Skip to content
OpenAdvisories

Package · Wolfi

kserve-localmodel

43 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-77524

    KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

    KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select K…

    kedacore keda k8sgpt kserve-agent Azure Linux Wolfi Go
  • Critical 9.1
    CVE-2026-78663

    Double flow control refund on HTTP/2 server streams in net/http

    The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.6
    CVE-2026-39821

    Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

    Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go