Skip to main content
Testkube 2.15.0 is out! AI Governance, GitLab in AI Test Creation, an executions timeline, and much more! Read More

testkube-migration-2.15.1_linux_amd64

digestsha256:b1beb07e80abd43e8b79b1649b467dba3be4d4903bcf7968367cb52db687adc4
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0 unspecified: 3
platformlinux/amd64
size56 MB
packages278
critical: 0 high: 1 medium: 0 low: 0 github.com/docker/cli 29.7.2+incompatible (golang)

pkg:golang/github.com/docker/cli@29.7.2%2Bincompatible
high : CVE--2025--15558

Affected range>=19.03.0+incompatible
Fixed versionNot Fixed
EPSS Score0.549%
EPSS Percentile46th percentile
Description

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

critical: 0 high: 0 medium: 0 low: 0 unspecified: 1golang.org/x/crypto 0.58.0 (golang)

pkg:golang/golang.org/x/crypto@0.58.0
unspecified : GO--2026--5932

Affected range<0.58.1-0.20261009181718-2f1f834330b2
Fixed version0.58.1-0.20261009181718-2f1f834330b2
Description

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

critical: 0 high: 0 medium: 0 low: 0 unspecified: 1github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang)

pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589
unspecified : GO--2026--6225

Affected range>=0
Fixed versionNot Fixed
Description

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.

critical: 0 high: 0 medium: 0 low: 0 unspecified: 1stdlib 1.26.10 (golang)

pkg:golang/stdlib@1.26.10
unspecified : CVE--2026--97054

Affected range<1.26.11
Fixed version1.26.11
EPSS Score0.171%
EPSS Percentile7th percentile
Description

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.