Skip to content
OpenAdvisories

Package · Wolfi

nfpm

48 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-45570

    go-git: Improper single-quote escaping in go-git SSH transport

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside…

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Low 2.8
    CVE-2026-33762

    go-git: Missing validation decoding Index v4 files leads to panic

    go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously cra…

    go-git go-git zot kubescape Debian Ubuntu Wolfi Go
  • Low 2.5
    CVE-2026-27139

    FileInfo can escape from a Root in os

    On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by …

    Go standard library os langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Low 2.9
    CVE-2026-1229

    Incorrect calculation in CIRCL secp384r1 CombinedMult

    The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed…

    Cloudflare CIRCL zot kubescape Ubuntu Alpine Wolfi Go