CVE-2026-29064

Zarf (Airgap Native Packager Manager for Kubernetes) is affected by a path traversal vulnerability in archive extraction from versions 0.54.0 up to before 0.73.1. The issue arises because symlink targets are not validated against the destination directory, enabling a package to create symlinks th...

Zarf 路径遍历漏洞

Zarf is an open-source Kubernetes offline environment software delivery tool developed by zarf-dev. Versions of Zarf from 0.54.0 to 0.73.1 had a path traversal vulnerability. This vulnerability stemmed from issues with path traversal in archive extraction, which could lead to arbitrary file readi...

PT-2026-23725

Name of the Vulnerable Software and Affected Versions Zarf versions 0.54.0 through 0.73.0 Description Zarf, an Airgap Native Packager Manager for Kubernetes, contains a path traversal flaw in its archive extraction process. A specially designed Zarf package can create symbolic links that point to...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: zot, jaeger-operator, skaffold, kyverno-fips, op-geth, spicedb-fips, docker-cli-buildx, keda-fips, harbor-fips, azuredisk-csi-fips, opencost-fips, kubescape-server-fips, syft, tekton-chains-fips, fulcio-fips, trillian, pulumi-kubernetes-operator,...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: xeol, trivy-operator, grype, steampipe, k9s, opentofu, zot, tfsec, zarf, kots, terraform, kubescape, rancher-fleet, tflint, wolfictl, syft, conftest, snyk-cli, terragrunt, trivy...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: xeol, trivy-operator, grype, steampipe, k9s, opentofu, zot, tfsec, zarf, kots, terraform, kubescape, rancher-fleet, tflint, wolfictl, syft, conftest, snyk-cli, terragrunt, trivy...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: zot, conftest-fips, grype, trivy-fips, tflint, rancher-fleet, terraform, chainctl, opentofu, grype-fips, opentofu-fips, rancher-fleet-fips, zarf, terraform-fips, conftest, cloudbeat-fips, cloudbeat, kots, trivy-operator, xeol-fips, terragrunt, snyk-cli, grype-db,...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: zot, conftest-fips, grype, trivy-fips, tflint, rancher-fleet, terraform, chainctl, opentofu, grype-fips, opentofu-fips, rancher-fleet-fips, zarf, terraform-fips, conftest, cloudbeat-fips, cloudbeat, kots, trivy-operator, xeol-fips, terragrunt, snyk-cli, grype-db,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: docker-compose, xeol, cluster-api-helm-controller, neuvector-scanner, nerdctl, grype, melange, datadog-agent, k8sgpt, kargo, kaniko, linkerd2, fuse-overlayfs-snapshotter, zot, cilium-cli, eksctl, skaffold, chartmuseum, helm, k3s, spegel, zarf, osv-scanner, kots,...

MAL-2024-12066 Malicious code in zarf-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8697bcf4cd06bebdca6e5806069048fc48ce173a5deb372b5992e95df3e0103a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zarf-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8697bcf4cd06bebdca6e5806069048fc48ce173a5deb372b5992e95df3e0103a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: spire-server, zot, conftest-fips, k8sgpt, kyverno, gatekeeper-fips, zarf, spire-server-fips, opa, conftest, kots, kyverno-fips, cosign, snyk-cli, datadog-agent-fips, kubescape, datadog-agent, policy-controller, cosign-fips, tfsec, policy-controller-fips, gatekeeper...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: conftest, snyk-cli, zot, kubescape, policy-controller, tfsec, cosign, zarf, datadog-agent, opa, k8sgpt, kots, spire-server...

GHSA-XFHP-JF8P-MH5W vulnerabilities

Vulnerabilities for packages: zot, conftest-fips, grype, trivy-fips, tflint, terraform, opentofu, zarf, conftest, kots, terragrunt, snyk-cli, datadog-agent-fips, kubescape, k9s, datadog-agent, wolfictl, trivy, tfsec...

GHSA-XFHP-JF8P-MH5W vulnerabilities

Vulnerabilities for packages: conftest, terraform, snyk-cli, zot, kubescape, tfsec, terragrunt, grype, trivy, datadog-agent, tflint, zarf, kots, wolfictl, k9s...

CVE-2024-6257 vulnerabilities

Vulnerabilities for packages: zot, conftest-fips, grype, trivy-fips, tflint, terraform, opentofu, zarf, conftest, kots, terragrunt, snyk-cli, datadog-agent-fips, kubescape, k9s, datadog-agent, wolfictl, trivy, tfsec...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: druid, falcoctl, flux-kustomize-controller, sops, trino, bank-vaults, flyte, cosign, hugo-extended, opentelemetry-collector, datadog-agent, grafana-mimir, k8sgpt, external-secrets-operator, grafana-agent-operator, flux-image-reflector-controller, step-ca, rook, corte...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: apko, falcoctl, slsa-verifier, vexctl, ko, melange, zot, goreleaser, skaffold, zarf, neuvector-sigstore-interface, tkn, flux-source-controller, gitsign, tekton-chains, aactl, kubescape, wolfictl, falco, policy-controller, spire-server...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: spire-server, zot, ko-fips, tkn-fips, skaffold, slsa-verifier, tekton-chains, tkn, ko, apko, flux-source-controller, chainctl, zarf, falcoctl-fips, spire-server-fips, falcoctl, neuvector-sigstore-interface, aactl, falco, melange, vexctl, kubescape, wolfictl, gitsign,...

GHSA-88JX-383Q-W4QC vulnerabilities

Vulnerabilities for packages: apko, falcoctl, slsa-verifier, vexctl, ko, melange, zot, goreleaser, skaffold, zarf, neuvector-sigstore-interface, tkn, flux-source-controller, gitsign, tekton-chains, aactl, kubescape, wolfictl, falco, policy-controller, spire-server...