Skip to content
OpenAdvisories

Package · Wolfi

gitlab-docker-machine-18.6

30 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.2
    CVE-2026-42306

    Moby: Race condition in docker cp allows bind mount redirection to host path

    Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redire…

    moby moby zot kots Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-7250

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper i…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.3
    CVE-2026-8589

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targete…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby Docker Engine moby/v2/daemon Debian Ubuntu Alpine Wolfi Go
  • High 7.5
    CVE-2026-33814

    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby zot kots Debian Ubuntu Alpine Wolfi Go
  • High 8.1
    CVE-2026-2370

    Improper Handling of Parameters in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions t…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.5
    CVE-2026-25679

    Incorrect parsing of IPv6 host literals in net/url

    url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

    Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go