StackRadar

CVE-2026-48978

Low

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
216
of 17,787 indexed, latest versions
Container images
217
deployed by those charts
Fix available
1 of 2
affected packages

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Carried by container images the latest versions of 216 of 17,787 indexed charts deploy, on 217 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-gogolangv0.4.0, v1.1.0, v1.1.1, v1.2.0+6 moreno fix listed128
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1103
OSV records
GHSA-xf85-363p-868w
Also known as
GO-2026-5885

Charts affected

216 by stars
ChartLatestAffected imagesRadar Score
chartmuseumkubegems3.8.01 of 1See more

chartmuseum kubegems 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.14.0878ef6a31fa0
oras.land/oras-go@v1.1.0
no fix listed

Open the chart page →

3,518
kubegems-edgekubegems1.24.101 of 1See more

kubegems-edge kubegems 1.24.10

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
kubegems/kubegems:v1.24.10a730bcf9322a
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

3,381
brudi-operatorkubernetes-replicator0.2.31 of 1See more

brudi-operator kubernetes-replicator 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/mittwald/brudi-operator:v0.2.3edb322094359
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

3,622
harbor-operatorkubernetes-replicator1.6.31 of 1See more

harbor-operator kubernetes-replicator 1.6.3

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/mittwald/harbor-operator:v1.6.365a38180e27a
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

1,196
harborkubesphereVerified publisher1.9.34 of 11See more

harbor kubesphere 1.9.3

4 of the 11 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
oras.land/oras-go@v1.1.0
no fix listed
goharbor/harbor-core:v2.5.386bf3031f4a7
oras.land/oras-go@v0.4.0
no fix listed
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
oras.land/oras-go@v0.4.0
no fix listed
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

17,798
chaos-meshkubesphere-stable2.5.11 of 3See more

chaos-mesh kubesphere-stable 2.5.1

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

8,555
kubestellar-consolekubestellar-consoleVerified publisher0.3.411 of 2See more

kubestellar-console kubestellar-console 0.3.41

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.32.47e1e7d5b7a96
oras.land/oras-go@v1.2.6
no fix listed

Open the chart page →

4,440
kubestellar-uikubestellaruiVerified publisher0.1.11 of 4See more

kubestellar-ui kubestellarui 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
mavrick1/kubestellar-b:latest45ca0429a1d4
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

4,763
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

20,299
kusionkusionstackVerified publisher0.14.11 of 3See more

kusion kusionstack 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

6,879
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
oras.land/oras-go@v1.1.1
no fix listed

Open the chart page →

4,271
linkerd-preview-vizlinkerd-buoyantVerified publisher25.4.33 of 5See more

linkerd-preview-viz linkerd-buoyant 25.4.3

3 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/buoyantio/metrics-api:preview-25.4.32cef2a3f97da
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/buoyantio/tap:preview-25.4.3e02a8bd9e2c3
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/buoyantio/web:preview-25.4.33ee1b62aa111
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

3,420
devpod-proloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

3,225
loft-agentloftVerified publisher3.2.41 of 1See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/agent:3.2.45c109914ff73
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

2,444
vcluster-control-planeloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

3,225
vcluster-headloftVerified publisher0.0.0-035ec6e1 of 2See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,269
vcluster-proloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

5,085
vcluster-pro-eksloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-eks loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

5,936
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.102 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
oras.land/oras-go@v1.2.0
no fix listed
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

5,770
vcluster-pro-k8sloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed

Open the chart page →

8,206
apica-ascentlogiqai2.0.41 of 19See more

apica-ascent logiqai 2.0.4

1 of the 19 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
logiqai/flash:v3.10.265b996bc7bdc
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

23,255
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed

Open the chart page →

9,786
cert-manager-setupmesosphere-stable0.2.101 of 5See more

cert-manager-setup mesosphere-stable 0.2.10

1 of the 5 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

7,179
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,334
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,821
agent-control-cdnewrelic1.0.02 of 3See more

agent-control-cd newrelic 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
oras.land/oras-go@v1.2.5
no fix listed
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

5,036
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

17,085
argocd-agent-addonocm-helm-chartsVerified publisher0.29.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.29.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

626
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

535
opa-nginxopa-nginx0.0.31 of 2See more

opa-nginx opa-nginx 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
openpolicyagent/opa:0.53.16a58dea59933
oras.land/oras-go/v2@v2.2.0
2.6.1

Open the chart page →

2,167
fsmopenshift0.1.8-ubi.61 of 6See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
oras.land/oras-go@v0.4.0
no fix listed

Open the chart page →

16,554
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

2,543
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.6.0
no fix listed
2.6.1

Open the chart page →

4,145
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
oras.land/oras-go@v1.1.1
oras.land/oras-go/v2@v2.3.0
no fix listed
2.6.1

Open the chart page →

8,634
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,821
opslevelopslevelVerified publisher2025.1.221 of 10See more

opslevel opslevel 2025.1.22

1 of the 10 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
replicated/replicated-sdk:1.0.0-beta.318751b4963250
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

5,609
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.15.29242b4df9e65
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

26,840
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
oras.land/oras-go@v1.2.4
no fix listed
quay.io/argoproj/argocd:v2.14.115fc69e31c755
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1

Open the chart page →

25,626
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

11,153
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,752
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,271
headlampradar-baseVerified publisher1.0.01 of 1See more

headlamp radar-base 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.43.05d03caa26df7
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

614
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,855
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

4,039
gitlab-operatorrock8sVerified publisher0.7.01 of 2See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
oras.land/oras-go@v0.4.0
no fix listed

