Skip to content
OpenAdvisories

Package · Wolfi

gitlab-runner-18.10

40 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.2
    CVE-2026-42306

    Moby: Race condition in docker cp allows bind mount redirection to host path

    Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redire…

    moby moby zot kots Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-7250

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper i…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.3
    CVE-2026-8589

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targete…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby Docker Engine moby/v2/daemon Debian Ubuntu Alpine Wolfi Go
  • High 7.5
    CVE-2026-42504

    Quadratic complexity in WordDecoder.DecodeHeader in mime

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

    Go standard library mime golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-39829

    Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

    The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by …

    golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2026-46597

    Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

    An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

    golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2026-33814

    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.7
    CVE-2026-35469

    SpdyStream: DOS on CRI

    spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTING…

    moby spdystream kubescape kots Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby zot kots Debian Ubuntu Alpine Wolfi Go
  • High 8.1
    CVE-2026-2370

    Improper Handling of Parameters in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions t…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.5
    CVE-2026-27141

    Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

    Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

    golang.org/x/net golang.org/x/net/http2 zot zarf Ubuntu Azure Linux Alpine Wolfi Go