Skip to content
OpenAdvisories

Package · Wolfi

tekton-pipelines-entrypoint-1.13

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-128085

    opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnor…

    open-telemetry opentelemetry-go go.opentelemetry.io/otel/sdk zot Wolfi Go
  • Medium 6.8
    CVE-2026-111943 Public exploit

    Distrust compromised intermediate certificates in crypto/x509

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  • Medium 6.1
    CVE-2026-94448

    Reset context tracking on consecutive template expressions in html/template

    When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent r…

    Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2026-97030

    Recognize yield as regexp preceder keyword in html/template

    A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

    Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-42507

    Arbitrary inputs are included in errors without any escaping in net/textproto

    When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

    Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go