Login Request a demo
OR
Product
oras-go
by oras-project · last CVE Sep 16, 2026
6
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 3Medium 2Low 1
Severity
All severities6Critical0High3Medium2Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add oras-go to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-85731
8.8
1%
Sep 16
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
Affected: < 2.6.2
CVE-2026-50151
7.5
0%
Jul 17
oras-go: credential forwarding via unvalidated Location header in blob upload
Affected: < 2.6.1
CVE-2026-50163
7.1
0%
Jul 17
oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction
Affected: < 2.6.2
CVE-2026-50162
6.9
0%
Jul 17
oras-go: file store write outside workingDir via symlink traversal
Affected: < 2.6.1
CVE-2026-85732
4.7
0%
Sep 16
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
Affected: < 2.6.2
CVE-2026-48978
2.1
0%
Jul 17
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
Affected: < 2.6.1
Showing 6