GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, kube-bench, gcsfuse, bom, cilium-cli, flux, kubernetes-dashboard, cloud-sql-proxy, rabbitmq-cluster-operator, harbor-cli, aws-eks-pod-identity-agent, lazydocker, undock, cloud-provider-vsphere, kapp, nri-redis, spire-controller-manager, thanos-operato...

CVE-2026-49349

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

CVE-2026-49349

CVE-2026-49349 affects the Go-based regclient library. Before version 0.11.5, credentials for a registry could be leaked to external servers when interacting with a malicious registry, blob store, or a registry that doesn’t restrict external URLs for foreign blobs. The root cause is an insecure c...

EUVD-2026-57221

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

CVE-2026-49349

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

CVE-2026-49349 regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

CVE-2026-49349 regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

CVE-2026-49349 regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

CVE-2026-49349: Insufficiently Protected Credentials

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

GO-2026-5822 regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient

regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient...

regclient may leak authentication credentials to external blob stores

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the urls field in the layer descriptor. An attacker can obtain authentication credentials by serving a manifest with a urls entry pointing to an attacker-controlled host and causing the client to...

regclient-0.11.4-1.1 on GA media (moderate)

regclient-0.11.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:10763-1 Rating: moderate Cross-References: CVE-2026-33814 CVSS scores: CVE-2026-33814 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now b...

OPENSUSE-SU-2026:10763-1 regclient-0.11.4-1.1 on GA media

These are all security issues fixed in the regclient-0.11.4-1.1 package on the GA media of openSUSE Tumbleweed...

regclient-0.11.2-1.1 on GA media (moderate)

regclient-0.11.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10256-1 Rating: moderate Cross-References: CVE-2025-68121 CVSS scores: CVE-2025-68121 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-68121 SUSE : 7.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:...

OPENSUSE-SU-2026:10256-1 regclient-0.11.2-1.1 on GA media

These are all security issues fixed in the regclient-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15807-1 regclient-0.11.1-1.1 on GA media

These are all security issues fixed in the regclient-0.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: promxy, kubeflow-katib, runc, kube-bench, nvidia-container-toolkit, terraform-provider-time, pgtimetable, opensearch-k8s-operator, temporal-server, rancher-loglevel, splunk-otel-collector, mockery, prometheus-adapter, pulumi-kubernetes-operator, gitness,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: promxy, kubeflow-katib, runc, kube-bench, nvidia-container-toolkit, terraform-provider-time, pgtimetable, opensearch-k8s-operator, temporal-server, rancher-loglevel, splunk-otel-collector, mockery, prometheus-adapter, pulumi-kubernetes-operator, gitness,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter-fips, aws-flb-cloudwatch-fips, cue-fips, kpt, kiali-fips, gitlab-workhorse-ce-fips, monstache, opa, gitea, fluxcd-kustomize-mutating-webhook-fips, chisel, cloudnative-pg-fips, helm-operator-fips, supercronic, nfpm, go-discover,...