GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: snyk-cli, kargo, tfsec, flux, external-secrets-operator, kaniko, melange, grype, teleport, flux-image-automation-controller, pulumi-language-java, steampipe, guac, gitaly, grafana-alloy, pulumi, kyverno, k9s, bom, trivy-operator, wolfictl, gitea,...

SUSE CVE-2026-25140

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-acm-fips, polaris-fips, descheduler-fips, crossplane-provider-aws-ec2, aws-ebs-csi-driver, opentelemetry-collector-contrib-fips, harbor-fips, crossplane-provider-aws-sns, crossplane-provider-aws-servicediscovery-fips, kyverno-policy-reporter,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: docker, pulumi-language-java, grafana-alloy, pulumi, terraform-provider-pagerduty, rclone, crossplane-provider-aws-lambda, sops, flux-notification-controller, aactl, terraform-provider-azuread, src-fingerprint, crossplane-provider-aws-kms, cerbos,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: docker, pulumi-language-java, grafana-alloy, pulumi, terraform-provider-pagerduty, rclone, crossplane-provider-aws-lambda, sops, flux-notification-controller, aactl, terraform-provider-azuread, src-fingerprint, crossplane-provider-aws-kms, cerbos,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitness, kubevela-fips, policy-controller, atlantis, flux-helm-controller, crossplane-provider-aws-ec2, argo-cd-fips, crossplane-provider-aws-sns, pulumi-language-yaml, pulumi-language-dotnet, cluster-api, trivy-operator, trivy, external-secrets-operator,...

GO-2026-4410 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko

apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko...

SUSE CVE-2026-25121

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatte...

SUSE CVE-2026-25122

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copyio.Discard, gzi without explicit bounds. With an attacker-controlled input stream, this can force lar...

CVE-2026-25122

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copyio.Discard, gzi without explicit bounds. With an attacker-controlled input stream, this can force lar...

CVE-2026-25140

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

GO-2026-4405 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko

apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko...

GO-2026-4406 apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko...

CVE-2026-25140

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

CVE-2026-25122

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copyio.Discard, gzi without explicit bounds. With an attacker-controlled input stream, this can force lar...

CVE-2026-25121

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatte...

CVE-2026-25140 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

CVE-2026-25140 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

EUVD-2026-5381

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

CVE-2026-25121 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatte...