StackRadar

CVE-2026-85731

High

Advisory

Published 17 Sept 2026In the index since 18 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
128
of 17,803 indexed, latest versions
Container images
120
deployed by those charts
Fix available
1 of 1
affected package

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

Carried by container images the latest versions of 128 of 17,803 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+5 more2.6.2120
OSV records
GHSA-m37j-52j7-pjw7

Charts affected

128 by stars
ChartLatestAffected imagesRadar Score
argo-cdargoOfficialVerified publisher10.9.21 of 3See more

argo-cd argo 10.9.2

1 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

3,032
harborharborOfficialVerified publisher1.19.21 of 8See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,738
rancherrancher-stable2.15.11 of 2See more

rancher rancher-stable 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
rancher/shell:v0.8.1f293af9c635f
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

1,528
artifact-hubartifact-hubVerified publisher1.23.04 of 7See more

artifact-hub artifact-hub 1.23.0

4 of the 7 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
oras.land/oras-go/v2@v2.6.0
2.6.2
artifacthub/hub:v1.23.07d3a91c539dc
oras.land/oras-go/v2@v2.6.1
2.6.2
artifacthub/scanner:v1.23.02d8365601f0e
oras.land/oras-go/v2@v2.6.1
2.6.2
artifacthub/tracker:v1.23.05368d21a6e5c
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

11,020
argo-cdargo-cd-oci10.9.21 of 3See more

argo-cd argo-cd-oci 10.9.2

1 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

3,032
falcofalcosecurity9.1.02 of 3See more

falco falcosecurity 9.1.0

2 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.44.17df783d5269a
oras.land/oras-go/v2@v2.6.0
2.6.2
falcosecurity/falcoctl:0.13.00eeb79adc580
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

5,523
flux2fluxcd-community2.19.02 of 7See more

flux2 fluxcd-community 2.19.0

2 of the 7 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/helm-controller:v1.6.2e17ab0e5885d
oras.land/oras-go/v2@v2.6.1
2.6.2
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

3,059
chaos-meshchaos-meshVerified publisher2.8.41 of 4See more

chaos-mesh chaos-mesh 2.8.4

1 of the 4 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.8.49e48285bb44c
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

6,674
atlantisatlantis6.15.11 of 1See more

atlantis atlantis 6.15.1

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,934
mesherymesheryOfficialVerified publisher1.0.701 of 1See more

meshery meshery 1.0.70

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest44b64ee128fb
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,495
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

2,416
rancherrancher-latest2.15.11 of 2See more

rancher rancher-latest 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
rancher/shell:v0.8.1f293af9c635f
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

1,528
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

9,942
oktetooktetoOfficialVerified publisher0.0.0-2026-08-171 of 10See more

okteto okteto 0.0.0-2026-08-17

1 of the 10 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/okteto/okteto:3.22.04585017f52f6
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

5,585
node-feature-discoverynode-feature-discoveryOfficialVerified publisher0.19.01 of 1See more

node-feature-discovery node-feature-discovery 0.19.0

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
registry.k8s.io/nfd/node-feature-discovery:v0.19.02fa1c99ad09b
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

245
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

5,483
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,428
openclawopenclawVerified publisher1.91.61 of 2See more

openclaw openclaw 1.91.6

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.6fff58c4ec600
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

3,066
devtron-operatordevtron0.23.33 of 11See more

devtron-operator devtron 0.23.3

3 of the 11 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

33,352
meshery-operatormesheryOfficialVerified publisher1.0.701 of 2See more

meshery-operator meshery 1.0.70

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

2,461
loadtesterflagger0.39.01 of 1See more

loadtester flagger 0.39.0

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/flagger-loadtester:0.39.06a8546993cb5
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

1,791
alloy-operatorgrafana0.7.11 of 1See more

alloy-operator grafana 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.12.14ee4b71cf16a
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

475
gateway-operatorkongOfficialVerified publisher0.6.11 of 1See more

gateway-operator kong 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
kong/gateway-operator:1.603510967482b
oras.land/oras-go/v2@v2.5.1-0.20250331092043-d0ac8e455584
2.6.2

