GO-2023-1754 vulnerabilities

Vulnerabilities for packages: aactl, apko, ko...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: kargo, tekton-chains, tkn, goreleaser, argo-workflows, cosign, spire-server, vexctl, step-ca, weaviate, fulcio, step, bank-vaults, skaffold, temporal-ui-server, grpc-health-probe, ko, nerdctl, sigstore-scaffolding, zot, kubescape, cloudflared, kots, minio,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, skaffold, ko, melange, cosign, slsa-verifier, kubescape, spire-server, flux-source-controller, policy-controller, aactl, apko...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, crossplane-provider-aws-iam, goreleaser, crossplane-provider-aws-kinesis, argo-workflows, cosign, kubevela, crossplane-provider-aws-sns, flux, pulumi, kaniko, crossplane-provider-family-aws, spire-server, vexctl, actions-runner-controller,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: loki, prometheus-operator, trivy-operator, kaf, kyverno, flux, fscrypt, pulumi, spire-server, cilium, prometheus, podman, witness, gitlab-kas, gptscript, kubernetes, osv-scanner, chezmoi, skaffold, argo-events, istio, nerdctl, kubescape, splunk-otel-collector, zot,...

GO-2026-5017 vulnerabilities

Vulnerabilities for packages: rancher-agent, trivy-operator, kyverno, pulumi, rootlesskit, gatus, rancher, istio, syft, kots, gh, k9s, gomplate, cloud-provider-aws, docker, wal-g, cilium-cli, containerd, zarf, mattermost, loki, spire-server, cilium, kubernetes, splunk-otel-collector, kubescape,...

GO-2026-4981 vulnerabilities

Vulnerabilities for packages: coredns, tekton-chains, argo-workflows, kyverno, kuma, gatus, nats, secrets-store-csi-driver-provider-azure, vault-secrets-webhook, authservice, ko, temporal-server, istio, kots, cert-manager-csi-driver, xeol, runc, octo-sts, k8sgpt, sops, aws-flb-kinesis, cilium-cli...

GO-2026-4984 vulnerabilities

Vulnerabilities for packages: coredns, tekton-chains, kbld, argo-workflows, controller-gen, manifest-tool, kyverno, pdfcpu, kuma, gatus, nats, cni-plugins, http-echo, secrets-store-csi-driver-provider-azure, cert-exporter, vault-secrets-webhook, authservice, ko, temporal-server, istio, govulnchec...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: rancher-agent, tekton-chains, trivy-operator, crossplane-provider-aws-kinesis, kyverno, pulumi, rootlesskit, gatus, rancher, ko, istio, syft, kots, gh, k9s, gomplate, crossplane-provider-family-azure, step-kms-plugin, cloud-provider-aws, docker, eksctl,...

GO-2026-5016 vulnerabilities

Vulnerabilities for packages: rancher-agent, trivy-operator, kyverno, pulumi, rootlesskit, gatus, rancher, istio, syft, kots, gh, k9s, gomplate, cloud-provider-aws, docker, wal-g, cilium-cli, containerd, zarf, mattermost, loki, spire-server, cilium, kubernetes, splunk-otel-collector, kubescape,...

GO-2026-5018 vulnerabilities

Vulnerabilities for packages: rancher-agent, tekton-chains, trivy-operator, kyverno, pulumi, rootlesskit, gatus, rancher, ko, istio, syft, kots, gh, k9s, gomplate, crossplane-provider-family-azure, step-kms-plugin, cloud-provider-aws, docker, eksctl, crossplane-provider-azure-sql, k8sgpt, sops,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: tkn, loki, jitsucom-bulker, grafana-alloy, argo-workflows, ksops, sqlexporter, spire-server, step-ca, fulcio, step, witness, kubeflow-pipelines, chezmoi, db-operator, ratify, temporal-server, splunk-otel-collector, kots, minio, cerbos, dbmate, age, caddy, openfga,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, cosign, spire-server, vexctl, zot, sigstore-scaffolding, kubescape, gh, policy-controller, neuvector-sigstore-interface, melange, rekor, gitsign, trivy, apko, slsa-verifier, falcoctl, zarf, flux-source-controller, wolfictl, aactl...

SUSE CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CLEANSTART-2026-FT78287 Security fixes in apko 1.2.2-r0

Package apko version 1.2.2-r0 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

CLEANSTART-2026-UC75488 Security fixes in apko 1.2.13-r0

Package apko version 1.2.13-r0 fixes 24 vulnerabilities: ghsa-crhj-59gh-8x96, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29, CVE-2026-45570, CVE-2026-45571...

CLEANSTART-2026-IZ40410 Security fixes in apko 1.2.3-r0

Package apko version 1.2.3-r0 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

PT-2026-85879

Package apko version 1.2.2-r0 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

PT-2026-85925

Package apko version 1.2.3-r0 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...