Package · Wolfi

act

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 7.1

CVE-2026-17106 Public exploit

Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

Docker moby Docker Desktop Docker Sandboxes Debian Ubuntu Azure Linux Wolfi Go

Aug 18, 2026
High 7.5

CVE-2026-56852 Public exploit

Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go

Jul 21, 2026