GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, gitness, docker-credential-acr-env, dgraph...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gitness, dgraph...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: govulncheck, zarf, mattermost, speedtest-go, crossplane-provider-aws-cloudwatchlogs, gke-gcloud-auth-plugin, cloudnative-pg, haproxy-ingress, lazydocker, emissary, amazon-cloudwatch-agent-operator, kube-state-metrics, neuvector-dbgen, local-path-provisioner, opentofu...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, up, ko, buildkitd, kube-state-metrics, local-path-provisioner, docker-credential-acr-env, cfssl, secrets-store-csi-driver, wireguard-go, nerdctl, amass, cloudflared, nats-server, mongo-tools, k8sgpt, helm-push, helm, vexctl, boring-registry,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, go-md2man, gke-gcloud-auth-plugin, ko, secrets-store-csi-driver-provider-aws, gosu, harbor-cli, kubernetes-ingress-defaultbackend, buildkitd, kube-state-metrics, local-path-provisioner, ip-masq-agent,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, kubernetes-csi-external-health-monitor, ko, secrets-store-csi-driver-provider-aws, gotestsum, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker, git-credential-oauth, kube-state-metrics,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: govulncheck, crane, prometheus-alertmanager, speedtest-go, go-md2man, gke-gcloud-auth-plugin, ko, kubernetes-csi-external-health-monitor, gosu, gotestsum, secrets-store-csi-driver-provider-aws, kubernetes-dashboard-web, helm-set-status, kapp, lazydocker,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, amass, cluster-proportional-autoscaler-fips, cargobump, fixuid, external-dns, tofu-controller, kapp-controller-fips, prometheus-adapter-fips, prometheus-mongodb-exporter-fips, dapr-fips, minio-operator-fips, src-fingerprint,...