Cchainguard-dev

Products

Exploited and recent CVEs

• CVE-2026-105768 Medium 6.3 apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root 0.3%
• CVE-2026-54174 High 8.3 melange: Incomplete package integrity verification allows data section substitution 0.2%
• CVE-2026-54174 High 8.3 melange: Incomplete package integrity verification allows data section substitution 0.2%
• CVE-2026-42576 Medium 6.5 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery 0.3%
• CVE-2026-42575 High 7.5 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) 0.2%
• CVE-2026-42574 High 7.5 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root 0.4%
• CVE-2026-29051 Medium 4.4 melange has Path Traversal via .PKGINFO in --persist-lint-results 0.2%
• CVE-2026-29050 Medium 6.1 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses 0.1%
• CVE-2026-29049 Medium 4.3 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI 0.3%
• CVE-2026-28407 Medium 6.9 malcontent's nested archive extraction failure can drop content from scan inputs 0.4%
• CVE-2026-25145 Medium 5.5 melange has a path traversal in license-path which allows reading files outside workspace 0.2%
• CVE-2026-25143 High 7.8 melange affected by potential host command execution via license-check YAML mode patch pipeline 0.2%
• CVE-2026-24844 High 7.8 melange pipeline working-directory could allow command injection 0.2%
• CVE-2026-24843 High 8.2 melange QEMU runner could write files outside workspace directory 0.2%
• CVE-2026-25140 High 7.5 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams 0.4%
• CVE-2026-25121 High 7.5 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base 0.4%
• CVE-2026-25122 Medium 5.5 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams 0.1%
• CVE-2026-24846 Medium 5.5 malcontent's archive extraction could write outside extraction directory 0.2%
• CVE-2026-24845 Medium 6.5 malcontent's OCI image scanning could expose registry credentials 0.4%
• CVE-2025-54059 Medium 4.4 melange creates SBOM files in APKs with world-writable permissions 0.2%
• CVE-2025-53945 High 7.0 apko has incorrect permission (0666) in /etc/ld.so.cache and other files 0.1%
• CVE-2024-36127 High 7.5 apko Exposure of HTTP basic auth credentials in log output 0.4%