github.com/crossplane/crossplane-runtime/v2 vulnerabilities
CVEs whose affected-version data names the github.com/crossplane/crossplane-runtime/v2 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
GO-2026-6302NoneSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
▾ Sunlitcrossplane · github.com/crossplane/crossplane-runtime/v2via OSV
GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
▾ Twilightcrossplane · github.com/crossplane/crossplane-runtime/v2via OSV