OR
Vendor
oras-project
7
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85731 | OR oras-go oras-project | 8.8 | Sep 16 | oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) |
| CVE-2026-85732 | OR oras-go oras-project | 4.7 | Sep 16 | oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing |
| CVE-2026-55588 | OR oras oras-project | 6.5 | Aug 25 | ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption |
| CVE-2026-50151 | OR oras-go oras-project | 7.5 | Jul 17 | oras-go: credential forwarding via unvalidated Location header in blob upload |
| CVE-2026-50162 | OR oras-go oras-project | 6.9 | Jul 17 | oras-go: file store write outside workingDir via symlink traversal |
| CVE-2026-50163 | OR oras-go oras-project | 7.1 | Jul 17 | oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction |
| CVE-2026-48978 | OR oras-go oras-project | 2.1 | Jul 17 | oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens |