kubeflow-pipelines-apiserver

8 results · Clear filters · Feed

• High 7.5
  CVE-2026-56852 Public exploit

  Infinite loop on invalid input in golang.org/x/text

  A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

  golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jul 21, 2026
• High 7.3
  CVE-2026-39883 Public exploit

  OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

  open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  Apr 8, 2026
• High 8.2
  CVE-2026-0994 Public exploit

  Denial of Service in Python Protobuf

  A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

  Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  Jan 23, 2026
• High 7.5
  CVE-2025-65945 Public exploit

  auth0/node-jws improper HMAC signature verification vulnerability

  auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

  auth0 node-jws langfuse-3-worker renovate Wolfi npm
  Dec 4, 2025
• High 7.7
  CVE-2025-27152 Public exploit

  Possible SSRF and Credential Leakage via Absolute URL in axios Requests

  axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

  axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  Mar 7, 2025
• High 8.1
  CVE-2024-10220 Public exploit

  Arbitrary command execution through gitRepo volume

  The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

  Kubernetes Kubelet kubeflow-pipelines-apiserver kubeflow-pipelines-frontend Debian Azure Linux Wolfi Go
  Nov 22, 2024
• High 7.5
  CVE-2024-45590 Public exploit

  body-parser vulnerable to denial of service when url encoding is enabled

  body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denia…

  expressjs body-parser kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 10, 2024
• High 7.5
  CVE-2024-39689 Public exploit

  Certifi removes GLOBALTRUST root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

  certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  Jul 5, 2024