193 matches found
CVE-2026-54174
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash ".PKGINFO" etc. against the signed "APKINDEX", but never verified the data section hash the actual package files...
CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...
CVE-2026-54174: Improper Validation of Integrity Check Value
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...
GO-2023-1699 vulnerabilities
Vulnerabilities for packages: bom, ctop, helm, apko, up, ko, melange...
GO-2023-1700 vulnerabilities
Vulnerabilities for packages: bom, ctop, helm, apko, up, ko, melange...
GO-2023-1701 vulnerabilities
Vulnerabilities for packages: bom, ctop, helm, apko, up, ko, melange...
GO-2023-1754 vulnerabilities
Vulnerabilities for packages: apko, ko, aactl...
GO-2023-2181 vulnerabilities
Vulnerabilities for packages: spire-server, apko, policy-controller, tkn, skaffold, spire-server-fips, falcoctl-fips, ko, cosign, slsa-verifier, flux-source-controller, kubescape, melange, tekton-chains, aactl...
GO-2024-2719 vulnerabilities
Vulnerabilities for packages: tkn-fips, zarf, chainctl, slsa-verifier, spire-server-fips, goreleaser, gitsign, zot, flux-source-controller, melange, tekton-chains, policy-controller, tkn, wolfictl, spire-server, kubescape, falcoctl, apko, tekton-chains-fips, policy-controller-fips, skaffold,...
GO-2025-3367 vulnerabilities
Vulnerabilities for packages: k8sgpt, gitsign, pulumi-kubernetes-operator, src-fingerprint, syft, pulumi-language-dotnet, kargo, flux-kustomize-controller, pulumi-language-java, pulumi-language-yaml, crossplane, gptscript, trivy, k9s, wolfictl, snyk-cli, argo-events, flux-source-controller,...
GO-2025-3368 vulnerabilities
Vulnerabilities for packages: k8sgpt, gitsign, pulumi-kubernetes-operator, src-fingerprint, syft, pulumi-language-dotnet, kargo, flux-kustomize-controller, pulumi-language-java, pulumi-language-yaml, crossplane, gptscript, trivy, k9s, wolfictl, snyk-cli, argo-events, flux-source-controller,...
GO-2023-1700 vulnerabilities
Vulnerabilities for packages: ko, helm, bom, up, apko, ctop, melange...
GO-2026-4559 vulnerabilities
Vulnerabilities for packages: k3s, cloud-sql-proxy, caddy, pluto, opentelemetry-collector-contrib, crossplane-provider-aws-ec2, cluster-api-azure-controller, kube-rbac-proxy, tekton-pipelines, trivy, terraform-provider-grafana, cert-manager-webhook-pdns, crossplane-provider-aws-rds,...
GO-2026-4910 vulnerabilities
Vulnerabilities for packages: gitsign, cerbos, kyverno, pulumi-kubernetes-operator, gitaly, src-fingerprint, syft, pulumi-language-dotnet, kargo, witness, pulumi-language-java, pulumi-language-yaml, crossplane, xeol, gptscript, trivy, k9s, wolfictl, snyk-cli, argo-events, flux-source-controller,...
GO-2024-2466 vulnerabilities
Vulnerabilities for packages: gitness, gitsign, pulumi-kubernetes-operator, src-fingerprint, pulumi-language-dotnet, flux-kustomize-controller, pulumi-language-java, pulumi-language-yaml, nuclei, go-licenses, apko, zot, pulumi, goreleaser, kots, bom, scorecard, gomplate, kubevela...
GO-2025-3830 vulnerabilities
Vulnerabilities for packages: buildah, docker-cli-buildx, syft, opentelemetry-collector-contrib, kargo, falcoctl, buildkitd, opentelemetry-collector, trivy, k9s, wolfictl, dagger, docker-compose, osv-scanner, splunk-otel-collector, melange, tw, zarf, apko, aws-otel-collector, zot, spire-server,...
GO-2023-1699 vulnerabilities
Vulnerabilities for packages: ko, helm, bom, up, apko, ctop, melange...
GO-2023-1701 vulnerabilities
Vulnerabilities for packages: ko, helm, bom, up, apko, ctop, melange...
GO-2026-5026 vulnerabilities
Vulnerabilities for packages: gitness, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, kube-rbac-proxy, rancher-machine, tempo, xeol, grafana, logstash-exporter, k9s, nfpm, crossplane-provider-aws-rds, terraform-provider-pagerduty, malcontent, rancher-telemetry, openbao-k8s,...