Skip to content
OpenAdvisories

Package · Wolfi

langfuse-3-worker

248 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-114139

    Sentry-Javascript: Middleware Bypass when using Tunnel route

    Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel re…

    getsentry sentry-javascript langfuse-3-worker langfuse-3 Wolfi npm
  • Critical 9.1
    CVE-2026-90711

    proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

    proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, …

    proxy-addr proxy-addr langfuse-3-worker kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  • Critical 9.1
    CVE-2026-73420

    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can…

    nextauthjs @auth next-auth core Wolfi npm
  • Critical 9.4
    CVE-2026-73653

    Vitest: Browser Mode provider commands bypass the file-access permission gate

    Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied fil…

    vitest-dev vitest langfuse-3-worker langfuse-3-compat Wolfi npm
  • Critical 9.4
    CVE-2026-41242 Public exploit

    protobufjs has an arbitrary code execution issue

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that…

    protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm
  • Critical 9.1
    CVE-2026-27699

    Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

    The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (…

    patrickjuchli basic-ftp langfuse-3-worker code-server Debian Ubuntu Wolfi npm
  • Critical 9.1
    CVE-2025-68121

    Unexpected session resumption in crypto/tls

    During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

    Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go