Vulnerabilities

TI-2026-85692 CVE-2026-122267

MinIO Signature V4 verification accepts unsigned x-amz-* headers

LOW 37

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00199 Published 2026-11-05 No fix listed CWE-347

TI-2026-83911 CVE-2026-105769 · GHSA-5q7h-w9jf-cx97

kaniko sends Azure access tokens to lookalike ACR registry hosts

MEDIUM 41

kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00196 Published 2026-11-02 Fixed in 1.25.20 CWE-346

TI-2026-68378 CVE-2026-105768

Numeric truncation in apko lets packages write root UID and GID

LOW 28

apko allows users to build and publish OCI container images built from apk packages.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00301 Published 2026-10-05 Fixed in 1.4.5 CWE-197

TI-2026-68377 CVE-2026-105767 · GHSA-vh2r-m6q8-8hp3

Command injection in Chainguard Academy integrate-platform-docs action

LOW 10

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0e…

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00185 Published 2026-10-05 Fixed CWE-78

TI-2026-68376 CVE-2026-105766 · GHSA-cfhv-267f-j755

Chainguard Academy Nginx redirect downgrades HTTPS to HTTP

LOW 11

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e80380…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00106 Published 2026-10-05 Fixed CWE-319

TI-2026-39078 CVE-2026-54174 · GHSA-fpg8-7664-jc5q

melange: Incomplete package integrity verification allows data section substitution

LOW 37

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00155 Published 2026-09-11 Fixed in 0.50.4, 1.2.9 CWE-345

TI-2026-30856 CVE-2026-42576 · GHSA-m7hm-vm4x-28jf

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

LOW 28

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00252 Published 2026-05-09 Fixed in 1.2.7 CWE-704

TI-2026-30855 CVE-2026-42575 · GHSA-hcwr-pq9g-rq3m

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

LOW 38

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00159 Published 2026-05-09 Fixed in 1.2.7 CWE-345

TI-2026-30854 CVE-2026-42574 · GHSA-qq3r-w4hj-gjp6

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

LOW 39

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00352 Published 2026-05-09 Fixed in 1.2.5 CWE-22

TI-2026-23196 CVE-2026-29051 · GHSA-q2pw-xx38-p64j

melange has Path Traversal via .PKGINFO in --persist-lint-results

LOW 20

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 4.4 Local No auth User interaction EPSS 0.00172 Published 2026-04-24 Fixed in 0.43.4 CWE-22

TI-2026-23195 CVE-2026-29050 · GHSA-98f2-w9h9-7fp9

melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

LOW 26

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.0014 Published 2026-04-23 Fixed in 0.43.4 CWE-22

TI-2026-23194 CVE-2026-29049 · GHSA-7rp8-r62p-q6wc

melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

LOW 20

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00263 Published 2026-03-06 Fixed in 0.43.4 CWE-400

TI-2026-22681 CVE-2026-28407 · GHSA-945p-3jhm-6rcp

malcontent's nested archive extraction failure can drop content from scan inputs

LOW 31

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00411 Published 2026-02-27 Fixed in 1.21.0 CWE-703

TI-2026-22680 CVE-2026-28406 · GHSA-6rxq-q92g-4rmf

kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory

MEDIUM 43

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00676 Published 2026-02-27 Partial fix · 1.25.10 CWE-22

TI-2026-20307 CVE-2026-25145 · GHSA-2w4f-9fgg-q2v9

melange has a path traversal in license-path which allows reading files outside workspace

LOW 24

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00191 Published 2026-02-04 Fixed in 0.40.3 CWE-22

TI-2026-20305 CVE-2026-25143 · GHSA-rf4g-89h5-crcr

melange affected by potential host command execution via license-check YAML mode patch pipeline

LOW 35

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00199 Published 2026-02-04 Fixed in 0.40.3 CWE-78

TI-2026-20043 CVE-2026-24844 · GHSA-vqqr-rmpc-hhg2

melange pipeline working-directory could allow command injection

LOW 39

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00198 Published 2026-02-04 Fixed in 0.40.3 CWE-78

TI-2026-20042 CVE-2026-24843 · GHSA-qxx2-7h4c-83f4

melange QEMU runner could write files outside workspace directory

LOW 36

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00186 Published 2026-02-04 Fixed in 0.40.3 CWE-22

TI-2026-20302 CVE-2026-25140

apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

LOW 39

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00407 Published 2026-02-04 Fixed in 1.1.1 CWE-400

TI-2026-20284 CVE-2026-25121 · GHSA-5g94-c2wx-8pxw

apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base

LOW 39

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00413 Published 2026-02-04 Fixed in 1.1.1, 1.1.0 CWE-23

TI-2026-20285 CVE-2026-25122 · GHSA-6p9p-q6wh-9j89

apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

LOW 24

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00129 Published 2026-02-04 Fixed in 1.1.0 CWE-400

TI-2026-20045 CVE-2026-24846 · GHSA-923j-vrcg-hxwh

malcontent's archive extraction could write outside extraction directory

LOW 24

malcontent discovers supply-chain compromises through.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00187 Published 2026-01-29 Fixed in 1.20.3 CWE-22

TI-2026-20044 CVE-2026-24845 · GHSA-9m43-p3cx-w8j5

malcontent's OCI image scanning could expose registry credentials

LOW 29

malcontent discovers supply-chain compromises through.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00375 Published 2026-01-29 Fixed in 1.20.3 CWE-522

TI-2025-33904 CVE-2025-54059 · GHSA-5662-cv6m-63wh

melange creates SBOM files in APKs with world-writable permissions

LOW 19

melange allows users to build apk packages using declarative pipelines.

CVSS 3.1MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00153 Published 2025-07-18 Fixed in 0.29.5 CWE-276

TI-2025-33810 CVE-2025-53945 · GHSA-x6ph-r535-3vjw

apko has incorrect permission (0666) in /etc/ld.so.cache and other files

LOW 30

apko allows users to build and publish OCI container images built from apk packages.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00143 Published 2025-07-18 Fixed in 0.29.5 CWE-276

Vulnerabilities

Filters