Open the chart page →

5,422
mailserverrock8sVerified publisher0.1.21 of 1See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
oras.land/oras-go@v1.2.4
no fix listed

Open the chart page →

1,946
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
oras.land/oras-go@v1.2.5
no fix listed

Open the chart page →

9,152
argocd-certificate-refreshromholdings0.10.81 of 1See more

argocd-certificate-refresh romholdings 0.10.8

1 of the 1 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
oras.land/oras-go@v1.2.0
no fix listed

Open the chart page →

12,999
devtron-enterpriseromholdings48.0.06 of 28See more

devtron-enterprise romholdings 48.0.0

6 of the 28 container images this version deploys carry CVE-2026-48978.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed
quay.io/devtron/kubectl:latest2ad610626658
oras.land/oras-go@v1.2.0
no fix listed
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

66,542

Container images carrying it

217 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1
7
quay.io/devtron/kubectl:latest2ad610626658
oras.land/oras-go@v1.2.0
no fix listed
6
keelhq/keel:latest73714afb4443
oras.land/oras-go@v1.2.5
no fix listed
5
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
oras.land/oras-go@v1.2.2
no fix listed
4
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
oras.land/oras-go@v1.2.3
no fix listed
4
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.1
3
kubegems/kubegems:v1.24.10a730bcf9322a
oras.land/oras-go@v1.1.1
no fix listed
3
quay.io/devtron/ai-agent:0.0.16545dac92173
oras.land/oras-go@v1.2.5
no fix listed
3
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
oras.land/oras-go@v1.2.0
no fix listed
3
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
oras.land/oras-go/v2@v2.6.0
2.6.1
3
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
oras.land/oras-go/v2@v2.6.0
2.6.1
3
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
oras.land/oras-go/v2@v2.6.0
2.6.1
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
oras.land/oras-go/v2@v2.6.0
2.6.1
3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
oras.land/oras-go@v1.2.4-0.20230801060855-932dd06d38af
no fix listed
3
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
oras.land/oras-go/v2@v2.6.0
2.6.1
3
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
oras.land/oras-go/v2@v2.6.0
2.6.1
3
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
oras.land/oras-go/v2@v2.6.0
2.6.1
3
alpine/k8s:1.32.12048f8d9c8cc7
oras.land/oras-go/v2@v2.6.0
2.6.1
2
dtzar/helm-kubectl:3.14.455429449408e
oras.land/oras-go@v1.2.4
no fix listed
2
ilum/api:6.7.3624fd09528c8
oras.land/oras-go@v1.2.5
no fix listed
2
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
oras.land/oras-go@v1.2.0
no fix listed
2
meshery/meshery:stable-latest44b64ee128fb
oras.land/oras-go/v2@v2.6.0
2.6.1
2
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.1
2
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
oras.land/oras-go/v2@v2.6.0
2.6.1
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
oras.land/oras-go/v2@v2.5.0
2.6.1
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
2
quay.io/jetstack/cert-manager-ctl:v1.11.074611761f052
oras.land/oras-go@v1.2.0
no fix listed
2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.1
2
alpine/helm105741fa6621
oras.land/oras-go@v1.2.5
no fix listed
1
alpine/helm:4.1.0905a068da431
oras.land/oras-go/v2@v2.6.0
2.6.1
1
alpine/k8s:1.22.600ac10bcb759
oras.land/oras-go@v0.4.0
no fix listed
1
alpine/k8s:1.27.321b24e6bf801
oras.land/oras-go@v1.2.2
no fix listed
1
alpine/k8s:1.36.244ef4942e171
oras.land/oras-go/v2@v2.6.0
2.6.1
1
alpine/k8s:1.31.106dbe6f391eda
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.5.0
no fix listed
2.6.1
1
alpine/k8s:1.31.137a319b15cfc9
oras.land/oras-go@v1.2.6
oras.land/oras-go/v2@v2.6.0
no fix listed
2.6.1
1
alpine/k8s:1.32.47e1e7d5b7a96
oras.land/oras-go@v1.2.6
no fix listed
1
alpine/k8s:1.31.49c4976d47656
oras.land/oras-go@v1.2.5
no fix listed
1
alpine/k8s:1.35.6b7a12c5ddf26
oras.land/oras-go/v2@v2.6.0
2.6.1
1
alpine/k8s:1.30.0bd01dae02676
oras.land/oras-go@v1.2.4
no fix listed
1
alpine/k8s:1.30.2cd560fce90f7
oras.land/oras-go@v1.2.4
no fix listed
1
alpine/k8s:1.35.5d870622d0040
oras.land/oras-go/v2@v2.6.0
2.6.1
1
alpine/k8s:1.28.13e5c0b053fed7
oras.land/oras-go@v1.2.2
no fix listed
1
alpine/k8s:1.32.3eec354133193
oras.land/oras-go@v1.2.5
no fix listed
1
alpine/k8s:1.28.2fc059f056ad0
oras.land/oras-go@v1.2.3
no fix listed
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
oras.land/oras-go@v1.2.5
oras.land/oras-go/v2@v2.6.0
no fix listed
2.6.1
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
oras.land/oras-go@v1.2.5
no fix listed
1
aquasec/trivy:0.43.1944a04445179
oras.land/oras-go@v1.2.3
no fix listed
1
aquasec/trivy:0.32.0973d0df16189
oras.land/oras-go@v1.1.1
no fix listed
1
aquasec/trivy:0.69.3bcc376de8d77
oras.land/oras-go/v2@v2.6.0
2.6.1
1
artifacthub/hub:v1.19.0111918d8c399
oras.land/oras-go@v1.2.5
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.