chainguard-dev melange

• CVE-2026-54174 High 8.3 melange: Incomplete package integrity verification allows data section substitution 0.2%
• CVE-2026-29051 Medium 4.4 melange has Path Traversal via .PKGINFO in --persist-lint-results 0.2%
• CVE-2026-29050 Medium 6.1 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses 0.1%
• CVE-2026-29049 Medium 4.3 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI 0.3%
• CVE-2026-25145 Medium 5.5 melange has a path traversal in license-path which allows reading files outside workspace 0.2%
• CVE-2026-25143 High 7.8 melange affected by potential host command execution via license-check YAML mode patch pipeline 0.2%
• CVE-2026-24844 High 7.8 melange pipeline working-directory could allow command injection 0.2%
• CVE-2026-24843 High 8.2 melange QEMU runner could write files outside workspace directory 0.2%
• CVE-2025-54059 Medium 4.4 melange creates SBOM files in APKs with world-writable permissions 0.2%