Skip to content
OpenAdvisories

Package · Wolfi

reflex

30 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-111943 Public exploit

    Distrust compromised intermediate certificates in crypto/x509

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

    Go standard library crypto/x509 renovate golang Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  • High 8.6
    CVE-2026-24486 Public exploit

    Python-Multipart has Arbitrary File Write via Non-Default Configuration

    Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbi…

    Kludex python-multipart open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2025-62727 Public exploit

    Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

    Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

    Kludex starlette open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • Medium 6.4
    CVE-2025-61765 Public exploit

    python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

    python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserializatio…

    miguelgrinberg python-socketio open-webui reflex Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2024-39689 Public exploit

    Certifi removes GLOBALTRUST root certificate

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

    certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  • Medium 5.4
    CVE-2024-34064 Public exploit

    Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

    Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

    pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI