148 matches found
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: skaffold, rancher-fleet, livekit-cli, argo-workflows, xeol, scorecard, grafana-alloy, gitaly-fips, syft, pulumi-language-java, flux-source-controller-fips, flux, melange, kots, trivy-fips, nfpm, external-secrets-operator, argo-workflows-fips, kubescape-server-fips,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, skaffold, nfpm, snyk-cli, k9s, gptscript, kubevela, steampipe, dagger, grafana-alloy, flux, argo-cd, gitaly, xeol, osv-scanner, tfsec, syft, chezmoi, crossplane, pulumi-language-dotnet, cerbos, external-secrets-operator, gitsign, kargo,...
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: argocd-image-updater, skaffold, nfpm, snyk-cli, k9s, gptscript, kubevela, steampipe, dagger, grafana-alloy, flux, argo-cd, gitaly, xeol, osv-scanner, tfsec, syft, chezmoi, crossplane, pulumi-language-dotnet, cerbos, external-secrets-operator, gitsign, kargo,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, skaffold, nfpm, snyk-cli, k9s, gptscript, kubevela, steampipe, dagger, grafana-alloy, flux, argo-cd, gitaly, xeol, osv-scanner, tfsec, syft, chezmoi, crossplane, pulumi-language-dotnet, cerbos, external-secrets-operator, gitsign, kargo,...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, skaffold, nfpm, snyk-cli, k9s, gptscript, kubevela, steampipe, dagger, grafana-alloy, flux, argo-cd, gitaly, xeol, osv-scanner, tfsec, syft, chezmoi, crossplane, pulumi-language-dotnet, cerbos, external-secrets-operator, gitsign, kargo,...
SUSE CVE-2026-29064
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or...
GO-2026-4636 Zarf's symlink targets in archives are not validated against destination directory in github.com/zarf-dev/zarf
Zarf's symlink targets in archives are not validated against destination directory in github.com/zarf-dev/zarf...
CVE-2026-29064
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or...
EUVD-2026-10044
Zarf's symlink targets in archives are not validated against destination directory...
GHSA-HCM4-6HPJ-VGHM Zarf's symlink targets in archives are not validated against destination directory
Summary A path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or write on the system processing the package. What users should do Upgrade immediately to version...
CVE-2026-29064
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or...
CVE-2026-29064
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or...
CVE-2026-29064 Zarf: Symlink targets in archives are not validated against destination directory
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or...
CVE-2026-29064 Zarf: Symlink targets in archives are not validated against destination directory
Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package to create symlinks pointing outside the destination directory, enabling arbitrary file read or...
CVE-2026-29064
Zarf (Airgap Native Packager Manager for Kubernetes) is affected by a path traversal vulnerability in archive extraction from versions 0.54.0 up to before 0.73.1. The issue arises because symlink targets are not validated against the destination directory, enabling a package to create symlinks th...
Zarf 路径遍历漏洞
Zarf is an open-source Kubernetes offline environment software delivery tool developed by zarf-dev. Versions of Zarf from 0.54.0 to 0.73.1 had a path traversal vulnerability. This vulnerability stemmed from issues with path traversal in archive extraction, which could lead to arbitrary file readi...
PT-2026-23725
Name of the Vulnerable Software and Affected Versions Zarf versions 0.54.0 through 0.73.0 Description Zarf, an Airgap Native Packager Manager for Kubernetes, contains a path traversal flaw in its archive extraction process. A specially designed Zarf package can create symbolic links that point to...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: octo-sts, seaweedfs, livekit-cli, ory-kratos-fips, apm-server-fips, scorecard, prometheus, terraform-provider-google, k3d, aws-node-termination-handler, sftpgo-plugin-kms, metrics-server, argo-workflows-fips, aws-ebs-csi-driver, cluster-api-helm-controller,...
CVE-2025-8959 vulnerabilities
Vulnerabilities for packages: snyk-cli, k9s, steampipe, xeol, tfsec, syft, trivy-operator, zarf, grype, trivy, terraform, conftest, rancher-fleet, wolfictl, terragrunt, kots, kubescape, opentofu, tflint, zot...
GHSA-WJRX-6529-HCJ3 vulnerabilities
Vulnerabilities for packages: snyk-cli, k9s, steampipe, xeol, tfsec, syft, trivy-operator, zarf, grype, trivy, terraform, conftest, rancher-fleet, wolfictl, terragrunt, kots, kubescape, opentofu, tflint, zot...