Skip to content
OpenAdvisories

Package · Wolfi

kyverno-cli-1.17

109 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

50 results · Clear filters · Feed

  • High 8.1
    CVE-2026-41323

    Kyverno: ServiceAccount token leaked to external servers via apiCall service URL

    Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoin…

    kyverno kyverno kyverno-1.17 kyverno-cli-1.17 Wolfi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-32281

    Inefficient policy validation in crypto/x509

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32280

    Unexpected work during chain building in crypto/x509

    During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.8
    CVE-2026-27140

    Code execution vulnerability in SWIG code generation in cmd/go

    SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go
  • High 7.5
    CVE-2026-25679

    Incorrect parsing of IPv6 host literals in net/url

    url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

    Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.0
    CVE-2025-15558

    Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

    Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-build…

    Docker Docker CLI Compose zot Wolfi Go
  • High 7.0
    CVE-2026-24051

    OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes th…

    open-telemetry opentelemetry-go zot kubescape Azure Linux Wolfi Go