Vendor

    Oras-project

    7 known vulnerabilities in products by Oras-project, 0 of them actively exploited (CISA KEV).

    Key figures

    7

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Oras-project
    HighCVE-2026-85731

    Oras-project Oras-go: Path Traversal

    also in 1 other product

    		8.8
    MediumCVE-2026-55588

    ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

    also in 1 other product

    		6.5
    MediumCVE-2026-50162

    oras-go: file store write outside workingDir via symlink traversal

    also in 1 other product

    		—
    HighCVE-2026-50151

    oras-go: credential forwarding via unvalidated Location header in blob upload

    also in 2 other products

    		7.5
    HighCVE-2026-50163

    Oras-project Oras-go: Path Traversal

    also in 1 other product

    		7.1
    MediumCVE-2026-85732

    oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

    also in 1 other product

    		4.7
    LowCVE-2026-48978

    Oras-project Oras-go: Cleartext Transmission of Sensitive Information

    also in 1 other product

    		—

    Products

    Products by Oras-project
    Oras-go60