CVE-2026-40895 vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards, kubeflow-katib, prism, thingsboard, lerna, configurable-http-proxy, kubeflow-pipelines, nextcloud-server, langfuse, saf, argo-workflows...

CVE-2026-24055-OAuth-Langfuse

CVE-2026-24055 — Unauthenticated Slack OAuth Install in Langfuse Course Project for Web and Application Security — Group 06, class NT213.Q21.ANTT 📌 Summary The project reproduces a real-world security vulnerability that has been publicly disclosed CVE-2026-24055 on the Langfuse platform — an OAut...

CLEANSTART-2026-EL48744 deepmerge through 4

Security vulnerability affects the langfuse package. deepmerge through 4...

CLEANSTART-2026-CT49396 Security fix for GHSA-8c8m-p3m8-cjg8 applied in: langfuse 3.225.9-r9

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UK27517 Security fix for GHSA-m943-m63m-w62w applied in: langfuse 3.225.9-r9

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SI96600 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node

Security vulnerability affects the langfuse package. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node...

CLEANSTART-2026-HH69772 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node

Security vulnerability affects the langfuse package. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node...

CLEANSTART-2026-CU33434 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node

Security vulnerability affects the langfuse package. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node...

CLEANSTART-2026-CE91975 Security fix for GHSA-85x2-q946-cp5h applied in: langfuse 3.225.9-r9

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WP68198 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node

Security vulnerability affects the langfuse package. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node...

CLEANSTART-2026-WM61981 undici is an HTTP client library for Node

Security vulnerability affects the langfuse package. undici is an HTTP client library for Node...

CLEANSTART-2026-KY75072 undici is an HTTP client library for Node

Security vulnerability affects the langfuse package. undici is an HTTP client library for Node...

CLEANSTART-2026-RY81711 Sentry-Javascript is an official Sentry SDKs for JavaScript

Security vulnerability affects the langfuse package. Sentry-Javascript is an official Sentry SDKs for JavaScript...

CLEANSTART-2026-HO83429 Security fix for GHSA-2464-fhr4-w9xw applied in: langfuse 3.225.9-r9

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EN47680 Security fix for GHSA-673q-mjm6-r5xr applied in: langfuse 3.225.9-r9

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WD98383 body-parser is body parsing middleware for Node

Security vulnerability affects the langfuse-worker package. body-parser is body parsing middleware for Node...

CLEANSTART-2026-EL23161 ### Summary `qs

Security vulnerability affects the langfuse-worker package. Summary qs...

CLEANSTART-2026-CX09609 deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects

Security vulnerability affects the langfuse package. deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects...

ai-kubernetes-helm-chart-security

AI on Kubernetes: Helm chart security defaults evidence This repository holds the data and evidence behind the Sorami technical report "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" version 1.2. Read the report here: https://sorami.com.au/research/ai-kubernetes-helm-chart-security...

CLEANSTART-2026-VH83166 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree

Security vulnerability affects the langfuse-worker package. PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree...