CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: aactl, goreleaser, sigstore-scaffolding, ratify, tekton-chains, falcoctl, trivy-operator, gh, docker-cli-buildx, kyverno, spire-server, teleport, zarf, kyverno-notation-aws, vexctl, flux-source-controller, slsa-verifier, witness, skaffold, buildkitd, cosign, ko, zot,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: aactl, goreleaser, sigstore-scaffolding, ratify, tekton-chains, falcoctl, trivy-operator, gh, docker-cli-buildx, kyverno, spire-server, teleport, zarf, kyverno-notation-aws, vexctl, flux-source-controller, slsa-verifier, witness, skaffold, buildkitd, cosign, ko, zot,...

CVE-2026-40090

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the zarf package inspect sbom and zarf package inspect documentation subcommands when the output file path is constructed using a user-controlled output directory combined with the untrusted Metadata.Name field...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the zarf package inspect sbom and zarf package inspect documentation subcommands when the output file path is constructed using a user-controlled output directory combined with the untrusted Metadata.Name field...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the zarf package inspect sbom and zarf package inspect documentation subcommands when the output file path is constructed using a user-controlled output directory combined with the untrusted Metadata.Name field...

Zarf 安全漏洞

Zarf is an open-source Kubernetes offline environment software delivery tool developed by zarf-dev. Versions of Zarf from 0.23.0 to 0.74.1 contain security vulnerabilities. These vulnerabilities stem from path traversal issues in the zarf package’s inspect subcommand, which could allow writing...

CVE-2026-40090 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

CVE-2026-40090 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

CVE-2026-40090

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

CVE-2026-40090 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

CVE-2026-40090

Zarf (Airgap Native Packager Manager for Kubernetes) versions 0.23.0–0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation commands. The vulnerability arises because output file paths are constructed by joining a user-controll...

EUVD-2026-22814

Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write...

Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Impact This vulnerability impacts users of zarf package inspect sbom or zarf package inspect documentation on untrusted packages. Patches 4793, now fixed in version v0.74.2 Workarounds Avoid inspecting unsigned packages Description The package inspect sbom and package inspect documentation...

GHSA-PJ97-4P9W-GX3Q Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Impact This vulnerability impacts users of zarf package inspect sbom or zarf package inspect documentation on untrusted packages. Patches 4793, now fixed in version v0.74.2 Workarounds Avoid inspecting unsigned packages Description The package inspect sbom and package inspect documentation...

PT-2026-32968

Name of the Vulnerable Software and Affected Versions Zarf versions 0.23.0 through 0.74.1 Description An arbitrary file write issue exists in the 'zarf package inspect sbom' and 'zarf package inspect documentation' subcommands. These subcommands construct output file paths by joining a...

GHSA-92MM-2PJQ-R785 vulnerabilities

Vulnerabilities for packages: k9s, trivy-operator, tfsec, xeol, opentofu, syft, zarf, snyk-cli, terragrunt, task, steampipe, wolfictl, zot, terraform, trivy, kots, conftest, grype, kubescape, tflint...

CVE-2026-4660 vulnerabilities

Vulnerabilities for packages: k9s, trivy-operator, tfsec, xeol, opentofu, syft, zarf, snyk-cli, terragrunt, task, steampipe, wolfictl, zot, terraform, trivy, kots, conftest, grype, kubescape, tflint...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, crossplane-fips, guac, trufflehog, nuclei, rancher-fleet-fips, argo-cd, trivy, syft-fips, kots, cerbos-fips, xeol, nemo, scorecard, gitlab-runner-fips, chainctl-fips, flux-source-controller-fips, chainctl, packer-fips, osv-scanner,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, crossplane-fips, guac, trufflehog, nuclei, rancher-fleet-fips, argo-cd, trivy, syft-fips, kots, cerbos-fips, xeol, nemo, scorecard, gitlab-runner-fips, chainctl-fips, flux-source-controller-fips, chainctl, packer-fips, osv-scanner,...