Skip to content
OpenAdvisories

Package · Wolfi

langfuse-3-compat

99 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-73420

    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can…

    nextauthjs @auth next-auth core Wolfi npm
  • Critical 9.4
    CVE-2026-73653

    Vitest: Browser Mode provider commands bypass the file-access permission gate

    Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied fil…

    vitest-dev vitest langfuse-3-worker langfuse-3-compat Wolfi npm