147 matches found
CLEANSTART-2026-DR73379 oras-go is a Go library for managing OCI artifacts
Security vulnerability affects the argo-cd package. oras-go is a Go library for managing OCI artifacts...
ROOT-APP-GOBINARY-CVE-2026-50151 CVE-2026-50151 in oras.land/oras-go/v2 - Patched by Root
Root has patched CVE-2026-50151 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-85731 CVE-2026-85731 in oras.land/oras-go/v2 - Patched by Root
Root has patched CVE-2026-85731 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-50163 CVE-2026-50163 in oras.land/oras-go/v2 - Patched by Root
Root has patched CVE-2026-50163 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...
CVE-2026-85731
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, co...
CVE-2026-85732
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, th...
Medium: soci-snapshotter
Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...
Medium: soci-snapshotter
Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...
Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2026-143)
The version of soci-snapshotter installed on the remote host is prior to 0.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-143 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root...
Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3153)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3153 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...
CLEANSTART-2026-VP35771 oras-go is a Go library for managing OCI artifacts
Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...
CLEANSTART-2026-VN99750 oras-go is a Go library for managing OCI artifacts
Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...
CLEANSTART-2026-AH23737 oras-go is a Go library for managing OCI artifacts
Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...
SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4417-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4417-1 advisory. - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction...
Security update for helm
This update for helm fixes the following issues: CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal...
SUSE-SU-2026:4417-1 Security update for helm
This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows...
GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...
GO-2026-6497 Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go
Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go...
