Red Hat Ai Inference Server vulnerabilities

14 CVEs affecting Red Hat Ai Inference Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18621, published 2026-08-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-28356, published 2026-03-12. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous…
CVE-2026-8461, published 2026-06-18. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. …
CVE-2026-56211, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control…
CVE-2026-42561, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing…
CVE-2026-45292, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the…
CVE-2026-56209, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an…
CVE-2025-69872, published 2026-02-11. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim…
CVE-2026-56210, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows…
CVE-2026-6385, published 2026-04-15. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability…
CVE-2026-18621, published 2026-08-10. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This…

Latest

CVE-2026-58049, published 2026-06-28. High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days. FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather…
CVE-2026-56208, published 2026-06-19. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer…
CVE-2026-12491, published 2026-06-17. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG…