StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
213
of 17,781 indexed, latest versions
Container images
216
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 213 of 17,781 indexed charts deploy, on 216 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed125
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

213 by stars
ChartLatestAffected imagesRadar Score
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

10,037
developer-operatordeveloper-operatorVerified publisher2.1.21 of 1See more

developer-operator developer-operator 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,828
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

5,598
dockyarddockyardVerified publisher0.4.01 of 1See more

dockyard dockyard 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/kgma74/dockyard:0.4.0b40439329191
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

1,542
fsmfsmOfficialVerified publisher0.2.111 of 5See more

fsm fsm 0.2.11

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
flomesh/fsm-manager:0.2.1122f849c70b25
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

4,215
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

16,514
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

5,508
kdiff-snapshotskdiff-snapshotsVerified publisher0.0.551 of 1See more

kdiff-snapshots kdiff-snapshots 0.0.55

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

5,789
ks-corekubeblocksVerified publisher1.1.32 of 5See more

ks-core kubeblocks 1.1.3

2 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
kubesphere/ks-extensions-museum:latest29681958f220
oras.land/oras-go@v1.2.3
no fix listed
kubesphere/kubectl:v1.27.1649b445b1b732
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

4,721
kubernetes-stateless-chartkubernetes-stateless-chart1.0.31 of 1See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

3,274
kubescoutkubescouteVerified publisher0.1.11 of 1See more

kubescout kubescoute 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

714
mesherykubesphere-stable0.5.09 of 13See more

meshery kubesphere-stable 0.5.0

9 of the 13 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
layer5/meshery-app-mesh:stable-latest77d59943b3d6
oras.land/oras-go@v1.2.0
no fix listed
layer5/meshery-consul:stable-latest25a4cc38abcd
oras.land/oras-go@v1.2.4
no fix listed
layer5/meshery-istio:stable-latestfde47c141ec6
oras.land/oras-go@v1.2.4
no fix listed
layer5/meshery-kuma:stable-latest9d25f029a8a2
oras.land/oras-go@v1.2.2
no fix listed
layer5/meshery-linkerd:stable-latestb99c73bac1f5
oras.land/oras-go@v1.2.4
no fix listed
layer5/meshery-nginx-sm:stable-latestb3864dfd47ad
oras.land/oras-go@v1.2.2
no fix listed
layer5/meshery-osm:stable-latestec898e5786c6
oras.land/oras-go@v1.2.2
no fix listed
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

24,690
kubetailkubetailVerified publisher0.26.01 of 3See more

kubetail kubetail 0.26.0

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/kubetail-org/kubetail-dashboard:0.17.08617f0a7f703
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,850
kubeservice-cosign-webhookkubservice-chartsVerified publisher1.1.11 of 5See more

kubeservice-cosign-webhook kubservice-charts 1.1.1

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

7,087
kubeservice-custom-limitrangekubservice-chartsVerified publisher1.3.01 of 5See more

kubeservice-custom-limitrange kubservice-charts 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

5,941
kubeservice-namespace-node-affinitykubservice-chartsVerified publisher1.1.21 of 5See more

kubeservice-namespace-node-affinity kubservice-charts 1.1.2

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
oras.land/oras-go@v1.2.3
no fix listed

Open the chart page →

6,872
vcluster-k0sloftVerified publisher0.0.0-ci.31 of 2See more

vcluster-k0s loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

3,136
chartmuseummike75151.2.01 of 1See more

chartmuseum mike7515 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

3,168
periscopeperiscopeVerified publisher1.1.61 of 1See more

periscope periscope 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/gnana997/periscope:1.1.621b284fb00f2
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

800
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

2,939
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

8,158
artifact-hubsoftonic1.19.04 of 8See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
oras.land/oras-go@v1.2.3
no fix listed
artifacthub/hub:v1.19.0111918d8c399
oras.land/oras-go@v1.2.5
no fix listed
artifacthub/scanner:v1.19.0323d026e78c3
oras.land/oras-go@v1.2.5
no fix listed
artifacthub/tracker:v1.19.06596c8c4d955
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

14,491
guardrails-agent-kubernetesturbotVerified publisher0.3.01 of 1See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

4,020
upbot-operatorupbot-operator0.0.201 of 2See more

upbot-operator upbot-operator 0.0.20

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.28.13e5c0b053fed7
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

