zarf-dev vulnerabilities
2 published CVEs name zarf-dev among the affected products.
- 2Published CVEs2 of them scored
- 2Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-40090
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
zarf-dev · zarf
High7.1 - CVE-2026-29064
Zarf: Symlink targets in archives are not validated against destination directory
zarf-dev · zarf
High8.2