oras-project vulnerabilities
7 published CVEs name oras-project among the affected products.
- 7Published CVEs7 of them scored
- 7Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-85731
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
oras-project · oras-go
High8.8 - CVE-2026-85732
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
oras-project · oras-go
Medium4.7 - CVE-2026-55588
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
oras-project · oras
Medium6.5 - CVE-2026-50151
oras-go: credential forwarding via unvalidated Location header in blob upload
oras-project · oras-go
High7.5 - CVE-2026-50162
oras-go: file store write outside workingDir via symlink traversal
oras-project · oras-go
Medium6.9 - CVE-2026-50163
oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction
oras-project · oras-go
High7.1 - CVE-2026-48978
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
oras-project · oras-go
Low2.1