OR
Product
oras-go
6
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 2Low 1
Watch
Add oras-go to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85731 | 8.8 | Sep 16 | oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) Affected: < 2.6.2 |
| CVE-2026-50151 | 7.5 | Jul 17 | oras-go: credential forwarding via unvalidated Location header in blob upload Affected: < 2.6.1 |
| CVE-2026-50163 | 7.1 | Jul 17 | oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction Affected: < 2.6.2 |
Showing 3