GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gitness, dgraph, docker-credential-acr-env-fips...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gitness, dgraph...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: kubeflow, go-discover, docker-credential-gcr, sonobuoy, kube-fluentd-operator, hello-world-golang, newrelic-nri-statsd, smokescreen, kpt, neuvector-dbgen, terraform-provider-google, aws-flb-cloudwatch, aws-flb-firehose, aws-flb-kinesis, src-fingerprint, gostatsd,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: fq, kustomize, vault-k8s, nuclei, hello-world-golang, kpt, prometheus-adapter, oras, helm-push, newrelic-infrastructure-agent, nri-mysql, docker-cli, docker-credential-ecr-login, ytt, aws-efs-csi-driver, nri-nagios, controller-gen, k8sgpt, prometheus-operator,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: hubble, libnvidia-container, vault-k8s, nova, kubernetes, litestream, crossplane, prometheus-adapter, steampipe, rancher, victoriametrics-cluster, newrelic-nri-kube-events, helm-push, sftpgo-plugin-pubsub, guac, sigstore-scaffolding, trino, aws-efs-csi-driver,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kubernetes, prometheus-adapter, helm-push, sigstore-scaffolding, tkn, crossplane-provider-aws, rekor, k8sgpt, kubeflow, prometheus-alertmanager, skopeo, caddy, fulcio, docker-credential-acr-env, up, step, kubewatch, haproxy-ingress, vexctl, cosign,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: aws-application-networking-k8s, hubble, libnvidia-container, nova, nuclei, kpt, steampipe, helm-push, aws-eks-pod-identity-agent, nri-mysql, guac, docker-cli, yunikorn-k8shim, tkn, controller-gen, terraform-provider-azapi, kuberlr, rancher-system-upgrade-controller,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: libnvidia-container, mkcert, kustomize, tfsec, vault-k8s, hello-world-golang, litestream, kpt, prometheus-adapter, falcosidekick, oras, metacontroller, helm-push, guac, docker-credential-ecr-login, aws-efs-csi-driver, crossplane-provider-aws, k9s, rekor, k8sgpt,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, hubble, keda, cert-manager-cmctl, libnvidia-container, syft, nuclei, seaweedfs, kubernetes, litestream, crossplane, kpt, prometheus-adapter, rancher, dkron, newrelic-infrastructure-agent, gitlab-kas, sftpgo-plugin-pubsub, yunikorn-k8shi...

EUVD-2026-9077

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: kubeflow, go-discover, docker-credential-gcr, sonobuoy, kube-fluentd-operator, hello-world-golang, newrelic-nri-statsd, smokescreen, kpt, neuvector-dbgen, terraform-provider-google, aws-flb-cloudwatch, aws-flb-firehose, aws-flb-kinesis, src-fingerprint, gostatsd,...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: kubeflow, go-discover, docker-credential-gcr, sonobuoy, kube-fluentd-operator, hello-world-golang, newrelic-nri-statsd, smokescreen, kpt, neuvector-dbgen, terraform-provider-google, aws-flb-cloudwatch, aws-flb-firehose, aws-flb-kinesis, src-fingerprint, gostatsd,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: hello-world-golang, kpt, nri-jmx, sbom-convert, rke2-cloud-provider, oras, guac, hydra, rancher-system-upgrade-controller, prometheus-operator, runc, podman, otel-cli, influx, kapp, go-md2man, dask-gateway, nodetaint, rancher-telemetry, github-mcp-server, opa, hcloud...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: hello-world-golang, kpt, nri-jmx, sbom-convert, rke2-cloud-provider, oras, guac, hydra, rancher-system-upgrade-controller, prometheus-operator, runc, podman, otel-cli, influx, kapp, go-md2man, dask-gateway, nodetaint, rancher-telemetry, github-mcp-server, opa, hcloud...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: fq, hello-world-golang, kpt, sbom-convert, oras, metacontroller, guac, docker-credential-ecr-login, ytt, hydra, prometheus-operator, docker-cli-buildx, runc, argo-rollouts, git-credential-oauth, otel-cli, kapp, go-md2man, wave, dask-gateway, nodetaint,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...