GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, dgraph, gitness, docker-credential-acr-env...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: dgraph, gitness, docker-credential-acr-env...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nri-elasticsearch, runc, crossplane-provider-aws-elasticache, terraform-provider-acme, cluster-proportional-autoscaler, kyverno, cis-operator, continuity, kaniko, dask-gateway, kapp-controller, spark-operator, kube-vip, crossplane-provider-aws-memorydb, goreleaser,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: cosign, memcached-exporter, go-licenses, spark-operator, kubeflow, cadvisor, k8sgpt, apko, src-fingerprint, kubeflow-pipelines, nerdctl, temporal-ui-server, falcoctl, skopeo, kyverno-policy-reporter, cfssl, crossplane-provider-azure-authorization,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: cosign, runc, go-licenses, http-echo, kubernetes-dns-node-cache, dask-gateway, kubernetes-csi-driver-hostpath, spark-operator, wire-go, cadvisor, k8sgpt, smarter-device-manager, hcloud, src-fingerprint, go-bindata, kubernetes-csi-external-provisioner, petname,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file, sbom-scorecard...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: runc, cluster-proportional-autoscaler, go-licenses, helm-mapkubeapis, http-echo, dask-gateway, kubernetes-csi-driver-hostpath, rancher-loglevel, spark-operator, wire-go, yunikorn-web, kubeflow, cargobump, cadvisor, neuvector-dbgen, vault-env, ini-file,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim-fips, wgcf, kafkaexporter, spicedb-operator, cloud-provider-azure-fips, cloud-provider-azure, nvidia-nsight-compute-13.0, scorecard, container-object-storage-interface-fips, kubeflow, sbom-convert, doppler-kubernetes-operator, grpcurl,...