clair

Analyze container images for known vulnerabilities

quay/clair · Container Security › Image Scanning · scanned v4.9.0 (released 2025-12-10) · commit f6a412ccbfc4 · last scan 2026-11-02

128
declared dependencies
14 / 34
critical / high advisories
67
advisories with a fixed version
82
advisories with vulnerable code in the go1.24.10 binary
5
OpenSSF Scorecard (of 10); OpenSSF public dataset
no checksums or signatures
release verification

Changes since last week

no change.

Known vulnerabilities (74)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

SeverityAdvisoryPackageVersionFixed inOSVReleased binaryKEVEPSSDeclared inDispute
CriticalGHSA-9jj7-4m8r-rfcm source
CVE-2026-33816
github.com/jackc/pgx/v5
golang
v5.7.65.9.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGHSA-xgrm-4fwx-7qm8 source
CVE-2026-33815
github.com/jackc/pgx/v5
golang
v5.7.65.9.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGHSA-33mj-cw25-m34h source
CVE-2026-77405
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.3%go.modDispute
CriticalGHSA-c5pq-fr2g-9jpf source
CVE-2026-77411
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
CriticalGHSA-j497-x9hr-x34x source
CVE-2026-77408
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
CriticalGHSA-5cgq-3rg8-m6cv source
CVE-2026-42508
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno6.9%go.modDispute
CriticalGHSA-89gr-r52h-f8rx source
CVE-2026-39831
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
CriticalGHSA-f5wc-c3c7-36mc source
CVE-2026-39832
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.7%go.modDispute
CriticalGHSA-jppx-rxg9-jmrx source
CVE-2026-39833
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
CriticalGHSA-rm3j-f69w-wqmq source
CVE-2026-39834
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGHSA-vgwf-h737-ff37 source
CVE-2026-39830
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.7%go.modDispute
CriticalGHSA-x527-x647-q7gg source
CVE-2026-46595
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGO-2026-6612 source
CVE-2026-78663
golang.org/x/net
golang
v0.47.00.60.0✓vulnerable code in binaryno0.6%go.modDispute
CriticalGHSA-p77j-4mvh-x3m3 source
CVE-2026-33186
google.golang.org/grpc
golang
v1.77.01.79.3✓not in released binaryno1.6%go.modDispute
HighGHSA-p436-gjf2-799p source
CVE-2025-15558
github.com/docker/cli
golang
v29.0.3+incompatible29.2.0✓vulnerable code in binaryno0.5%go.modDispute
HighGHSA-78h2-9frx-2jm8 source
CVE-2026-34986
github.com/go-jose/go-jose/v3
golang
v3.0.43.0.5✓vulnerable code in binaryno0.7%go.modDispute
HighGHSA-mgcc-cww5-fp2q source
CVE-2026-116587
github.com/go-jose/go-jose/v3
golang
v3.0.4no fix listed✓vulnerable code not in binaryno0.4%go.modDispute
HighGHSA-jqcq-xjh3-6g23 source
CVE-2026-32286
github.com/jackc/pgproto3/v2
golang
v2.3.3no fix listed✓not in released binaryno0.7%go.modDispute
HighGHSA-259r-337f-4rfw source
CVE-2026-63209
github.com/klauspost/compress
golang
v1.18.21.18.7✓vulnerable code in binaryno0.6%go.modDispute
HighGHSA-27gv-rfvv-22mv source
CVE-2026-77407
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.1%go.modDispute
HighGHSA-465g-fh3v-9jw4 source
CVE-2026-77404
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.1%go.modDispute
HighGHSA-4v58-74mf-rjx3 source
CVE-2026-77412
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
HighGHSA-6c5v-hqjr-5xxp source
CVE-2026-79921
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
HighGHSA-r9c8-gcjp-xfwh source
CVE-2026-77410
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
HighGHSA-rm6m-hrcw-jw33 source
CVE-2026-77406
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
HighGHSA-xwwf-m8fg-p9q2 source
CVE-2026-77403
github.com/rabbitmq/amqp091-go
