Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Moby

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Moby. Vulnerability Details CVEID:CVE-2024-41110 DESCRIPTION: Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine,...

AZL-57374 CVE-2025-22869 affecting package docker-compose for versions less than 2.27.0-4

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

AZL-57362 CVE-2025-22869 affecting package docker-buildx for versions less than 0.14.0-4

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2025-050)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-050 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims c...

Amazon Linux 2 : docker (ALASDOCKER-2025-051)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-051 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead ...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, s5cmd, direnv, external-dns, vault-k8s, gops, kuberay-operator, kubeadm-controlplane-controller, prometheus-operator, pulumi-kubernetes-operator, docker-credential-gcr, shfmt, kube-state-metrics, flux-image-automation-controller,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, s5cmd, direnv, external-dns, vault-k8s, gops, kuberay-operator, kubeadm-controlplane-controller, prometheus-operator, pulumi-kubernetes-operator, docker-credential-gcr, shfmt, kube-state-metrics, flux-image-automation-controller,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: external-dns, vault-k8s, flux-image-automation-controller, distribution, aws-signer-notation-plugin, oras, timoni, metacontroller, crane, rancher-loglevel, hello-world-golang, kubernetes-event-exporter, x509-certificate-exporter, docker-credential-acr-env, overmind,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, flux-kustomize-controller, grafana-agent-operator, direnv, external-dns, nvidia-container-toolkit, pulumi-language-dotnet, s5cmd, vault-k8s, gops, flannel, pulumi-kubernetes-operator, trivy, docker-credential-gcr,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, tigera-operator, newrelic-fluent-bit-output, smarter-device-manager, datadog-agent-fips, falco, pombump, aws-flb-firehose, kubewatch, dagger, flux-helm-controller, nri-memcached, prometheus-pushgateway, direnv, temporal-server, yq,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, tigera-operator, newrelic-fluent-bit-output, smarter-device-manager, datadog-agent-fips, falco, pombump, aws-flb-firehose, kubewatch, dagger, flux-helm-controller, nri-memcached, prometheus-pushgateway, direnv, temporal-server, yq,...

openSUSE Security Advisory (SUSE-SU-2024:4204-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:0586-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Low: docker

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors...

Low: docker

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors...

Low: docker

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors...

Low: docker

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors...

PT-2025-31369

Name of the Vulnerable Software and Affected Versions Moby versions prior to 28.0.0 Moby version 25.0.13 Description Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products...

CVE-2023-45288 affecting package docker-cli for versions less than 25.0.7-1

CVE-2023-45288 affecting package docker-cli for versions less than 25.0.7-1. An upgraded version of the package is available that resolves this issue...

Ubuntu: Security Advisory (USN-7161-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...