Skip to content
OpenAdvisories

Package · Wolfi

jitsucom-jitsu-rotor

34 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2025-65945 Public exploit

    auth0/node-jws improper HMAC signature verification vulnerability

    auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

    auth0 node-jws langfuse-3-worker renovate Wolfi npm
  • Critical 9.4
    CVE-2025-7783 Public exploit

    Usage of unsafe random function in form-data for choosing boundary

    Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

    katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-optuna-enas Debian Ubuntu Azure Linux Wolfi npm
  • Critical 9.1
    CVE-2025-29927 Public exploit Scanner template EPSS 99%

    Authorization Bypass in Next.js Middleware

    Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check…

    vercel next.js jitsucom-jitsu-console next Wolfi npm
  • High 7.7
    CVE-2025-27152 Public exploit

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

    axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2024-46982 Public exploit EPSS 59%

    Cache Poisoning in next.js

    Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this craft…

    vercel next.js jitsucom-jitsu-console next Wolfi npm
  • High 7.5
    CVE-2024-34351 Public exploit Scanner template

    Next.js Server-Side Request Forgery in Server Actions

    Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …

    vercel next.js jitsucom-jitsu-console next Wolfi npm