StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
216
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 216 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed125
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
harborharborOfficialVerified publisher1.19.21 of 8See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,650
artifact-hubartifact-hubVerified publisher1.23.03 of 7See more

artifact-hub artifact-hub 1.23.0

3 of the 7 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
oras.land/oras-go/v2@v2.6.0
2.6.1
artifacthub/scanner:v1.23.02d8365601f0e
oras.land/oras-go/v2@v2.6.0
2.6.1
artifacthub/tracker:v1.23.05368d21a6e5c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

10,755
falcofalcosecurity9.1.02 of 3See more

falco falcosecurity 9.1.0

2 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.44.17df783d5269a
oras.land/oras-go/v2@v2.6.0
2.6.1
falcosecurity/falcoctl:0.13.00eeb79adc580
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

5,227
chartmuseumchartmuseumVerified publisher3.10.41 of 1See more

chartmuseum chartmuseum 3.10.4

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.16.3c81f105c3682
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

1,360
chaos-meshchaos-meshVerified publisher2.8.41 of 4See more

chaos-mesh chaos-mesh 2.8.4

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.8.49e48285bb44c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

6,342
atlantisatlantis6.15.01 of 1See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,891
mesherymesheryOfficialVerified publisher1.0.691 of 1See more

meshery meshery 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,407
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,221
keelkeel1.2.21 of 1See more

keel keel 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/keel-hq/keel:0.22.3315e188a07c2
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

809
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

9,864
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.8.0595c548dee6f
oras.land/oras-go@v1.1.0
no fix listed

Open the chart page →

16,251
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

5,240
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,235
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

4,167
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,977
devtron-operatordevtron0.23.34 of 11See more

devtron-operator devtron 0.23.3

4 of the 11 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/kubectl:latest2ad610626658
oras.land/oras-go@v1.2.0
no fix listed
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

32,902
gatekeepergogatekeeperVerified publisher0.1.641 of 1See more

gatekeeper gogatekeeper 0.1.64

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/gogatekeeper/gatekeeper:4.9.0dcf583aba224
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

553
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

23,228
emqx-operatoremqx-operator2.3.21 of 2See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

4,531
meshery-operatormesheryOfficialVerified publisher1.0.691 of 2See more

meshery-operator meshery 1.0.69

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,415
alloy-operatorgrafana0.7.11 of 1See more

alloy-operator grafana 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.12.14ee4b71cf16a
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

401
gateway-operatorkongOfficialVerified publisher0.6.11 of 1See more

gateway-operator kong 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
kong/gateway-operator:1.603510967482b
oras.land/oras-go/v2@v2.5.1-0.20250331092043-d0ac8e455584
2.6.1

Open the chart page →

842
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,997
steampipe-powerpipe-kubernetessteampipe-powerpipe-kubernetesVerified publisher0.13.12 of 2See more

steampipe-powerpipe-kubernetes steampipe-powerpipe-kubernetes 0.13.1

2 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
oras.land/oras-go/v2@v2.5.0
2.6.1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

5,468
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

19,337
openshift-consoleav1o-chartsVerified publisher0.3.61 of 1See more

openshift-console av1o-charts 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
oras.land/oras-go@v0.4.0
no fix listed

Open the chart page →

9,052
cert-managerchoerodon1.8.21 of 4See more

cert-manager choerodon 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
oras.land/oras-go@v1.1.0
no fix listed

Open the chart page →

7,775
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,383
kubevpnkubevpn-charts2.11.71 of 1See more

kubevpn kubevpn-charts 2.11.7

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/kubenetworks/kubevpn:v2.11.7cce8ff866f60
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,596
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

11,582
loftloftVerified publisher0.0.0-ci.141 of 1See more

loft loft 0.0.0-ci.14

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

3,675
vcluster-platformloftVerified publisher4.12.01 of 1See more

vcluster-platform loft 4.12.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

744
helm-ai-kernelmindburn-labsOfficialVerified publisher0.8.51 of 2See more

helm-ai-kernel mindburn-labs 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/helmdigest-pinned105741fa6621
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

2,160
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
oras.land/oras-go/v2@v2.2.0
2.6.1

Open the chart page →

3,793
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

107,811
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,866
topaztopaz0.2.51 of 1See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,494
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go@v1.2.2
oras.land/oras-go/v2@v2.2.0
no fix listed
2.6.1

Open the chart page →

10,315
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

4,243
yataiyataiVerified publisher0.4.61 of 2See more

yatai yatai 0.4.6

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai:0.4.614b482c1f1b8
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

4,039
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.6.0
no fix listed
2.6.1

Open the chart page →

14,917
scannerappscodeVerified publisher2026.1.151 of 3See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
oras.land/oras-go/v2@v2.0.2
2.6.1

Open the chart page →

5,299
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

954
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

2,898
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,483
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,483
finops-stackcert-managerVerified publisher0.0.56 of 12See more

finops-stack cert-manager 0.0.5

6 of the 12 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
oras.land/oras-go/v2@v2.3.1
2.6.1

