Skip to content
OpenAdvisories

Package · Wolfi

superset-6.0

84 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026
  • Medium 6.8
    CVE-2026-111943 Public exploit

    Distrust compromised intermediate certificates in crypto/x509

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  • Critical 9.2
    CVE-2026-112403 Public exploit

    Pillow: Heap buffer overflow in ImagingJpegDecode

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is re…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • Critical 9.1
    CVE-2026-102268 Public exploit

    PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

    jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 4.4
    CVE-2026-25645 Public exploit

    Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

    psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  • High 7.1
    CVE-2026-24049 Public exploit

    wheel Allows Arbitrary File Permission Modification via Path Traversal

    wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…

    pypa wheel open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI