Package · Wolfi

cadvisor-compat

45 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 7.3

CVE-2026-39883 Public exploit

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go

Apr 8, 2026
Medium 4.4

CVE-2025-22870 Public exploit

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 12, 2025
Critical 9.1

CVE-2024-45337 Public exploit

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 11, 2024