742 matches found
CVE-2026-4404: Use of Hard-coded Credentials
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI...
Harbor 安全漏洞
Harbor is an open-source registry developed by Harbor Open Source. It protects artifacts through policy-based and role-based access control, ensures that images are scanned for vulnerabilities, and signs images as trustworthy. Versions of Harbor prior to 2.15.0 have security vulnerabilities; thes...
GHSA-P77J-4MVH-X3M3 vulnerabilities
Vulnerabilities for packages: mcp-grafana, task, crossplane-provider-aws-firehose, certificate-transparency, fulcio, crossplane-provider-azure-managedidentity, slsa-verifier, trivy-operator, wal-g, helm-push, grafana-pyroscope, sqlexporter, op-geth, mesosphere-vsphere-csi,...
CVE-2026-33186 vulnerabilities
Vulnerabilities for packages: mcp-grafana, task, crossplane-provider-aws-firehose, certificate-transparency, fulcio, crossplane-provider-azure-managedidentity, slsa-verifier, trivy-operator, wal-g, helm-push, grafana-pyroscope, sqlexporter, op-geth, mesosphere-vsphere-csi,...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: vault, syft, rke2-runtime, packer, calico, gatekeeper, scorecard, google-osconfig-agent, consul, metrics-server-fips, cluster-api, grafana-pyroscope, spicedb-operator, cluster-api-ipam-provider-in-cluster, task-fips, kapp-controller-fips,...
CLEANSTART-2026-PC16040 Within HostnameError
Multiple security vulnerabilities affect the harbor-registry-fips package. Within HostnameError. See references for individual vulnerability details...
CLEANSTART-2026-BZ92766 beego is an open-source web framework for the Go programming language
Multiple security vulnerabilities affect the harbor-fips package. beego is an open-source web framework for the Go programming language. See references for individual vulnerability details...
CLEANSTART-2026-OI08379 Cancelling a query (e
Multiple security vulnerabilities affect the harbor-fips package. Cancelling a query e. See references for individual vulnerability details...
CLEANSTART-2026-QK01721 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
CLEANSTART-2026-XX70537 Cancelling a query (e
Multiple security vulnerabilities affect the harbor-fips package. Cancelling a query e. See references for individual vulnerability details...
CLEANSTART-2026-PO40318 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
CLEANSTART-2026-RY09679 go-redis is the official Redis client library for the Go programming language
Security vulnerability affects the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language...
CLEANSTART-2026-PG91940 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines
Multiple security vulnerabilities affect the harbor-registry package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. See references for individual vulnerability details...
CLEANSTART-2026-ZO91195 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
BIT-HARBOR-2024-22261 SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
BIT-HARBOR-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
CVE-2019-16919
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper...