CH
Vendor
chainguard-dev
21
CVEs
0
On KEV
1
New 30D
Products
AP8.3
apko
chainguard-dev
9 CVEs0 on KEV1 new
ME8.8
melange
chainguard-dev
9 CVEs0 on KEV0 new
MA6.5
malcontent
chainguard-dev
3 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105768 | AP apko chainguard-dev | 6.3 | Oct 5 | apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root |
| CVE-2026-54174 | AP apko chainguard-dev | 8.3 | Sep 11 | melange: Incomplete package integrity verification allows data section substitution |
| CVE-2026-42576 | AP apko chainguard-dev | 6.5 | May 9 | apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery |
| CVE-2026-42575 | AP apko chainguard-dev | 7.5 | May 9 | apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) |
| CVE-2026-42574 | AP apko chainguard-dev | 7.5 | May 9 | apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root |
| CVE-2026-29051 | ME melange chainguard-dev | 3.3 | Apr 24 | melange has Path Traversal via .PKGINFO in --persist-lint-results |
| CVE-2026-29050 | ME melange chainguard-dev | 6.1 | Apr 23 | melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses |
| CVE-2026-29049 | ME melange chainguard-dev | 4.3 | Mar 6 | melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI |
| CVE-2026-28407 | MA malcontent chainguard-dev | 5.3 | Feb 27 | malcontent's nested archive extraction failure can drop content from scan inputs |
| CVE-2026-25145 | ME melange chainguard-dev | 5.5 | Feb 4 | melange has a path traversal in license-path which allows reading files outside workspace |
| CVE-2026-25143 | ME melange chainguard-dev | 7.8 | Feb 4 | melange affected by potential host command execution via license-check YAML mode patch pipeline |
| CVE-2026-24844 | ME melange chainguard-dev | 8.8 | Feb 4 | melange pipeline working-directory could allow command injection |
| CVE-2026-24843 | ME melange chainguard-dev | 8.4 | Feb 4 | melange QEMU runner could write files outside workspace directory |
| CVE-2026-25140 | AP apko chainguard-dev | 7.5 | Feb 4 | apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams |
| CVE-2026-25121 | AP apko chainguard-dev | 7.5 | Feb 4 | apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base |
| CVE-2026-25122 | AP apko chainguard-dev | 5.5 | Feb 4 | apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams |
| CVE-2026-24846 | MA malcontent chainguard-dev | 5.0 | Jan 29 | malcontent's archive extraction could write outside extraction directory |
| CVE-2026-24845 | MA malcontent chainguard-dev | 6.5 | Jan 29 | malcontent's OCI image scanning could expose registry credentials |
| CVE-2025-54059 | ME melange chainguard-dev | 4.4 | Jul 18 | melange creates SBOM files in APKs with world-writable permissions |
| CVE-2025-53945 | AP apko chainguard-dev | 7.0 | Jul 18 | apko has incorrect permission (0666) in /etc/ld.so.cache and other files |