Ecosystem
Wolfi
8,505 known vulnerabilities.
Most affected packages
chromium 3,268
chromium-docker-selenium-compat 1,659
chromium-lang 1,659
firefox 662
open-webui 266
langfuse-3-worker 248
katib-suggestion-hyperopt 237
katib-earlystopping 228
katib-suggestion-hyperband 222
katib-suggestion-pbt-enas 222
katib-suggestion-optuna-enas 222
katib-suggestion-skopt-enas 222
katib-suggestion-nas-darts 220
katib-suggestion-goptuna-compat 217
druid 214
katib-suggestion-nas-enas 210
katib-tfevent-metricscollector 208
renovate 199
thingsboard-tb-node 190
zot 182
kubescape 179
thingsboard-tb-mqtt-transport 178
prism 175
kots 171
zarf 164
k3d 162
openjdk-9-jre 162
opensearch-dashboards-3 158
skaffold 150
aactl 146
trivy 145
langfuse-3 145
k3s 144
kubeflow-pipelines-apiserver 143
scorecard 142
trino 142
airflow-3 141
k3s-static 141
helm-3 136
lerna 134
3,429 results · Clear filters · Feed
-
Medium 6.1
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from Java…
-
Medium 5.0
Istio Vulnerable to SSRF via RequestAuthentication jwksUri
Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to t…
-
Medium 6.3
OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger…
-
Medium 5.3
Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()
Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, b…
-
Medium 4.2
Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage…
-
Medium 5.4
Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform …
-
Medium 5.3
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromis…
-
Medium 5.4
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI s…
-
Medium 4.3
Insufficient validation of untrusted input in FedCM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker t…
-
Medium 4.3
Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross…
-
Medium 4.3
Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cro…
-
Medium 5.4
Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had comprom…
-
Medium 5.4
Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a us…
-
Medium 5.0
Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromi…
-
Medium 6.3
Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote at…
-
Medium 5.4
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a…
-
Medium 4.3
Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the l…
-
Medium 5.4
Insufficient validation of untrusted input in TabGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attack…
-
Medium 4.3
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a…
-
Medium 4.3
Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentia…
-
Medium 5.4
Insufficient validation of untrusted input in Dialog in Google Chrome prior to 148.0.7778.96 allowed a remote attacker …
-
Medium 4.2
Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who…
-
Medium 4.2
Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 148.0.7778.96 allowed a rem…
-
Medium 4.2
Insufficient data validation in DataTransfer in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had …
-
Medium 4.3
Insufficient policy enforcement in Autofill in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak c…
-
Medium 4.3
Out of bounds read in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data …
-
Medium 6.5
Uninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially …
-
Medium 6.3
Inappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same…
-
Medium 4.3
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-o…
-
Medium 4.3
Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rend…
-
Medium 6.3
Inappropriate implementation in ORB in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass site is…
-
Medium 4.3
Integer overflow in Network in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the r…
-
Medium 4.2
Insufficient validation of untrusted input in FileSystem in Google Chrome prior to 148.0.7778.96 allowed a remote attac…
-
Medium 5.3
Race in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proce…
-
Medium 5.4
Insufficient policy enforcement in DirectSockets in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to p…
-
Medium 4.3
Insufficient validation of untrusted input in Permissions in Google Chrome prior to 148.0.7778.96 allowed an attacker o…
-
Medium 5.4
Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced…
-
Medium 5.3
Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rend…
-
Medium 6.1
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 148.0.7778.96 allowed a remote attacker…
-
Medium 4.2
Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had…