oras-project oras-go

• CVE-2026-85731 High 8.8 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) 0.7%
• CVE-2026-85732 Medium 4.7 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing 0.4%
• CVE-2026-50151 High 7.5 oras-go: credential forwarding via unvalidated Location header in blob upload 0.4%
• CVE-2026-50162 Medium 6.9 oras-go: file store write outside workingDir via symlink traversal 0.4%
• CVE-2026-50163 High 7.1 oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction 0.4%
• CVE-2026-48978 Low 2.1 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens 0.2%