Skip to content
OpenAdvisories

Ecosystem

Wolfi

8,498 known vulnerabilities.

Most affected packages

chromium 3,268 chromium-docker-selenium-compat 1,659 chromium-lang 1,659 firefox 662 open-webui 266 langfuse-3-worker 248 katib-suggestion-hyperopt 237 katib-earlystopping 228 katib-suggestion-hyperband 222 katib-suggestion-pbt-enas 222 katib-suggestion-optuna-enas 222 katib-suggestion-skopt-enas 222 katib-suggestion-nas-darts 220 katib-suggestion-goptuna-compat 217 druid 214 katib-suggestion-nas-enas 210 katib-tfevent-metricscollector 208 renovate 199 thingsboard-tb-node 190 zot 182 kubescape 179 thingsboard-tb-mqtt-transport 178 prism 175 kots 171 zarf 164 openjdk-9-jre 162 k3d 161 opensearch-dashboards-3 158 skaffold 150 aactl 146 trivy 145 langfuse-3 145 k3s 144 kubeflow-pipelines-apiserver 143 scorecard 142 trino 142 airflow-3 141 k3s-static 141 helm-3 136 lerna 134
All Critical High Medium Low Exploited only Public exploit

128 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-29425 Public exploit EPSS 11%

    Possible limited path traversal vulnerabily in Apache Commons IO

    In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…

    Apache Software Foundation Apache Commons IO druid commons-io:commons-io Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2020-8554 Public exploit

    Kubernetes man in the middle using LoadBalancer or ExternalIPs

    Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a pri…

    Kubernetes Kubernetes kubernetes-1.35 kubernetes Debian Azure Linux Wolfi Go
  • Medium 5.2
    CVE-2020-15257 Public exploit

    containerd-shim API Exposed to Host Network Containers

    containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s AP…

    containerd containerd ctop docker.io Debian Ubuntu Alpine Wolfi Go
  • Medium 5.3
    CVE-2020-26235 Public exploit

    Segmentation fault in Rust time crate

    In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the …

    time-rs time zellij berg Ubuntu Alpine Wolfi crates.io
  • Medium 6.4
    CVE-2020-8559 Public exploit

    Privilege escalation from compromised node to cluster

    The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

    Kubernetes Kubernetes zot kots Debian Alpine Wolfi Go
  • Medium 6.9
    CVE-2020-11022 Public exploit EPSS 99%

    jQuery has a potential XSS vulnerability

    In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

    jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems
  • Medium 5.9
    CVE-2019-10172 Public exploit EPSS 17%

    Improper Restriction of XML External Entity Reference in jackson-mapper-asl

    A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

    Red Hat jackson-mapper-asl tez spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  • Medium —
    CVE-2007-0450 Public exploit EPSS 91%

    Apache Tomcat Directory Traversal

    Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with com…

    org.apache.tomcat:tomcat apache2 Wolfi Maven