StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
216
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 216 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed125
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
harborkubesphereVerified publisher1.9.34 of 11See more

harbor kubesphere 1.9.3

4 of the 11 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
oras.land/oras-go@v1.1.0
no fix listed
goharbor/harbor-core:v2.5.386bf3031f4a7
oras.land/oras-go@v0.4.0
no fix listed
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
oras.land/oras-go@v0.4.0
no fix listed
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

17,798
chaos-meshkubesphere-stable2.5.11 of 3See more

chaos-mesh kubesphere-stable 2.5.1

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

8,555
kubestellar-consolekubestellar-consoleVerified publisher0.3.411 of 2See more

kubestellar-console kubestellar-console 0.3.41

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.32.47e1e7d5b7a96
oras.land/oras-go@v1.2.6
no fix listed

Open the chart page →

4,439
kubestellar-uikubestellaruiVerified publisher0.1.11 of 4See more

kubestellar-ui kubestellarui 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
mavrick1/kubestellar-b:latest45ca0429a1d4
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

4,763
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

20,204
kusionkusionstackVerified publisher0.14.11 of 3See more

kusion kusionstack 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

6,824
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

4,271
linkerd-preview-vizlinkerd-buoyantVerified publisher25.4.33 of 5See more

linkerd-preview-viz linkerd-buoyant 25.4.3

3 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/buoyantio/metrics-api:preview-25.4.32cef2a3f97da
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/buoyantio/tap:preview-25.4.3e02a8bd9e2c3
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/buoyantio/web:preview-25.4.33ee1b62aa111
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

3,420
devpod-proloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

3,225
loft-agentloftVerified publisher3.2.41 of 1See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/agent:3.2.45c109914ff73
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

2,444
vcluster-control-planeloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

3,225
vcluster-headloftVerified publisher0.0.0-035ec6e1 of 2See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,269
vcluster-proloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

5,085
vcluster-pro-eksloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-eks loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

5,936
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.102 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
oras.land/oras-go@v1.2.0
no fix listed
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

5,768
vcluster-pro-k8sloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

8,202
apica-ascentlogiqai2.0.41 of 19See more

apica-ascent logiqai 2.0.4

1 of the 19 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
logiqai/flash:v3.10.265b996bc7bdc
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

23,613
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed

Open the chart page →

9,774
cert-manager-setupmesosphere-stable0.2.101 of 5See more

cert-manager-setup mesosphere-stable 0.2.10

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

7,179
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,334
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,843
agent-control-cdnewrelic1.0.02 of 3See more

agent-control-cd newrelic 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

5,034
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

17,070
argocd-agent-addonocm-helm-chartsVerified publisher0.29.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.29.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

626
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

535
opa-nginxopa-nginx0.0.31 of 2See more

opa-nginx opa-nginx 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
openpolicyagent/opa:0.53.16a58dea59933
oras.land/oras-go/v2@v2.2.0
2.6.1

Open the chart page →

2,167
fsmopenshift0.1.8-ubi.61 of 6See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
oras.land/oras-go@v0.4.0
no fix listed

Open the chart page →

16,556
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.6.0
no fix listed
2.6.1

Open the chart page →

4,127
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
oras.land/oras-go@v1.1.1
oras.land/oras-go/v2@v2.3.0
no fix listed
2.6.1

Open the chart page →

8,599
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,821
opslevelopslevelVerified publisher2025.1.221 of 10See more

opslevel opslevel 2025.1.22

1 of the 10 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
replicated/replicated-sdk:1.0.0-beta.318751b4963250
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

5,554
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.15.29242b4df9e65
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

26,840
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
oras.land/oras-go@v1.2.4
no fix listed
quay.io/argoproj/argocd:v2.14.115fc69e31c755
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

25,934
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

11,151
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,270
headlampradar-baseVerified publisher1.0.01 of 1See more

headlamp radar-base 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.43.05d03caa26df7
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

613
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,837
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

4,038
gitlab-operatorrock8sVerified publisher0.7.01 of 2See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
oras.land/oras-go@v0.4.0
no fix listed

Open the chart page →

5,422
mailserverrock8sVerified publisher0.1.21 of 1See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

1,946
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

9,607
argocd-certificate-refreshromholdings0.10.81 of 1See more

argocd-certificate-refresh romholdings 0.10.8

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

12,949
devtron-enterpriseromholdings48.0.06 of 28See more

devtron-enterprise romholdings 48.0.0

6 of the 28 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed
quay.io/devtron/kubectl:latest2ad610626658
oras.land/oras-go@v1.2.0
no fix listed
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

68,240
devtron-operatorromholdings0.23.34 of 11See more

devtron-operator romholdings 0.23.3

4 of the 11 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/kubectl:latest2ad610626658
oras.land/oras-go@v1.2.0
no fix listed
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

