{"matches":[{"vulnerability":{"id":"GO-2026-4887","dataSource":"https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","namespace":"govulndb:language:go","severity":"High","urls":["https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":7.091550000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34040","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-x744-4wpc-v9h2","dataSource":"https://github.com/advisories/GHSA-x744-4wpc-v9h2","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://nvd.nist.gov/vuln/detail/CVE-2026-34040","https://github.com/moby/moby/releases/tag/docker-v29.3.1"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GO-2026-4887","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"description":"Go JOSE: DoS when parsing JWKs that contain RSA keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.6"],"state":"fixed","available":[{"version":"4.1.6","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.2745},"relatedVulnerabilities":[{"id":"CVE-2026-116587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.6"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=41a8099e429d2e26","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-pxq6-2prw-chj9","dataSource":"https://github.com/advisories/GHSA-pxq6-2prw-chj9","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a","https://docs.docker.com/engine/extend/legacy_plugins","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33997"],"description":"Moby has an Off-by-one error in its plugin privilege validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.23717999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-33997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/security/cve/CVE-2026-33997","https://bugzilla.redhat.com/show_bug.cgi?id=2453277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-pxq6-2prw-chj9","versionConstraint":"<29.3.1 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panics in JSON parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=41a8099e429d2e26","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panic during CBC-HMAC processing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.15708},"relatedVulnerabilities":[{"id":"CVE-2026-116585","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=41a8099e429d2e26","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-685w-q87j-wqw3","dataSource":"https://github.com/advisories/GHSA-685w-q87j-wqw3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-85747","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"description":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.12861999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-85747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2","https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3"],"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/distribution","version":"v2.8.3+incompatible"}},"found":{"vulnerabilityID":"GHSA-685w-q87j-wqw3","versionConstraint":"<=2.8.3 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible?package-id=3ecf5daaa007448a","name":"github.com/docker/distribution","version":"v2.8.3+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:distribution:v2.8.3\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk="}}},{"vulnerability":{"id":"GHSA-x86f-5xw2-fm2r","dataSource":"https://github.com/advisories/GHSA-x86f-5xw2-fm2r","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://nvd.nist.gov/vuln/detail/CVE-2026-41567"],"description":"Docker: `PUT /containers/{id}/archive` executes container binary on the host","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11392499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-41567","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41567","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/security/cve/CVE-2026-41567","https://bugzilla.redhat.com/show_bug.cgi?id=2485356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json"],"description":"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":0.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-x86f-5xw2-fm2r","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.60.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.60.0?package-id=e090465aca4b3a43","name":"golang.org/x/net","version":"v0.60.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.60.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU="}}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.60.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.60.0?package-id=e090465aca4b3a43","name":"golang.org/x/net","version":"v0.60.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.60.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU="}}},{"vulnerability":{"id":"GHSA-rg2x-37c3-w2rh","dataSource":"https://github.com/advisories/GHSA-rg2x-37c3-w2rh","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","https://nvd.nist.gov/vuln/detail/CVE-2026-42306"],"description":"Docker: Race condition in docker cp allows bind mount redirection to host path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07644},"relatedVulnerabilities":[{"id":"CVE-2026-42306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-rg2x-37c3-w2rh","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-vp62-88p7-qqf5","dataSource":"https://github.com/advisories/GHSA-vp62-88p7-qqf5","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5","https://nvd.nist.gov/vuln/detail/CVE-2026-41568"],"description":"Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.05993999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41568","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41568","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-vp62-88p7-qqf5","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.57.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.57.0?package-id=4a7180a3454dcfdc","name":"golang.org/x/crypto","version":"v0.57.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.57.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.57.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M="}}}],"source":{"type":"file","target":"trufflesecurity/trufflehog"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:08:32.508990112Z"}}