chainguard-dev apko

• CVE-2026-105768 Medium 6.3 apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root 0.3%
• CVE-2026-54174 High 8.3 melange: Incomplete package integrity verification allows data section substitution 0.2%
• CVE-2026-42576 Medium 6.5 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery 0.3%
• CVE-2026-42575 High 7.5 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) 0.2%
• CVE-2026-42574 High 7.5 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root 0.4%
• CVE-2026-25140 High 7.5 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams 0.4%
• CVE-2026-25121 High 7.5 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base 0.4%
• CVE-2026-25122 Medium 5.5 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams 0.1%
• CVE-2025-53945 High 7.0 apko has incorrect permission (0666) in /etc/ld.so.cache and other files 0.1%
• CVE-2024-36127 High 7.5 apko Exposure of HTTP basic auth credentials in log output 0.4%