Package · Wolfi

kubeflow-pipelines-cache_server

96 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

High 7.5

CVE-2026-56852 Public exploit

Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go

Jul 21, 2026
High 7.3

CVE-2026-39883 Public exploit

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go

Apr 8, 2026
High 7.5

CVE-2025-65945 Public exploit

auth0/node-jws improper HMAC signature verification vulnerability

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

auth0 node-jws langfuse-3-worker renovate Wolfi npm

Dec 4, 2025
High 7.7

CVE-2025-27152 Public exploit

Possible SSRF and Credential Leakage via Absolute URL in axios Requests

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm

Mar 7, 2025
High 8.1

CVE-2024-10220 Public exploit

Arbitrary command execution through gitRepo volume

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Kubernetes Kubelet kubeflow-pipelines-apiserver kubeflow-pipelines-frontend Debian Azure Linux Wolfi Go

Nov 22, 2024
High 7.5

CVE-2024-45590 Public exploit

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denia…

expressjs body-parser kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm

Sep 10, 2024
High 7.5

CVE-2024-39689 Public exploit

Certifi removes GLOBALTRUST root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI

Jul 5, 2024