GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: gitness, docker-credential-acr-env-fips, dgraph, docker-credential-acr-env...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: dgraph, docker-credential-acr-env, gitness...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, aws-flb-kinesis, terraform-provider-google, kubeflow, aws-flb-cloudwatch, aws-flb-firehose, php-fpmexporter, smokescreen, neuvector-dbgen, kpt, sonobuoy, src-fingerprint, newrelic-nri-statsd, docker-credential-gcr, gostatsd, hello-world-golang,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: kustomize, direnv, mage, mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, kubernetes-csi-external-attacher, glow, kubernetes-dashboard-web, oras, spark-operator, terraform-provider-time, mkcert, fulcio, contour, docker-machine-driver-harvester,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: kustomize, direnv, mage, mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, kubernetes-csi-external-attacher, glow, kubernetes-dashboard-web, oras, spark-operator, terraform-provider-time, mkcert, fulcio, contour, docker-machine-driver-harvester,...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: kustomize, direnv, grype, mage, nri-redis, k8sgpt, regclient, prometheus-operator, nri-apache, oras, rabbitmq-cluster-operator, spark-operator, gh, nri-f5, pulumi, kubernetes-csi-external-resizer, nri-prometheus, nri-nagios, kuberay-operator, http-echo,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: apache-exporter, kubescape, db-operator, crossplane-provider-aws-rds, nri-apache, net-kourier, crossplane-provider-aws-cloudformation, crossplane-provider-aws-elasticache, rabbitmq-cluster-operator, spark-operator, xeol, crossplane-provider-aws-s3,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: grype, k8sgpt, kubescape, spark-operator, gh, pulumi, fulcio, terraform-provider-aws, weaviate, secrets-store-csi-driver-provider-azure, boring-registry, terraform, libssh, conftest, argo-workflows, kube-state-metrics, cfssl, libssh2, cadvisor, step, vexctl, sops, sr...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: regclient, nri-redis, k8sgpt, kubernetes-dashboard-web, glow, prometheus-operator, nri-apache, kubernetes-dashboard-api, aws-eks-pod-identity-agent, azure-service-operator, rabbitmq-cluster-operator, spark-operator, nri-f5, fulcio, terraform-mcp-server,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: kustomize, direnv, mage, regclient, k8sgpt, kubescape, oras, spark-operator, mkcert, spicedb, fulcio, nri-prometheus, redka, http-echo, secrets-store-csi-driver-provider-azure, trust-manager, pombump, boring-registry, s5cmd, kafkaexporter, ctop, gostatsd, conftest,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: apache-exporter, kubernetes-csi-external-attacher, kubernetes-dashboard-web, kubescape, prometheus-operator, db-operator, kubernetes-dashboard-api, azure-service-operator, net-kourier, xeol, terraform-provider-time, gh, opentelemetry-operator, contour,...

EUVD-2026-9077

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using filepath.Joindest, cleanedName without enforcing that the final path stays within dest. A ta...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, aws-flb-kinesis, terraform-provider-google, kubeflow, aws-flb-cloudwatch, aws-flb-firehose, php-fpmexporter, smokescreen, neuvector-dbgen, kpt, sonobuoy, src-fingerprint, newrelic-nri-statsd, docker-credential-gcr, gostatsd, hello-world-golang,...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, aws-flb-kinesis, terraform-provider-google, kubeflow, aws-flb-cloudwatch, aws-flb-firehose, php-fpmexporter, smokescreen, neuvector-dbgen, kpt, sonobuoy, src-fingerprint, newrelic-nri-statsd, docker-credential-gcr, gostatsd, hello-world-golang,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, k8sgpt, glow, prometheus-operator, go-jsonnet, spark-operator, terraform-provider-time, spicedb, terraform-mcp-server, kubernetes-csi-external-resizer, http-echo, percona-server-mongodb-operator, terrafor...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, k8sgpt, glow, prometheus-operator, go-jsonnet, spark-operator, terraform-provider-time, spicedb, terraform-mcp-server, kubernetes-csi-external-resizer, http-echo, percona-server-mongodb-operator, terrafor...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: kustomize, mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, glow, prometheus-operator, spark-operator, terraform-provider-time, http-echo, terraform, ctop, gostatsd, conftest, dive, kind, cadvisor, buildkitd, falco-exporter, configmap-reload, yace,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: kustomize, direnv, mage, mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, kubernetes-csi-external-attacher, glow, kubernetes-dashboard-web, oras, spark-operator, terraform-provider-time, mkcert, fulcio, contour, docker-machine-driver-harvester,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: kustomize, direnv, mage, mongodb-kubernetes-operator, regclient, custom-pod-autoscaler, kubernetes-csi-external-attacher, glow, kubernetes-dashboard-web, oras, spark-operator, terraform-provider-time, mkcert, fulcio, contour, docker-machine-driver-harvester,...