32,902
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

5,819
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

2,620
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,674

Container images carrying it

216 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
artifacthub/scanner:v1.19.0323d026e78c3
oras.land/oras-go@v1.2.5
no fix listed
1
artifacthub/tracker:v1.23.05368d21a6e5c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
artifacthub/tracker:v1.19.06596c8c4d955
oras.land/oras-go@v1.2.5
no fix listed
1
beopenit/door-agent:v3.0.5d24c323fe7c3
oras.land/oras-go@v1.2.5
no fix listed
1
beopenit/door-helm:v3.0.1b4d9f9bee224
oras.land/oras-go@v1.2.2
no fix listed
1
devopstales/trivy-operator:2.575136aa7a26e
oras.land/oras-go@v1.1.1
no fix listed
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
oras.land/oras-go@v1.2.2
no fix listed
1
epamedp/edp-headlamp:0.25.093417e18bb1a
oras.land/oras-go@v1.2.4
no fix listed
1
falcosecurity/falcoctl:0.13.00eeb79adc580
oras.land/oras-go/v2@v2.6.0
2.6.1
1
falcosecurity/falco-driver-loader:0.44.17df783d5269a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
flanksource/batch-runner:v1.0.44689687a7cf95
oras.land/oras-go/v2@v2.6.0
2.6.1
1
flomesh/fsm-manager:0.2.1122f849c70b25
oras.land/oras-go@v1.2.2
no fix listed
1
galaxy/cloudman-server:lateste5c265fe9fcd
oras.land/oras-go@v1.2.0
no fix listed
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
oras.land/oras-go@v1.1.0
no fix listed
1
goharbor/harbor-core:v2.5.386bf3031f4a7
oras.land/oras-go@v0.4.0
no fix listed
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
oras.land/oras-go@v0.4.0
no fix listed
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
oras.land/oras-go@v1.1.1
no fix listed
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
oras.land/oras-go@v1.2.3
no fix listed
1
hashicorp/waypoint:0.11.397d521a27498
oras.land/oras-go@v1.2.0
no fix listed
1
inseefrlab/shelly:cloudshell31f04ca7436b
oras.land/oras-go@v1.2.4
no fix listed
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
oras.land/oras-go/v2@v2.6.0
2.6.1
1
kong/gateway-operator:1.603510967482b
oras.land/oras-go/v2@v2.5.1-0.20250331092043-d0ac8e455584
2.6.1
1
kubebb/core:v0.1.62b9e7f451d6b
oras.land/oras-go@v1.2.0
no fix listed
1
kubebb/core:lateste366c34a9b8d
oras.land/oras-go@v1.2.0
no fix listed
1
kubebb/mesh-operator:v5.7.0163ebbfc7a82
oras.land/oras-go@v1.2.0
no fix listed
1
kubesphere/ks-extensions-museum:latest29681958f220
oras.land/oras-go@v1.2.3
no fix listed
1
kubesphere/kubectl:v1.27.1649b445b1b732
oras.land/oras-go@v1.2.2
no fix listed
1
kusionstack/kusion:v0.14.0126c8f0b0976
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
layer5/meshery:stable-latest78a8be21bef3
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
layer5/meshery-app-mesh:stable-latest77d59943b3d6
oras.land/oras-go@v1.2.0
no fix listed
1
layer5/meshery-consul:stable-latest25a4cc38abcd
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-istio:stable-latestfde47c141ec6
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-kuma:stable-latest9d25f029a8a2
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-linkerd:stable-latestb99c73bac1f5
oras.land/oras-go@v1.2.4
no fix listed
1
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-osm:stable-latestec898e5786c6
oras.land/oras-go@v1.2.2
no fix listed
1
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
oras.land/oras-go@v1.2.2
no fix listed
1
logiqai/flash:v3.10.265b996bc7bdc
oras.land/oras-go@v1.2.4
no fix listed
1
mavrick1/kubestellar-b:latest45ca0429a1d4
oras.land/oras-go@v1.2.5
no fix listed
1
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
oras.land/oras-go/v2@v2.5.0
2.6.1
1
murtazashah46/helmfile:latest4d11726cf803
oras.land/oras-go@v1.2.2
no fix listed
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
oras.land/oras-go/v2@v2.6.0
2.6.1
1
openpolicyagent/opa:0.53.16a58dea59933
oras.land/oras-go/v2@v2.2.0
2.6.1
1
phntom/chartmuseum:v0.16.053883b65d9b7
oras.land/oras-go@v1.2.2
no fix listed
1
phntom/chartmuseum:v0.15.29242b4df9e65
oras.land/oras-go@v1.2.0
no fix listed
1
platzio/backend:v0.6.5d5e5972f344b
oras.land/oras-go/v2@v2.6.0
2.6.1
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
oras.land/oras-go@v1.2.5
no fix listed
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
oras.land/oras-go/v2@v2.6.0
2.6.1
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
oras.land/oras-go@v1.2.2
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.