kubeflow-pipelines-cache-deployer

8 results · Clear filters · Feed

• High 7.5
  CVE-2025-65945 Public exploit

  auth0/node-jws improper HMAC signature verification vulnerability

  auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

  auth0 node-jws langfuse-3-worker renovate Wolfi npm
  Dec 4, 2025
• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025
• High 7.7
  CVE-2025-27152 Public exploit

  Possible SSRF and Credential Leakage via Absolute URL in axios Requests

  axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

  axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  Mar 7, 2025
• Critical 9.1
  CVE-2024-45337 Public exploit

  Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

  Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

  golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 11, 2024
• High 8.1
  CVE-2024-10220 Public exploit

  Arbitrary command execution through gitRepo volume

  The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

  Kubernetes Kubelet kubeflow-pipelines-apiserver kubeflow-pipelines-frontend Debian Azure Linux Wolfi Go
  Nov 22, 2024
• High 7.5
  CVE-2024-45590 Public exploit

  body-parser vulnerable to denial of service when url encoding is enabled

  body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denia…

  expressjs body-parser kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 10, 2024
• Medium 6.2
  CVE-2024-3651 Public exploit

  Denial of Service via Quadratic Complexity in kjd/idna

  A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

  kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 7, 2024
• High 7.5
  CVE-2024-39689 Public exploit

  Certifi removes GLOBALTRUST root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

  certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  Jul 5, 2024