https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:39:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-28500 <p><strong>Affected:</strong> onnx, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI (RHOAI)</p> <p>Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim&#39;s machine the moment the model is loaded. As of time of publication, no known patched versions are available.</p> <p><strong>Affected:</strong> onnx, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI (RHOAI)</p> <p>Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim&#39;s machine the moment the model is loaded. As of time of publication, no known patched versions are available.</p> https://cve.radiocsirt.org/vuln/cve-2026-28500