Chainguard records

14 published records for vendor chainguard.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-24844No exploit	melange pipeline working-directory could allow command injectionchainguard · melange · CWE-78 RCE Command injection	High8.8	—	0.1%	Feb 4, 2026
33Monitor	CVE-2026-24843No exploit	melange QEMU runner could write files outside workspace directorychainguard · melange · CWE-22 Path traversal	High8.4	—	0.1%	Feb 4, 2026
32Monitor	CVE-2026-28406No exploit	kaniko has tar archive path traversal in build context extraction allows writing files outside destination directorychainguard · kaniko · CWE-22 Pre-auth Path traversal	High8.2	—	0.6%	Feb 27, 2026
31Monitor	CVE-2026-25143No exploit	melange affected by potential host command execution via license-check YAML mode patch pipelinechainguard · melange · CWE-78 RCE Command injection	High7.8	—	0.1%	Feb 4, 2026
30Monitor	CVE-2026-25121No exploit	apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside basechainguard · apko · CWE-23 Pre-auth Path traversal	High7.5	—	0.4%	Feb 4, 2026
30Monitor	CVE-2026-25140No exploit	apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streamschainguard · apko · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Feb 4, 2026
27Monitor	CVE-2026-28407No exploit	malcontent's nested archive extraction failure can drop content from scan inputschainguard · malcontent · CWE-703 Pre-auth	Medium6.9	—	0.4%	Feb 27, 2026
26Monitor	CVE-2026-24845No exploit	malcontent's OCI image scanning could expose registry credentialschainguard · malcontent · CWE-522 Pre-auth Info leak	Medium6.5	—	0.3%	Jan 29, 2026
24Monitor	CVE-2026-29050No exploit	melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].useschainguard · melange · CWE-22 Path traversal	Medium6.1	—	0.1%	Apr 24, 2026
22Monitor	CVE-2026-25145No exploit	melange has a path traversal in license-path which allows reading files outside workspacechainguard · melange · CWE-22 Path traversal	Medium5.5	—	0.1%	Feb 4, 2026
22Monitor	CVE-2026-25122No exploit	apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streamschainguard · apko · CWE-400 Denial of service	Medium5.5	—	0.1%	Feb 4, 2026
20Monitor	CVE-2026-24846No exploit	malcontent's archive extraction could write outside extraction directorychainguard · malcontent · CWE-22 Path traversal	Medium5.0	—	0.1%	Jan 29, 2026
17Monitor	CVE-2026-29049No exploit	melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CIchainguard · melange · CWE-400 Pre-auth Denial of service	Medium4.3	—	0.2%	Mar 6, 2026
13Monitor	CVE-2026-29051No exploit	melange has Path Traversal via .PKGINFO in --persist-lint-resultschainguard · melange · CWE-22 Path traversal	Low3.3	—	0.1%	Apr 24, 2026

CVE-2026-24844
35Monitor
melange pipeline working-directory could allow command injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
chainguard · melangeFeb 4, 2026
CVE-2026-24843
33Monitor
melange QEMU runner could write files outside workspace directory
HighCVSS 8.4No exploitEPSS 0%
- Path traversal
chainguard · melangeFeb 4, 2026
CVE-2026-28406
32Monitor
kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
chainguard · kanikoFeb 27, 2026
CVE-2026-25143
31Monitor
melange affected by potential host command execution via license-check YAML mode patch pipeline
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
chainguard · melangeFeb 4, 2026
CVE-2026-25121
30Monitor
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
chainguard · apkoFeb 4, 2026
CVE-2026-25140
30Monitor
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
chainguard · apkoFeb 4, 2026
CVE-2026-28407
27Monitor
malcontent's nested archive extraction failure can drop content from scan inputs
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
chainguard · malcontentFeb 27, 2026
CVE-2026-24845
26Monitor
malcontent's OCI image scanning could expose registry credentials
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Info leak
chainguard · malcontentJan 29, 2026
CVE-2026-29050
24Monitor
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
MediumCVSS 6.1No exploitEPSS 0%
- Path traversal
chainguard · melangeApr 24, 2026
CVE-2026-25145
22Monitor
melange has a path traversal in license-path which allows reading files outside workspace
MediumCVSS 5.5No exploitEPSS 0%
- Path traversal
chainguard · melangeFeb 4, 2026
CVE-2026-25122
22Monitor
apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
MediumCVSS 5.5No exploitEPSS 0%
- Denial of service
chainguard · apkoFeb 4, 2026
CVE-2026-24846
20Monitor
malcontent's archive extraction could write outside extraction directory
MediumCVSS 5.0No exploitEPSS 0%
- Path traversal
chainguard · malcontentJan 29, 2026
CVE-2026-29049
17Monitor
melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- Denial of service
chainguard · melangeMar 6, 2026
CVE-2026-29051
13Monitor
melange has Path Traversal via .PKGINFO in --persist-lint-results
LowCVSS 3.3No exploitEPSS 0%
- Path traversal
chainguard · melangeApr 24, 2026