Skip to content
OpenAdvisories

Package · Wolfi

kubeflow-pipelines-metadata-writer-compat

78 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.2
    CVE-2026-0994 Public exploit

    Denial of Service in Python Protobuf

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

    Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2025-65945 Public exploit

    auth0/node-jws improper HMAC signature verification vulnerability

    auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

    auth0 node-jws langfuse-3-worker renovate Wolfi npm
  • High 7.7
    CVE-2025-27152 Public exploit

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

    axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2024-10220 Public exploit

    Arbitrary command execution through gitRepo volume

    The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

    Kubernetes Kubelet kubeflow-pipelines-apiserver kubeflow-pipelines-frontend Debian Azure Linux Wolfi Go
  • High 7.5
    CVE-2024-45590 Public exploit

    body-parser vulnerable to denial of service when url encoding is enabled

    body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denia…

    expressjs body-parser kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2024-39689 Public exploit

    Certifi removes GLOBALTRUST root certificate

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

    certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI