CVE-2024-3727High· 8.3▾ TwilightA flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.3%
Last analysed / modified upstream
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/containers/image < 5.30.1github.com/containers/image/v5 >= 5.30.0, < 5.30.1github.com/containers/image/v5 < 5.29.3Patched in:
github.com/containers/image 5.30.1github.com/containers/image/v5 5.30.1github.com/containers/image/v5 5.29.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-25934Medium· 4.3go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files (CVE-2026-25934)
CVE-2026-91333Low· 3.7openjdk: Improve ciphertext handling (Oracle CPU 2026-10) (CVE-2026-91333)
CVE-2026-106434Medium· 4.3The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)