GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, dgraph, gitness, docker-credential-acr-env...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: dgraph, gitness, docker-credential-acr-env...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, newrelic-infra-operator, nova, stakater-reloader, docker-machine-driver-linode, migrate, cluster-api-ipam-provider-in-cluster, paranoia, db-operator, crossplane-provider-aws-kinesis, manifest-tool, litestream, kubernetes-event-exporter,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, go-licenses, scorecard, zot, cadvisor, bom, kubernetes-event-exporter, hugo, falcoctl, cloudflared, ferretdb, dockerize, step, prometheus-alertmanager, sops, terraform-provider-azurerm, terragrunt, flux-helm-controller, rqlite, nri-kafka,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: gostatsd, newrelic-infra-operator, nvidia-container-toolkit, go-licenses, grafana-agent-operator, docker-credential-gcr, paranoia, scorecard, zot, kubernetes-dns-node-cache, cadvisor, bom, litestream, flux-notification-controller, falcoctl, wgcf, cloudflared, mkcert,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: grafana-agent-operator, kubernetes-event-exporter, dbmate, gitleaks, minio-object-browser, logstash-exporter, kyverno-policy-reporter-ui, rancher-machine, distribution, go-tools, spire-controller-manager, kubebuilder, nri-prometheus, nfs-subdir-external-provisioner,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, cadvisor, bom, maru, kubernetes-event-exporter, falcoctl, wgcf,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...