kserve-storage-controller

6 results · Clear filters · Feed

• High 8.8
  CVE-2026-104851 Public exploit

  fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

  fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Templa…

  fsspec filesystem_spec open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  Oct 2, 2026
• High 8.2
  CVE-2026-0994 Public exploit

  Denial of Service in Python Protobuf

  A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

  Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  Jan 23, 2026
• High 7.1
  CVE-2026-24049 Public exploit

  wheel Allows Arbitrary File Permission Modification via Path Traversal

  wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…

  pypa wheel open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 22, 2026
• High 7.5
  CVE-2025-67221 Public exploit

  orjson does not limit recursion for deeply nested JSON documents

  The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

  kserve-storage-controller datadog-agent-7.72-core-integrations datadog-agent-7.73-core-integrations py3.13-ambassador Wolfi PyPI
  Jan 22, 2026
• High 7.5
  CVE-2025-62727 Public exploit

  Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

  Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

  Kludex starlette open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  Oct 28, 2025
• High 7.7
  CVE-2025-47273 Public exploit

  setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

  setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to ar…

  pypa setuptools kserve-storage-controller datadog-agent-7.77 Debian Ubuntu Azure Linux Wolfi PyPI
  May 17, 2025