31 matches found
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: trivy, opa, k3s, zot, wgcf, opentofu, undock, swagger, dive, prometheus-operator, nodetaint, ipfs-cluster, grafana-rollout-operator, libnvidia-container, helm-operator, cni-plugins, nri-consul, kind, aws-eks-pod-identity-agent, kubernetes-csi-driver-nfs, wal-g,...
CVE-2026-49349
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...
CVE-2026-49349 regclient may leak authentication credentials to external blob stores
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...
CVE-2026-49349
CVE-2026-49349 affects the Go-based regclient library. Before version 0.11.5, credentials for a registry could be leaked to external servers when interacting with a malicious registry, blob store, or a registry that doesn’t restrict external URLs for foreign blobs. The root cause is an insecure c...
GO-2026-5822 regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient
regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the urls field in the layer descriptor. An attacker can obtain authentication credentials by serving a manifest with a urls entry pointing to an attacker-controlled host and causing the client to...
regclient may leak authentication credentials to external blob stores
Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...
regclient-0.11.4-1.1 on GA media (moderate)
regclient-0.11.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:10763-1 Rating: moderate Cross-References: CVE-2026-33814 CVSS scores: CVE-2026-33814 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now b...
OPENSUSE-SU-2026:10763-1 regclient-0.11.4-1.1 on GA media
These are all security issues fixed in the regclient-0.11.4-1.1 package on the GA media of openSUSE Tumbleweed...
regclient-0.11.2-1.1 on GA media (moderate)
regclient-0.11.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10256-1 Rating: moderate Cross-References: CVE-2025-68121 CVSS scores: CVE-2025-68121 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-68121 SUSE : 7.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:...
OPENSUSE-SU-2026:10256-1 regclient-0.11.2-1.1 on GA media
These are all security issues fixed in the regclient-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2025:15807-1 regclient-0.11.1-1.1 on GA media
These are all security issues fixed in the regclient-0.11.1-1.1 package on the GA media of openSUSE Tumbleweed...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: opa, kubeflow-pipelines, kubernetes-event-exporter, opentofu, gogatekeeper, opa-envoy, k9s, kargo, prometheus-operator, rootlesskit, kubelet-csr-approver, ipfs-cluster, rancher-loglevel, newrelic-infrastructure-agent, pulumi-kubernetes-operator,...
CVE-2025-61727 vulnerabilities
Vulnerabilities for packages: opa, kubeflow-pipelines, kubernetes-event-exporter, opentofu, gogatekeeper, opa-envoy, k9s, kargo, prometheus-operator, rootlesskit, kubelet-csr-approver, ipfs-cluster, rancher-loglevel, newrelic-infrastructure-agent, pulumi-kubernetes-operator,...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws-fips, helm-operator-fips, azurefile-csi-fips, kiali-fips, knative-operator-fips, mockery, nri-apache, nri-f5, prometheus-pgbouncer-exporter-fips, gitlab-cng, ingress-nginx-controller-fips, terraform-docs, slsa-verifier, cloud-provider-azure-fips,...
regclient-0.10.0-1.1 on GA media (moderate)
regclient-0.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15723-1 Rating: moderate Cross-References: CVE-2025-47912 CVE-2025-58183 CVE-2025-58185 CVE-2025-58186 CVE-2025-58187 CVE-2025-58188 CVE-2025-58189 CVE-2025-61723 CVE-2025-9230 CVE-2025-9231 CVE-2025-9232 CVSS scores: CVE-2025-479...
OPENSUSE-SU-2025:15723-1 regclient-0.10.0-1.1 on GA media
These are all security issues fixed in the regclient-0.10.0-1.1 package on the GA media of openSUSE Tumbleweed...
GHSA-8PJC-487G-W6P2 vulnerabilities
Vulnerabilities for packages: trivy, opa, k3s, zot, wgcf, opentofu, undock, swagger, dive, prometheus-operator, nodetaint, ipfs-cluster, grafana-rollout-operator, libnvidia-container, helm-operator, cni-plugins, nri-consul, kind, aws-eks-pod-identity-agent, kubernetes-csi-driver-nfs, wal-g,...
GHSA-8PJC-487G-W6P2 vulnerabilities
Vulnerabilities for packages: mockgen, kube-logging-operator, rancher-security-scan, emissary, nri-f5, nri-apache, buildkitd, dapr, gobump, delve, ratify, cis-operator, ko, azure-service-operator, rancher-agent, prometheus-operator, oauth2-proxy, tigera-operator, kyverno, rancher-system-agent,...