Skip to content
OpenAdvisories

Package · Wolfi

dockerd-29

47 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

47 results · Feed

  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go
  • Low 2.9
    CVE-2026-1229

    Incorrect calculation in CIRCL secp384r1 CombinedMult

    The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed…

    Cloudflare CIRCL zot kubescape Ubuntu Alpine Wolfi Go
  • High 8.6
    CVE-2025-61732

    Potential code smuggling via doc comments in cmd/cgo

    A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

    Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.0
    CVE-2026-24051

    OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes th…

    open-telemetry opentelemetry-go zot kubescape Azure Linux Wolfi Go
  • Medium 4.7
    CVE-2026-24686

    go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names

    go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and …

    theupdateframework go-tuf zot kubescape Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2026-23992

    go-tuf improperly validates the configured threshold for delegations

    go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signatu…

    theupdateframework go-tuf zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2026-23991

    go-tuf affected by client DoS via malformed server response

    go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will p…

    theupdateframework go-tuf zot kubescape Debian Ubuntu Azure Linux Wolfi Go