ME
Product
melange
9
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 4Low 1
Watch
Add melange to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24844 | 8.8 | Feb 4 | melange pipeline working-directory could allow command injection Affected: >= 0.3.0, < 0.40.3 |
| CVE-2026-24843 | 8.4 | Feb 4 | melange QEMU runner could write files outside workspace directory Affected: >= 0.11.3, < 0.40.3 |
| CVE-2026-54174 | 8.3 | Sep 11 | melange: Incomplete package integrity verification allows data section substitution Affected: < 0.50.4 |
| CVE-2026-25143 | 7.8 | Feb 4 | melange affected by potential host command execution via license-check YAML mode patch pipeline Affected: >= 0.10.0, < 0.40.3 |
| CVE-2026-29050 | 6.1 | Apr 23 | melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses Affected: >= 0.32.0, < 0.43.4 |
| CVE-2026-25145 | 5.5 | Feb 4 | melange has a path traversal in license-path which allows reading files outside workspace Affected: >= 0.14.0, < 0.40.3 |
| CVE-2025-54059 | 4.4 | Jul 18 | melange creates SBOM files in APKs with world-writable permissions Affected: >= 0.23.0, < 0.29.5 |
| CVE-2026-29049 | 4.3 | Mar 6 | melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI Affected: < 0.43.4 |
| CVE-2026-29051 | 3.3 | Apr 24 | melange has Path Traversal via .PKGINFO in --persist-lint-results Affected: >= 0.32.0, < 0.43.4 |
Showing 9