GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

PT-2026-80446

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: dgraph, docker-credential-acr-env-fips, docker-credential-acr-env, gitness...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: gitness, dgraph, docker-credential-acr-env...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: sonobuoy, aws-flb-kinesis, kube-fluentd-operator, gostatsd, kubeflow, neuvector-dbgen, docker-credential-gcr, hello-world-golang, src-fingerprint, newrelic-nri-statsd, php-fpmexporter, terraform-provider-google, go-discover, smokescreen, aws-flb-firehose,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: k6, podinfo, oras, kbld, neuvector-sigstore-interface, manifest-tool, oauth2-proxy, terraform-provider-tls, kaf, kratos, php-fpmexporter, timestamp-authority, s5cmd, contour, terraform-provider-time, logstash-exporter, sonobuoy, git-credential-oauth, maru,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: k6, podinfo, oras, kbld, neuvector-sigstore-interface, manifest-tool, oauth2-proxy, terraform-provider-tls, kaf, kratos, php-fpmexporter, timestamp-authority, s5cmd, contour, terraform-provider-time, logstash-exporter, sonobuoy, git-credential-oauth, maru,...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: tailscale, nri-mongodb, oras, nri-f5, pulumi-language-yaml, kaf, metallb, newrelic-infrastructure-agent, php-fpmexporter, s5cmd, dex, prometheus-operator, actions-runner-controller, logstash-exporter, sonobuoy, flux-helm-controller, dgraph, gosu, go-licenses,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: hugo, cloudflared, oauth2-proxy, kaf, spire-server, dex, actions-runner-controller, grpc-health-probe, buf, flux-helm-controller, crossplane-provider-azure-managedidentity, dgraph, temporal-ui-server, go-licenses, dynamic-localpv-provisioner, gh, temporal,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: redpanda, podinfo, migrate, kbld, emissary, manifest-tool, spire-server, crossplane-provider-aws-route53, crossplane-provider-aws-cloudformation, envoy-gateway, actions-runner-controller, node-problem-detector, wuzz, zarf, cloud-provider-azure, cloud-provider-aws,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: migrate, neuvector-sigstore-interface, emissary, harbor-cli, oauth2-proxy, nri-f5, terraform-mcp-server, dex, prometheus-operator, rabbitmq-default-user-credential-updater, rabbitmq-messaging-topology-operator, witness, dgraph, render-template, nri-rabbitmq, conftest...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: oras, harbor-cli, cloudflared, oauth2-proxy, pulumi-language-yaml, kaf, php-fpmexporter, s5cmd, dex, logstash-exporter, rabbitmq-default-user-credential-updater, sonobuoy, kubernetes-ingress-defaultbackend, dgraph, gosu, go-licenses, render-template, golangci-lint,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, redpanda, tailscale, migrate, emissary, oauth2-proxy, pulumi-language-yaml, terraform-provider-tls, kaf, newrelic-infrastructure-agent, spire-server, contour, dex, envoy-gateway, prometheus-operator, terraform-provider-time, grpc-health-probe,...

EUVD-2026-9077

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: sonobuoy, aws-flb-kinesis, kube-fluentd-operator, gostatsd, kubeflow, neuvector-dbgen, docker-credential-gcr, hello-world-golang, src-fingerprint, newrelic-nri-statsd, php-fpmexporter, terraform-provider-google, go-discover, smokescreen, aws-flb-firehose,...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: sonobuoy, aws-flb-kinesis, kube-fluentd-operator, gostatsd, kubeflow, neuvector-dbgen, docker-credential-gcr, hello-world-golang, src-fingerprint, newrelic-nri-statsd, php-fpmexporter, terraform-provider-google, go-discover, smokescreen, aws-flb-firehose,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: k6, podinfo, migrate, kbld, neuvector-sigstore-interface, harbor-cli, grafana-image-renderer, oauth2-proxy, terraform-provider-tls, kratos, php-fpmexporter, spire-server, timestamp-authority, terraform-provider-time, grpc-health-probe,...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: k6, podinfo, migrate, kbld, neuvector-sigstore-interface, harbor-cli, grafana-image-renderer, oauth2-proxy, terraform-provider-tls, kratos, php-fpmexporter, spire-server, timestamp-authority, terraform-provider-time, grpc-health-probe,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: k6, podinfo, oras, kbld, neuvector-sigstore-interface, manifest-tool, oauth2-proxy, terraform-provider-tls, kaf, kratos, php-fpmexporter, timestamp-authority, s5cmd, contour, terraform-provider-time, logstash-exporter, sonobuoy, git-credential-oauth, maru,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: k6, podinfo, oras, kbld, neuvector-sigstore-interface, manifest-tool, oauth2-proxy, terraform-provider-tls, kaf, kratos, php-fpmexporter, timestamp-authority, s5cmd, contour, terraform-provider-time, logstash-exporter, sonobuoy, git-credential-oauth, maru,...