CH
Vendor
Chainguard
16
CVEs
0
On KEV
2
New 30D
Products
CA3.3
Chainguard Academy (edu)
Chainguard
2 CVEs0 on KEV2 new
ME8.8
Melange
Chainguard
7 CVEs0 on KEV0 new
AP7.5
Apko
Chainguard
3 CVEs0 on KEV0 new
MA6.5
Malcontent
Chainguard
3 CVEs0 on KEV0 new
KA8.2
Kaniko
Chainguard
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105767 | CA Chainguard Academy (edu) Chainguard | 3.3 | Oct 5 | Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands |
| CVE-2026-105766 | CA Chainguard Academy (edu) Chainguard | 3.1 | Oct 5 | Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP |
| CVE-2026-29051 | ME Melange Chainguard | 3.3 | Apr 24 | melange has Path Traversal via .PKGINFO in --persist-lint-results |
| CVE-2026-29050 | ME Melange Chainguard | 6.1 | Apr 23 | melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses |
| CVE-2026-29049 | ME Melange Chainguard | 4.3 | Mar 6 | melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI |
| CVE-2026-28407 | MA Malcontent Chainguard | 5.3 | Feb 27 | malcontent's nested archive extraction failure can drop content from scan inputs |
| CVE-2026-28406 | KA Kaniko Chainguard | 8.2 | Feb 27 | kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory |
| CVE-2026-25145 | ME Melange Chainguard | 5.5 | Feb 4 | melange has a path traversal in license-path which allows reading files outside workspace |
| CVE-2026-25143 | ME Melange Chainguard | 7.8 | Feb 4 | melange affected by potential host command execution via license-check YAML mode patch pipeline |
| CVE-2026-24844 | ME Melange Chainguard | 8.8 | Feb 4 | melange pipeline working-directory could allow command injection |
| CVE-2026-24843 | ME Melange Chainguard | 8.4 | Feb 4 | melange QEMU runner could write files outside workspace directory |
| CVE-2026-25140 | AP Apko Chainguard | 7.5 | Feb 4 | apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams |
| CVE-2026-25121 | AP Apko Chainguard | 7.5 | Feb 4 | apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base |
| CVE-2026-25122 | AP Apko Chainguard | 5.5 | Feb 4 | apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams |
| CVE-2026-24846 | MA Malcontent Chainguard | 5.0 | Jan 29 | malcontent's archive extraction could write outside extraction directory |
| CVE-2026-24845 | MA Malcontent Chainguard | 6.5 | Jan 29 | malcontent's OCI image scanning could expose registry credentials |