kubeflow-volumes-web-app

8 results · Clear filters · Feed

• Medium 4.4
  CVE-2026-25645 Public exploit

  Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

  Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

  psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 25, 2026
• Medium 6.3
  CVE-2026-27199 Public exploit

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

  pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  Feb 21, 2026
• Medium 6.2
  CVE-2024-3651 Public exploit

  Denial of Service via Quadratic Complexity in kjd/idna

  A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

  kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 7, 2024
• High 7.5
  CVE-2024-39689 Public exploit

  Certifi removes GLOBALTRUST root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

  certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  Jul 5, 2024
• High 7.5
  CVE-2024-34069 Public exploit

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI
  May 6, 2024
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 6, 2024
• High 8.0
  CVE-2023-46136 Public exploit

  Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Azure Linux Alpine Wolfi PyPI
  Oct 24, 2023
• Medium 5.9
  CVE-2023-43804 Public exploit

  `Cookie` HTTP header isn't stripped on cross-origin redirects

  urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

  urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 4, 2023