2026 CVE Vulnerabilities
47,770 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-18950 | HIGH | 8.8 | 0.4% | Aug 10, 2026 | A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how Rol... |
| CVE-2026-18949 | HIGH | 8.8 | 0.4% | Aug 10, 2026 | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Ac... |
| CVE-2026-18948 | CRITICAL | 9.9 | 0.7% | Aug 10, 2026 | A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, whic... |
| CVE-2026-18947 | HIGH | 8.5 | 0.4% | Aug 10, 2026 | A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental... |
| CVE-2026-18942 | MEDIUM | 5.5 | 0.3% | Aug 10, 2026 | A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. Th... |
| CVE-2026-18941 | HIGH | 7.7 | 0.6% | Aug 10, 2026 | A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is... |
| CVE-2026-18621 | HIGH | 7.6 | 0.4% | Aug 10, 2026 | A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security harde... |
| CVE-2026-18620 | HIGH | 7.1 | 0.3% | Aug 10, 2026 | A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerab... |
| CVE-2026-18618 | HIGH | 7.5 | 0.5% | Aug 10, 2026 | A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to kn... |
| CVE-2026-18617 | HIGH | 8.8 | 0.4% | Aug 10, 2026 | A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the sp... |
| CVE-2026-18611 | HIGH | 7.5 | 0.4% | Aug 10, 2026 | A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive... |
| CVE-2026-18608 | HIGH | 8.7 | 0.4% | Aug 10, 2026 | A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permission... |
| CVE-2026-16456 | MEDIUM | 6.5 | 0.3% | Aug 10, 2026 | A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can ex... |
| CVE-2026-15581 | HIGH | 8 | 0.3% | Aug 10, 2026 | A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to b... |
| CVE-2026-15467 | HIGH | 8.1 | 0.4% | Aug 10, 2026 | A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can e... |
| CVE-2026-14450 | CRITICAL | 9.9 | 0.5% | Aug 10, 2026 | A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy... |
| CVE-2026-13717 | HIGH | 8.8 | 0.4% | Aug 10, 2026 | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serv... |
| CVE-2026-11810 | HIGH | 7.5 | 0.3% | Aug 10, 2026 | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) pars... |
| CVE-2026-11809 | LOW | 3.7 | 0.3% | Aug 10, 2026 | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z... |
| CVE-2026-72902 | CRITICAL | 9.9 | 0.5% | Aug 10, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to... |
| CVE-2026-72901 | CRITICAL | 9.9 | 0.6% | Aug 10, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-pri... |
| CVE-2026-72886 | CRITICAL | 9.9 | — | Aug 10, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.u... |
| CVE-2026-72885 | NONE | 0 | 0.6% | Aug 10, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokp... |
| CVE-2026-72884 | HIGH | 8.7 | 0.4% | Aug 10, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/... |
| CVE-2026-72883 | HIGH | 8.8 | 0.4% | Aug 10, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now