4,460
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

5,225
aktoakto0.2.01 of 7See more

akto akto 0.2.0

1 of the 7 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

13,613
akto-hybrid-redactakto1.44.41 of 5See more

akto-hybrid-redact akto 1.44.4

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

4,777
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

6,486
akto-mini-testing-kafkaakto1.42.11 of 5See more

akto-mini-testing-kafka akto 1.42.1

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

6,397
akto-protectionakto0.1.01 of 4See more

akto-protection akto 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

11,285
akto-testing-db-layerakto1.42.161 of 2See more

akto-testing-db-layer akto 1.42.16

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

5,489
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,592
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,894
ace-installerappscodeVerified publisher2026.9.111 of 2See more

ace-installer appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,225
ace-installer-certifiedappscodeVerified publisher2026.9.111 of 2See more

ace-installer-certified appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,225
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,592
fargocdappscodeVerified publisher2026.5.221 of 1See more

fargocd appscode 2026.5.22

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

446
fargocd-managerappscodeVerified publisher2026.5.221 of 1See more

fargocd-manager appscode 2026.5.22

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

446
kube-ui-serverappscodeVerified publisher2026.9.111 of 1See more

kube-ui-server appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-ui-server:v0.7.079e67164b4f0
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

236
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,592
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

37,268
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

7,300
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

4,923
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

14,352
kubermatic-operatorbuttahtoastVerified publisher2.24.51 of 1See more

kubermatic-operator buttahtoast 2.24.5

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/kubermatic/kubermatic:v2.24.5ebba936046ab
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

2,770
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
oras.land/oras-go@v1.2.6
no fix listed

Open the chart page →

14,130
capsule-argo-addoncapsule-argo-addonVerified publisher0.7.51 of 2See more

capsule-argo-addon capsule-argo-addon 0.7.5

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,038
catalyst-agentscatalyst-agents0.1.302 of 18See more

catalyst-agents catalyst-agents 0.1.30

2 of the 18 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.32.3eec354133193
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/chaos-mesh/chaos-mesh:v2.8.3bdb31f3121a2
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

15,027
capsule-rancher-addonclastixVerified publisher0.1.11 of 5See more

capsule-rancher-addon clastix 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

7,104
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

25,151

Container images carrying it

216 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/kgma74/dockyard:0.4.0b40439329191
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
oras.land/oras-go@v1.2.0
no fix listed
1
ghcr.io/krateoplatformops/installer/installer:0.6.3a7e922ddac55
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/kubenetworks/kubevpn:v2.11.7cce8ff866f60
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/kubetail-org/kubetail-dashboard:0.17.08617f0a7f703
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
oras.land/oras-go/v2@v2.3.1
2.6.1
1
ghcr.io/loft-sh/agent:3.2.45c109914ff73
oras.land/oras-go@v1.2.2
no fix listed
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
oras.land/oras-go@v1.2.2
no fix listed
1
ghcr.io/loft-sh/vcluster:0.16.484f70425f4dd
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
oras.land/oras-go@v1.2.4
no fix listed
1
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
oras.land/oras-go@v1.2.5
no fix listed
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
oras.land/oras-go/v2@v2.5.0
2.6.1
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
oras.land/oras-go/v2@v2.6.0
2.6.1
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
oras.land/oras-go@v1.2.5
no fix listed
1
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
oras.land/oras-go@v1.2.5
no fix listed
1
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
oras.land/oras-go@v1.2.4
no fix listed
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
oras.land/oras-go@v1.1.0
no fix listed
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go@v1.2.2
oras.land/oras-go/v2@v2.2.0
no fix listed
2.6.1
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.1
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
oras.land/oras-go@v1.1.1
no fix listed
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
oras.land/oras-go@v1.1.1
no fix listed
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
oras.land/oras-go@v1.2.2
no fix listed
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
oras.land/oras-go/v2@v2.0.0
2.6.1
1
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
oras.land/oras-go@v0.4.0
no fix listed
1
quay.io/gogatekeeper/gatekeeper:4.9.0dcf583aba224
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
oras.land/oras-go@v1.1.1
no fix listed
1
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
oras.land/oras-go@v1.2.3
no fix listed
1
quay.io/jetstack/cert-manager-ctl:v1.8.0595c548dee6f
oras.land/oras-go@v1.1.0
no fix listed
1
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
oras.land/oras-go@v1.1.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.