Red Hat Ai Inference Server 3.3 vulnerabilities

10 CVEs affecting Red Hat Ai Inference Server 3.3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56211, published 2026-06-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-56211, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control…
CVE-2026-6100, published 2026-04-13. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is…
CVE-2026-4111, published 2026-03-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is…
CVE-2025-14831, published 2026-02-09. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates…
CVE-2026-56209, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an…
CVE-2026-40164, published 2026-04-14. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table…
CVE-2026-56210, published 2026-06-19. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows…
CVE-2026-4786, published 2026-04-13. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the…
CVE-2026-56208, published 2026-06-19. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer…
CVE-2026-10118, published 2026-06-01. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the…