https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-351223 EUVD-2026-351223 https://cve.radiocsirt.org/vuln/euvd-2026-351223 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18941 <p>A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is &#34;no_auth,&#34; meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.</p> <p>A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is &#34;no_auth,&#34; meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18941 https://cve.radiocsirt.org/vuln/ghsa-2xfw-wg76-86w9 <p>A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is &#34;no_auth,&#34; meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.</p> <p>A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is &#34;no_auth,&#34; meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (RCE) by storing a malicious User-Defined Function (UDF) on the feature-server, trigger a denial of service (DoS) by forcing re-materialization of all tenant features, and gain unauthorized access to cross-tenant data.</p> https://cve.radiocsirt.org/vuln/ghsa-2xfw-wg76-86w9 https://cve.radiocsirt.org/vuln/rhsa-2026:53261 <p>guardrails-detectors: guardrails-detectors: Unauthenticated Regular-Expression Denial of Service (ReDoS) via detector_params.regex trustyai-service-operator: trustyai-service-operator: LMEvalJob sidecar containers bypass protected environment variable filtering, allowing TRUST_REMOTE_CODE policy override trustyai-service-operator: trustyai-service-operator: TAS internal Service bypasses kube-rbac-proxy, exposing unauthenticated Quarkus API cluster-wide odh-model-controller: odh-model-controller: Cross-namespace secret read via NIM Account CRD confused deputy odh-dashboard: odh-dashboard: Backend port 8080 trusts x-forwarded-access-token without origin validation data-science-pipelines-operator: DSPO: Operator ClusterRole grants pods/exec:*, kubeflow.org */*, and ClusterRole/Binding CRUD cluster-wide data-science-pipelines-operator: DSPO: Cryptographically weak secret generation (math/rand) for DB and S3 credentials data-science-pipelines-operator: DSPO: MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod ml-metdata: Bundled gRPC 1.46.3 (2022) with published HTTP/2 DoS CVEs — directly reachable on listener data-sciences-pipeline: User-controlled ServiceAccount for workflow pods without authorization check — confused deputy data-sciences-pipeline: DSP: V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening feast: feast-operator: Feast: Default authentication mode is no_auth — shared mu…</p> <p>guardrails-detectors: guardrails-detectors: Unauthenticated Regular-Expression Denial of Service (ReDoS) via detector_params.regex trustyai-service-operator: trustyai-service-operator: LMEvalJob sidecar containers bypass protected environment variable filtering, allowing TRUST_REMOTE_CODE policy override trustyai-service-operator: trustyai-service-operator: TAS internal Service bypasses kube-rbac-proxy, exposing unauthenticated Quarkus API cluster-wide odh-model-controller: odh-model-controller: Cross-namespace secret read via NIM Account CRD confused deputy odh-dashboard: odh-dashboard: Backend port 8080 trusts x-forwarded-access-token without origin validation data-science-pipelines-operator: DSPO: Operator ClusterRole grants pods/exec:*, kubeflow.org */*, and ClusterRole/Binding CRUD cluster-wide data-science-pipelines-operator: DSPO: Cryptographically weak secret generation (math/rand) for DB and S3 credentials data-science-pipelines-operator: DSPO: MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod ml-metdata: Bundled gRPC 1.46.3 (2022) with published HTTP/2 DoS CVEs — directly reachable on listener data-sciences-pipeline: User-controlled ServiceAccount for workflow pods without authorization check — confused deputy data-sciences-pipeline: DSP: V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening feast: feast-operator: Feast: Default authentication mode is no_auth — shared mu…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:53261 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2750 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2750