AP
Product
apko
9
CVEs
0
On KEV
8.3
Max CVSS
1
New 30D
Severity mix
Critical 0High 6Medium 3Low 0
Watch
Add apko to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-54174 | 8.3 | Sep 11 | melange: Incomplete package integrity verification allows data section substitution Affected: < 1.2.9 |
| CVE-2026-42575 | 7.5 | May 9 | apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) Affected: < 1.2.7 |
| CVE-2026-42574 | 7.5 | May 9 | apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root Affected: >= 0.14.8, < 1.2.5 |
| CVE-2026-25140 | 7.5 | Feb 4 | apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams Affected: >= 0.14.8, < 1.1.1 |
| CVE-2026-25121 | 7.5 | Feb 4 | apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base Affected: >= 0.14.8, < 1.1.1 |
| CVE-2025-53945 | 7.0 | Jul 18 | apko has incorrect permission (0666) in /etc/ld.so.cache and other files Affected: >= 0.27.0, < 0.29.5 |
Showing 6