Skip to content
OpenAdvisories

Package · Wolfi

ratify-licensechecker-compat

26 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-48978

    oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

    oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to int…

    oras-project oras-go kubescape kots Debian Ubuntu Wolfi Go
  • Low 3.7
    CVE-2026-24122

    Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

    Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp…

    sigstore cosign zot skaffold Debian Ubuntu Wolfi Go