EUVD-2026-58750

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

CVE-2026-12364 Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign, cosign-fips, gh, slsa-verifier...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: policy-controller, ratify, kyverno-policy-reporter-plugins-kyverno-fips, buildkitd, neuvector-sigstore-interface, docker, falcoctl, sigstore-scaffolding-fips, vexctl, cg, tekton-chains-fips, zarf, chainctl, buildkitd-fips, gh, trivy, ratify-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: policy-controller, neuvector-sigstore-interface, falcoctl, melange, sigstore-scaffolding-fips, vexctl, zarf, tekton-chains-fips, chainctl, gh, trivy, spire-server, slsa-verifier, flux-source-controller-fips, cosign, policy-controller-fips, wolfictl, kubescape,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: policy-controller, neuvector-sigstore-interface, falcoctl, melange, vexctl, zarf, tekton-chains-fips, chainctl, spire-server, slsa-verifier, policy-controller-fips, wolfictl, kubescape, flux-source-controller, apko, gitsign, ko-fips, ko, spire-server-fips,...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gh, cosign...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: terragrunt, flux-kustomize-controller, tkn, aactl, argo-workflows, tekton-chains, rekor, gitsign, slsa-verifier, kots, spire-server, oauth2-proxy, cloudflared, kubescape, fulcio, cosign, sops, dex, flux-source-controller, vexctl...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: slsa-verifier, skopeo, gitsign, aactl, falcoctl, buildah, kubescape, kyverno-notation-aws, podman, tekton-chains, kyverno, undock, zarf, flux-source-controller, witness, ratify, kots...

GO-2026-5694 vulnerabilities

Vulnerabilities for packages: slsa-verifier, trivy-operator, policy-controller, aactl, crossplane, kyverno-notation-aws, kyverno, teleport, zot, ratify, kubescape, trivy...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: tkn, policy-controller, aactl, zarf, tekton-chains, trivy-operator, gitsign, falcoctl, goreleaser, kyverno, neuvector-sigstore-interface, slsa-verifier, tflint, spire-server, crossplane, kyverno-notation-aws, teleport, kubescape, ko, ratify...

GO-2026-4529 vulnerabilities

Vulnerabilities for packages: trivy-operator, tkn, vexctl, aactl, skaffold, kyverno-notation-aws, tekton-chains, kyverno, teleport, zot, ratify, slsa-verifier, trivy, ko...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: slsa-verifier, tkn, policy-controller, spire-server, aactl, skaffold, apko, cosign, tekton-chains, melange, flux-source-controller, kubescape, ko...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, argocd-image-updater, crossplane-provider-aws-iam, terraform-provider-tls, zarf, podman, fscrypt, wolfictl, containerd, crossplane-provider-family-azure, glab, falco-no-driver, crossplane-provider-aws-sqs, pulumi-language-dotnet,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: tkn, policy-controller, aactl, zarf, sigstore-scaffolding, witness, tekton-chains, zot, docker, trivy-operator, gitsign, skaffold, falcoctl, goreleaser, kyverno, neuvector-sigstore-interface, slsa-verifier, trivy, tflint, spire-server, crossplane, docker-cli-buildx,...

GO-2026-4311 vulnerabilities

Vulnerabilities for packages: slsa-verifier, skopeo, gitsign, aactl, falco-no-driver, falcoctl, kubescape, cosign, tekton-chains, zarf, sigstore-scaffolding, witness, kots, vexctl...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: tkn, policy-controller, aactl, zarf, sigstore-scaffolding, witness, tekton-chains, rekor, zot, docker, trivy-operator, gitsign, skaffold, falcoctl, goreleaser, neuvector-sigstore-interface, slsa-verifier, trivy, tflint, spire-server, kyverno-notation-aws, gh, telepor...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, opentelemetry-collector, flux-kustomize-controller, terragrunt, policy-controller, skopeo, tkn, aactl, crossplane-provider-azure-authorization, snyk-cli, scorecard, sigstore-scaffolding, zarf, tekton-chains, rekor, zot, ksops,...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-68295

A flaw was found in the Linux kernel. The LoongArch Just-In-Time JIT compiler for the Berkeley Packet Filter BPF subsystem incorrectly sign-extends the results of signed 32-bit division and modulo operations. This behavior causes the upper bits of BPF registers to be set, which differs from the...