CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...

dasel-hardened-container

dasel v3.3.1 加固容器 这是一个针对 dasel v3.3.1 的 melange 包和 apko 容器镜像，包含针对 CVE-2026-33320（无限制的 YAML 别名扩展）的构建时补丁。该镜像完全由本地生成的 APK 构建——不使用任何预构建的上游镜像。 前提条件 工具| 已测试版本| 用途 ---|---|--- Docker| 29.3.1| 容器运行时，通过 compose.yaml 运行 melange/apko melange| 0.50.5 Docker image...

dasel-melange-apko

dasel v3.3.1 — Melange + apko build, patched for CVE-2026-33320 This repo packages the dasel CLI v3.3.1 as an APK with Melange , builds a minimal container image with apko , and applies a fix for CVE-2026-33320 while staying on the v3.3.1 codebase a patch, not a version bump. The result is a 4 MB...

GO-2023-1700 vulnerabilities

Vulnerabilities for packages: helm, ko, melange, apko, bom, ctop, up...

GO-2023-1701 vulnerabilities

Vulnerabilities for packages: helm, ko, melange, apko, bom, ctop, up...

GO-2023-1699 vulnerabilities

Vulnerabilities for packages: helm, ko, melange, apko, bom, ctop, up...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: aactl, ko, apko...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: slsa-verifier, flux-source-controller, ko, kubescape, melange, policy-controller, skaffold, tekton-chains, tkn, apko, spire-server, aactl, spire-server-fips, cosign, falcoctl-fips...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: ko, falcoctl, chainctl, wolfictl, neuvector-sigstore-interface, policy-controller-fips, tekton-chains-fips, slsa-verifier, flux-source-controller, tekton-chains, policy-controller, zot, apko, spire-server, kubescape, spire-server-fips, tkn, goreleaser, melange,...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: osv-scanner, openfga, docker-compose, buildah, opentelemetry-collector-contrib, zarf, splunk-otel-collector, falcoctl, grype, apko, trivy, zot, melange, dagger, buildkitd, docker-cli-buildx, trufflehog, kargo, tw, wolfictl, goreleaser, buf, cadvisor, syft, nerdctl,...

GO-2023-1699 vulnerabilities

Vulnerabilities for packages: up, apko, ctop, melange, helm, ko, bom...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: task, osv-scanner, flux-source-controller, guac, k8sgpt, src-fingerprint, kubescape, pulumi-kubernetes-operator, snyk-cli, pulumi-language-yaml, zarf, flux-image-automation-controller, chezmoi, flux, grype, apko, flux-kustomize-controller, trivy, zot, melange, gitsig...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: task, osv-scanner, flux-source-controller, guac, k8sgpt, src-fingerprint, kubescape, pulumi-kubernetes-operator, snyk-cli, pulumi-language-yaml, zarf, flux-image-automation-controller, chezmoi, flux, grype, apko, flux-kustomize-controller, trivy, zot, melange, gitsig...

GO-2023-1700 vulnerabilities

Vulnerabilities for packages: up, apko, ctop, melange, helm, ko, bom...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: xeol, osv-scanner, flux-source-controller, guac, src-fingerprint, gitaly, gitlab-runner, kubescape, pulumi-kubernetes-operator, snyk-cli, gomplate, steampipe, pulumi-language-yaml, zarf, flux-image-automation-controller, chezmoi, flux, grype, apko, trivy, zot, melang...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: src-fingerprint, pulumi-kubernetes-operator, gomplate, pulumi-language-yaml, gitness, apko, flux-kustomize-controller, zot, gitsign, go-licenses, pulumi-language-java, kots, bom, goreleaser, kubevela, pulumi-language-dotnet, pulumi, nuclei, scorecard...

GO-2023-1701 vulnerabilities

Vulnerabilities for packages: up, apko, ctop, melange, helm, ko, bom...

GO-2026-4559 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sqs, nova, dex, flux, flux-kustomize-controller, terraform-provider-aws, k3s, opa, terraform-provider-grafana, pulumi-language-java, pulumi, vertical-pod-autoscaler, kubo, grafana-mimir, opentelemetry-collector, kube-rbac-proxy, emissary, src,...

GO-2026-5026 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql, fscrypt, terraform-provider-pagerduty, node-feature-discovery, flux, falco-no-driver, nri-couchbase, nats-top, mailpit, spire-controller-manager, metrics-agent, cue, glab, nri-consul, karpenter, addon-resizer, harbor-registry,...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, crossplane-provider-aws-sqs, flux-source-controller, crossplane-provider-aws-ec2, vexctl, crossplane-provider-aws-s3, crossplane-provider-aws-sns, actions-runner-controller, crossplane-provider-aws-eks, crossplane-provider-aws-kinesis,...