VEXkubescape-synchronizer
kubescape-synchronizer
1 declaración, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/kubescape-synchronizer/2026-10-08
CVE-2026-33997
no afectado · código vulnerable ausente- docker v28.5.2+incompatible
CVE-2026-33997 is a privilege-validation bypass in the Moby daemon's plugin installation. The Kubescape synchronizer v0.0.166 links only Docker API type definitions. Checked with `go list -deps` on both binaries in the CI build (images run 37734562285, both arches): ./cmd/client and ./cmd/server each linked github.com/docker/docker/api/types/filters, api/types/registry and api/types/versions, and no client, daemon, plugin manager or api/server package. The build fails if daemon, plugin or api/server code is ever linked. The fix (29.3.1) exists only under the github.com/moby/moby module path, so the +incompatible module cannot be floated to it.