oras.land/oras vulnerabilities

CVEs whose affected-version data names the oras.land/oras package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-55588Medium· 6.5⚖ disputed

4w ago

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registr…

▾ Sunlitoras · oras.land/orasEPSS 0.30%via NVD