kubeflow-centraldashboard

6 results · Clear filters · Feed

• Critical 9.1
  CVE-2026-90711

  proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

  proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, …

  proxy-addr proxy-addr langfuse-3-worker kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 15, 2026
• Critical 9.2
  CVE-2026-59873

  node-tar: Decompression/parse DoS via unlimited input

  node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

  isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  Jul 8, 2026
• Critical 9.4
  CVE-2026-41242 Public exploit

  protobufjs has an arbitrary code execution issue

  protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that…

  protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm
  Apr 18, 2026
• Critical 9.4
  CVE-2025-7783 Public exploit

  Usage of unsafe random function in form-data for choosing boundary

  Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-skopt-enas Debian Ubuntu Azure Linux Wolfi npm
  Jul 18, 2025
• Critical 9.8
  CVE-2025-1302 Public exploit Scanner template EPSS 10%

  JSONPath Plus allows Remote Code Execution

  Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. **Note:** T…

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-optuna-enas Wolfi npm
  Feb 15, 2025
• Critical 9.8
  CVE-2024-21534 Public exploit

  JSONPath Plus Remote Code Execution (RCE) Vulnerability

  All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were severa…

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-hyperband Wolfi npm Maven
  Oct 11, 2024