Skip to content
OpenAdvisories

Package · Wolfi

kserve-modelmesh

75 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-59903 Public exploit

    Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

    Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2026-49844 Public exploit

    Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

    Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

    Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-54515 Public exploit

    jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2025-48924 Public exploit

    Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

    Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

    Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven