640 matches found
PT-2026-27137
Name of the Vulnerable Software and Affected Versions GoHarbor versions prior to 2.15.0 Description The use of hard-coded credentials in GoHarbor allows attackers to use the default password and gain access to the web user interface. Recommendations Update GoHarbor to version 2.15.0 or later...
GHSA-P77J-4MVH-X3M3 vulnerabilities
Vulnerabilities for packages: azure-service-operator, kyverno-policy-reporter, gatekeeper, zarf, kubescape, crossplane-provider-aws-cloudformation, trivy, tekton-pipelines, kube-logging-operator, ko, rancher-machine, jaeger, sftpgo-plugin-kms, kube-arangodb, contour, docker-cli-buildx, loki,...
CVE-2026-33186 vulnerabilities
Vulnerabilities for packages: azure-service-operator, kyverno-policy-reporter, gatekeeper, zarf, kubescape, crossplane-provider-aws-cloudformation, trivy, tekton-pipelines, kube-logging-operator, ko, rancher-machine, jaeger, sftpgo-plugin-kms, kube-arangodb, contour, docker-cli-buildx, loki,...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: argo-cd-fips, cloud-provider-aws-fips, onepassword-operator, zot, gitlab-rails-ce-fips, gitlab-operator, aws-node-termination-handler, calico, cluster-api-aws-controller-fips, fulcio, cerbos, trillian-fips, cluster-api-ipam-provider-in-cluster,...
CLEANSTART-2026-PC16040 Within HostnameError
Multiple security vulnerabilities affect the harbor-registry-fips package. Within HostnameError. See references for individual vulnerability details...
CLEANSTART-2026-BZ92766 beego is an open-source web framework for the Go programming language
Multiple security vulnerabilities affect the harbor-fips package. beego is an open-source web framework for the Go programming language. See references for individual vulnerability details...
CLEANSTART-2026-QK01721 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
CLEANSTART-2026-OI08379 Cancelling a query (e
Multiple security vulnerabilities affect the harbor-fips package. Cancelling a query e. See references for individual vulnerability details...
CLEANSTART-2026-XX70537 Cancelling a query (e
Multiple security vulnerabilities affect the harbor-fips package. Cancelling a query e. See references for individual vulnerability details...
CLEANSTART-2026-RY09679 go-redis is the official Redis client library for the Go programming language
Security vulnerability affects the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language...
CLEANSTART-2026-PO40318 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
CLEANSTART-2026-PG91940 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines
Multiple security vulnerabilities affect the harbor-registry package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. See references for individual vulnerability details...
CLEANSTART-2026-ZO91195 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
BIT-HARBOR-2024-22261 SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
BIT-HARBOR-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects...
CVE-2019-16097
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix:...
CVE-2019-16919
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper...
CVE-2024-55885 vulnerabilities
Vulnerabilities for packages: harbor...