GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, docker-credential-acr-env, dgraph, gitness...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, dgraph, gitness...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: tekton-chains, boring-registry, caddy, terragrunt, terraform-provider-azurerm, up, temporal, k3d, nri-mssql, src-fingerprint, aactl, tkn, helm-push, gh, kubeflow-pipelines, gitness, cloudflared, kaf, zot, sops, fq, kubewatch, pulumi, terraform, bank-vaults,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler, haproxy-ingress, tekton-chains, grafana-alloy, percona-server-mongodb-operator, terragrunt, crossplane-provider-aws-route53, cert-manager-webhook-pdns, nri-couchbase, crossplane-provider-aws-firehose, terraform-provider-azurerm, cert-exporter,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: render-template, tekton-chains, boring-registry, caddy, cert-manager-webhook-pdns, ghaudit, cert-exporter, k3d, src-fingerprint, aactl, kyverno-policy-reporter-ui, croc, gostatsd, oras, nvidia-container-toolkit, helm-push, ip-masq-agent, chartmuseum, overmind,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push, cluster-proportional-autoscaler, ip-masq-agent,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: render-template, boring-registry, cert-manager-webhook-pdns, openbao-k8s, terraform-provider-kubernetes, ghaudit, cert-exporter, vault-env, contour, docker-cli-buildx, k3d, dagdotdev, src-fingerprint, gostatsd, oras, otel-cli, helm-push,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: terraform-provider-random-fips, etcd, smarter-device-manager, localstack, sbom-scorecard, dynamic-localpv-provisioner, rancher-agent, google-guest-agent, yunikorn-web-fips, prometheus-blackbox-exporter-fips, metacontroller, kubernetes-dashboard-auth-fips,...