Open the chart page →

881
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

4,134
steampipe-powerpipe-kubernetessteampipe-powerpipe-kubernetesVerified publisher0.13.12 of 2See more

steampipe-powerpipe-kubernetes steampipe-powerpipe-kubernetes 0.13.1

2 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
oras.land/oras-go/v2@v2.5.0
2.6.2
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

5,638
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

3,485
kubevpnkubevpn-charts2.11.91 of 1See more

kubevpn kubevpn-charts 2.11.9

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/kubenetworks/kubevpn:v2.11.93feb9da85270
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

1,683
vcluster-platformloftVerified publisher4.12.01 of 1See more

vcluster-platform loft 4.12.0

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

794
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
oras.land/oras-go/v2@v2.2.0
2.6.2

Open the chart page →

3,828
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

108,589
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

2,903
topaztopaz0.2.51 of 1See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

1,674
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go/v2@v2.2.0
2.6.2

Open the chart page →

10,418
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

4,293
argo-cdwenerme10.9.21 of 3See more

argo-cd wenerme 10.9.2

1 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

3,032
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

15,002
scannerappscodeVerified publisher2026.1.151 of 3See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
oras.land/oras-go/v2@v2.0.2
2.6.2

Open the chart page →

5,340
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

985
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

1,658
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

1,658
finops-stackcert-managerVerified publisher0.0.56 of 12See more

finops-stack cert-manager 0.0.5

6 of the 12 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
oras.land/oras-go/v2@v2.3.1
2.6.2
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
oras.land/oras-go/v2@v2.3.1
2.6.2
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
oras.land/oras-go/v2@v2.3.1
2.6.2
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
oras.land/oras-go/v2@v2.3.1
2.6.2
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
oras.land/oras-go/v2@v2.3.1
2.6.2
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
oras.land/oras-go/v2@v2.3.1
2.6.2

Open the chart page →

12,804
cloudttycloudtty0.8.101 of 2See more

cloudtty cloudtty 0.8.10

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.1023e8d178e02c
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

3,026
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

10,463
developer-operatordeveloper-operatorVerified publisher2.1.21 of 1See more

developer-operator developer-operator 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,909
falco-operatorfalcosecurity0.3.11 of 1See more

falco-operator falcosecurity 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
falcosecurity/falco-operator:0.4.18a99fcc57a57
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

386
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

5,591
kdiff-snapshotskdiff-snapshotsVerified publisher0.0.551 of 1See more

kdiff-snapshots kdiff-snapshots 0.0.55

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

5,871
kube-arguskube-argusOfficialVerified publisher0.0.1-s2z1 of 1See more

kube-argus kube-argus 0.0.1-s2z

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/manishchaudhary101/kube-argus:latest8e3869d31c70
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

381
kubescoutkubescouteVerified publisher0.1.11 of 1See more

kubescout kubescoute 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

747
mesherykubesphere-stable0.5.01 of 13See more

meshery kubesphere-stable 0.5.0

1 of the 13 container images this version deploys carry CVE-2026-85731.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

24,958

Container images carrying it

120 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/zapier/kubechecks:latest60cea46ce830
oras.land/oras-go/v2@v2.6.1
2.6.2
1
quay.io/argoproj/argocd:v3.5.10deb1a1c9176
oras.land/oras-go/v2@v2.6.1
2.6.2
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go/v2@v2.5.0
2.6.2
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go/v2@v2.2.0
2.6.2
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.2
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
oras.land/oras-go/v2@v2.0.0
2.6.2
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go/v2@v2.5.0
2.6.2
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
oras.land/oras-go/v2@v2.2.0
2.6.2
1
quay.io/manusa/kubernetes_mcp_server:v0.0.47150f76e844d9
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
oras.land/oras-go/v2@v2.3.0
2.6.2
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
oras.land/oras-go/v2@v2.6.0
2.6.2
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
oras.land/oras-go/v2@v2.6.0
2.6.2
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.6fff58c4ec600
oras.land/oras-go/v2@v2.6.0
2.6.2
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.