Open the chart page →

12,562
cloudttycloudtty0.8.91 of 2See more

cloudtty cloudtty 0.8.9

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,951
clusternet-hubclusternet1.0.01 of 1See more

clusternet-hub clusternet 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

1,394
clusternet-schedulerclusternet1.0.01 of 1See more

clusternet-scheduler clusternet 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

1,394

Container images carrying it

216 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
artifacthub/scanner:v1.19.0323d026e78c3
oras.land/oras-go@v1.2.5
no fix listed
1
artifacthub/tracker:v1.23.05368d21a6e5c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
artifacthub/tracker:v1.19.06596c8c4d955
oras.land/oras-go@v1.2.5
no fix listed
1
beopenit/door-agent:v3.0.5d24c323fe7c3
oras.land/oras-go@v1.2.5
no fix listed
1
beopenit/door-helm:v3.0.1b4d9f9bee224
oras.land/oras-go@v1.2.2
no fix listed
1
devopstales/trivy-operator:2.575136aa7a26e
oras.land/oras-go@v1.1.1
no fix listed
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
oras.land/oras-go@v1.2.2
no fix listed
1
epamedp/edp-headlamp:0.25.093417e18bb1a
oras.land/oras-go@v1.2.4
no fix listed
1
falcosecurity/falcoctl:0.13.00eeb79adc580
oras.land/oras-go/v2@v2.6.0
2.6.1
1
falcosecurity/falco-driver-loader:0.44.17df783d5269a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
flanksource/batch-runner:v1.0.44689687a7cf95
oras.land/oras-go/v2@v2.6.0
2.6.1
1
flomesh/fsm-manager:0.2.1122f849c70b25
oras.land/oras-go@v1.2.2
no fix listed
1
galaxy/cloudman-server:lateste5c265fe9fcd
oras.land/oras-go@v1.2.0
no fix listed
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
oras.land/oras-go@v1.1.0
no fix listed
1
goharbor/harbor-core:v2.5.386bf3031f4a7
oras.land/oras-go@v0.4.0
no fix listed
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
oras.land/oras-go@v0.4.0
no fix listed
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
oras.land/oras-go@v1.1.1
no fix listed
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
oras.land/oras-go@v1.2.3
no fix listed
1
hashicorp/waypoint:0.11.397d521a27498
oras.land/oras-go@v1.2.0
no fix listed
1
inseefrlab/shelly:cloudshell31f04ca7436b
oras.land/oras-go@v1.2.4
no fix listed
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
oras.land/oras-go/v2@v2.6.0
2.6.1
1
kong/gateway-operator:1.603510967482b
oras.land/oras-go/v2@v2.5.1-0.20250331092043-d0ac8e455584
2.6.1
1
kubebb/core:v0.1.62b9e7f451d6b
oras.land/oras-go@v1.2.0
no fix listed
1
kubebb/core:lateste366c34a9b8d
oras.land/oras-go@v1.2.0
no fix listed
1
kubebb/mesh-operator:v5.7.0163ebbfc7a82
oras.land/oras-go@v1.2.0
no fix listed
1
kubesphere/ks-extensions-museum:latest29681958f220
oras.land/oras-go@v1.2.3
no fix listed
1
kubesphere/kubectl:v1.27.1649b445b1b732
oras.land/oras-go@v1.2.2
no fix listed
1
kusionstack/kusion:v0.14.0126c8f0b0976
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
layer5/meshery:stable-latest78a8be21bef3
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
layer5/meshery-app-mesh:stable-latest77d59943b3d6
oras.land/oras-go@v1.2.0
no fix listed
1
layer5/meshery-consul:stable-latest25a4cc38abcd
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-istio:stable-latestfde47c141ec6
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-kuma:stable-latest9d25f029a8a2
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-linkerd:stable-latestb99c73bac1f5
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-osm:stable-latestec898e5786c6
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
oras.land/oras-go@v1.2.2
no fix listed
1
logiqai/flash:v3.10.265b996bc7bdc
oras.land/oras-go@v1.2.4
no fix listed
1
mavrick1/kubestellar-b:latest45ca0429a1d4
oras.land/oras-go@v1.2.5
no fix listed
1
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
oras.land/oras-go/v2@v2.5.0
2.6.1
1
murtazashah46/helmfile:latest4d11726cf803
oras.land/oras-go@v1.2.2
no fix listed
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
openpolicyagent/opa:0.53.16a58dea59933
oras.land/oras-go/v2@v2.2.0
2.6.1
1
phntom/chartmuseum:v0.16.053883b65d9b7
oras.land/oras-go@v1.2.2
no fix listed
1
phntom/chartmuseum:v0.15.29242b4df9e65
oras.land/oras-go@v1.2.0
no fix listed
1
platzio/backend:v0.6.5d5e5972f344b
oras.land/oras-go/v2@v2.6.0
2.6.1
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
oras.land/oras-go@v1.2.5
no fix listed
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
oras.land/oras-go/v2@v2.6.0
2.6.1
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
oras.land/oras-go@v1.2.2
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.