Skip to content
OpenAdvisories

Package · Wolfi

lerna

134 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-40175 Public exploit

    Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

    Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …

    axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 4.3
    CVE-2026-33532 Public exploit

    yaml is vulnerable to Stack Overflow via deeply nested YAML collections

    `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase…

    eemeli yaml langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 4.0
    CVE-2024-33883 Public exploit

    ejs lacks certain pollution protection

    The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

    lerna node-ejs ejs node-ejs Debian Ubuntu Wolfi npm