vcluster-syncer

8 results · Clear filters · Feed

• High 7.5
  CVE-2026-56852 Public exploit

  Infinite loop on invalid input in golang.org/x/text

  A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

  golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jul 21, 2026
• High 7.2
  CVE-2026-41567 Public exploit

  Docker: `PUT /containers/{id}/archive` executes container binary on the host

  Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

  Docker moby Docker Engine moby/v2/daemon Debian Ubuntu Alpine Wolfi Go
  Jun 5, 2026
• Medium 6.5
  CVE-2026-27145 Public exploit

  Inefficient candidate hostname parsing in crypto/x509

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

  Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  Jun 2, 2026
• High 7.3
  CVE-2026-39883 Public exploit

  OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

  open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  Apr 8, 2026
• High 8.8
  CVE-2026-34040 Public exploit

  Moby: AuthZ plugin bypass with oversized request body

  Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

  moby moby zot kots Debian Ubuntu Alpine Wolfi Go
  Mar 31, 2026
• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025
• Critical 9.1
  CVE-2024-45337 Public exploit

  Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

  Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

  golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 11, 2024
• Critical 10.0
  CVE-2024-41110 Public exploit EPSS 16%

  Moby authz zero length regression

  Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances…

  moby moby katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 24, 2024