GO-2026-5105 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, argocd-image-updater, snyk-cli, pulumi-language-yaml, pulumi-language-java, witness, act, grafana-alloy, bom, trufflehog, terragrunt, gitlab-runner, rancher-fleet, pulumi-kubernetes-operator, gptscript, zot, xeol, zarf, cerbos,...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: aactl, ko, apko...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: melange, tkn, flux-source-controller, cosign, spire-server, tekton-chains, policy-controller, slsa-verifier, aactl, ko, kubescape, skaffold, apko...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-route53, chezmoi, crossplane-provider-family-aws, pulumi-language-yaml, mattermost, k3s, crossplane-provider-aws-eks, crossplane-provider-aws-rds, osv-scanner, wal-g, cloudflared, buildkitd, gatus,...

GO-2026-5018 vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-language-yaml, mattermost, k3s, osv-scanner, wal-g, buildkitd, gatus, terraform-provider-tls, kubernetes-dashboard, spire-server, opentelemetry-collector, cert-manager, grype, eksctl, fscrypt, step, external-dns, neuvector-sigstore-interface,...

GO-2026-4984 vulnerabilities

Vulnerabilities for packages: thanos, nova, grafana-alloy, migrate, addon-resizer, azure-service-operator, conjur-cli, k8s-device-plugin, local-static-provisioner, mattermost, k3s, rancher-webhook, keda, karma, spqr, incert, apache-exporter, lazydocker, kpt, litestream, aws-flb-kinesis,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, argocd-image-updater, chezmoi, containerd, snyk-cli, pulumi-language-yaml, nfpm, pulumi-language-java, act, witness, mattermost, terragrunt, aactl, k3s, pulumi-kubernetes-operator, gptscript, zot, zarf, prometheus-operator, kine, loki,...

GO-2026-5016 vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-language-yaml, mattermost, k3s, osv-scanner, wal-g, buildkitd, gatus, kubernetes-dashboard, spire-server, opentelemetry-collector, cert-manager, grype, fscrypt, external-dns, knative-serving, argo-cd, flux, argo-events, cloud-provider-aws, skaffold,...

GO-2026-5017 vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-language-yaml, mattermost, k3s, osv-scanner, wal-g, buildkitd, gatus, kubernetes-dashboard, spire-server, opentelemetry-collector, cert-manager, grype, fscrypt, external-dns, knative-serving, argo-cd, flux, argo-events, cloud-provider-aws, skaffold,...

GO-2026-4981 vulnerabilities

Vulnerabilities for packages: thanos, nova, grafana-alloy, migrate, azure-service-operator, conjur-cli, k8s-device-plugin, mattermost, k3s, rancher-webhook, spqr, kpt, litestream, aws-flb-kinesis, fluent-bit-plugin-loki, buildkitd, gatus, crossplane, cloud-sql-proxy, terraform-provider-tls,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: chezmoi, openbao, witness, grafana-alloy, mattermost, dbmate, terragrunt, aactl, ratify, k3s, jitsucom-bulker, sftpgo, seaweedfs, caddy, kine, loki, croc, cerbos, argo-workflows, tailscale, certificate-transparency, amass, splunk-otel-collector, kots, gitsign, gitea,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: falcoctl, gh, aactl, zot, zarf, sigstore-scaffolding, cosign, tekton-chains, gitsign, slsa-verifier, apko, melange, flux-source-controller, spire-server, wolfictl, trivy, rekor, vexctl, neuvector-sigstore-interface, tkn, policy-controller, kubescape...

CLEANSTART-2026-UC75488 Security fixes in apko 1.2.13-r0

Package apko version 1.2.13-r0 fixes 24 vulnerabilities: ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29, CVE-2026-45570, CVE-2026-45571...

GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...

CLEANSTART-2026-CV49545 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-3xc5-wrhm-f963, ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29 applied in versions: 1.2.13-r0, 1.2.2-r0

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WU14778 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 1.2.15-r1

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-language-yaml, mattermost, k3s, osv-scanner, wal-g, buildkitd, gatus, terraform-provider-tls, kubernetes-dashboard, spire-server, opentelemetry-collector, cert-manager, grype, eksctl, fscrypt, step, external-dns, neuvector-sigstore-interface,...

GO-2026-5422 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko

apko doesn't verify downloaded apk packages against APKINDEX checksum package substitution possible in chainguard.dev/apko...

GO-2026-5497 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko

apko DiscoverKeys has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko...

CLEANSTART-2026-VD09973 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-45570, CVE-2026-45571, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-3xc5-wrhm-f963, ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29 applied in versions: 1.2.13-r0, 1.2.2-r0

Multiple security vulnerabilities affect the apko package. These issues are resolved in later releases. See references for individual vulnerability details...