golang
v1.10.01.13.0✓not in released binaryno0.5%go.modDispute
HighGHSA-mh2q-q3fh-2475 source
CVE-2026-29181
go.opentelemetry.io/otel
golang
v1.39.01.41.0✓vulnerable code in binaryno0.8%go.modDispute
HighGHSA-9h8m-3fm2-qjrq source
CVE-2026-24051
go.opentelemetry.io/otel/sdk
golang
v1.39.01.40.0✓not in released binaryno0.2%go.modDispute
HighGHSA-hfvc-g4fc-pqhx source
CVE-2026-39883
go.opentelemetry.io/otel/sdk
golang
v1.39.01.43.0✓not in released binaryno0.3%go.modDispute
HighGHSA-q4h4-gmj2-qvw2 source
CVE-2026-46597
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
HighGHSA-w879-237q-wc7r source
CVE-2026-39829
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2026-6303 source
CVE-2026-56854
golang.org/x/crypto
golang
v0.45.00.55.0✓vulnerable code in binaryno0.4%go.modDispute
HighGO-2026-6354 source
CVE-2026-78662
golang.org/x/crypto
golang
v0.45.00.56.0✓vulnerable code in binaryno0.4%go.modDispute
HighGO-2026-6355 source
CVE-2026-56855
golang.org/x/crypto
golang
v0.45.00.56.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2026-6179 source
CVE-2026-56865
golang.org/x/mod
golang
v0.30.00.40.0✓not in released binaryno0.1%go.modDispute
HighGO-2026-6180 source
CVE-2026-56864
golang.org/x/mod
golang
v0.30.00.40.0✓not in released binaryno0.3%go.modDispute
HighGO-2026-4918 source
CVE-2026-33814
golang.org/x/net
golang
v0.47.00.53.0✓vulnerable code in binaryno0.8%go.modDispute
HighGO-2026-5026 source
CVE-2026-39821
golang.org/x/net
golang
v0.47.00.55.0✓vulnerable code in binaryno1.8%go.modDispute
HighGO-2026-5942 source
CVE-2026-46600
golang.org/x/net
golang
v0.47.00.56.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2026-6603 source
CVE-2026-78659
golang.org/x/net
golang
v0.47.00.60.0✓vulnerable code in binaryno0.6%go.modDispute
HighGO-2026-6610 source
CVE-2026-78660
golang.org/x/net
golang
v0.47.00.60.0✓vulnerable code in binaryno0.4%go.modDispute
HighGO-2026-6611 source
CVE-2026-78669
golang.org/x/net
golang
v0.47.00.60.0✓vulnerable code in binaryno0.6%go.modDispute
HighGO-2026-6617 source
CVE-2026-97032
golang.org/x/net
golang
v0.47.00.60.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2026-5970 source
CVE-2026-56852
golang.org/x/text
golang
v0.31.00.39.0✓vulnerable code in binaryno0.5%go.modDispute
HighGO-2026-6629 source
CVE-2026-56851
golang.org/x/text
golang
v0.31.00.41.0✓vulnerable code in binaryno0.5%go.modDispute
HighGHSA-2v4p-qf9q-27wj source
CVE-2026-84445
google.golang.org/grpc
golang
v1.77.01.82.2✓not in released binaryno0.6%go.modDispute
HighGHSA-hrxh-6v49-42gf sourcegoogle.golang.org/grpc
golang
v1.77.01.82.1✓not in released binaryno—go.modDispute
HighGHSA-vp52-pcj8-j9qc source
CVE-2026-84304
google.golang.org/grpc
golang
v1.77.01.83.1✓not in released binaryno0.6%go.modDispute
MediumGHSA-685w-q87j-wqw3 source
CVE-2026-85747
github.com/docker/distribution
golang
v2.8.3+incompatibleno fix listed✓vulnerable code not in binaryno0.2%go.modDispute
MediumGHSA-4w3g-jfj2-cw2q source
CVE-2026-116585
github.com/go-jose/go-jose/v3
golang
v3.0.4no fix listed✓vulnerable code not in binaryno0.3%go.modDispute
MediumGHSA-vvm8-gf78-28g4 source
CVE-2026-116586
github.com/go-jose/go-jose/v3
golang
v3.0.4no fix listed✓vulnerable code not in binaryno0.3%go.modDispute
MediumGHSA-698x-9w2p-7vvp source
CVE-2026-10517
github.com/quay/claircore
golang
v1.5.48no fix listed✓module in binaryno—go.modDispute
MediumGHSA-w6r9-248c-frg8 source
CVE-2026-107386
github.com/rabbitmq/amqp091-go
golang
v1.10.01.14.0✓not in released binaryno0.5%go.modDispute
MediumGHSA-w8rr-5gcm-pp58 source
CVE-2026-39882
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
golang
v1.39.01.43.0✓not in released binaryno0.2%go.modDispute
MediumGHSA-w8rr-5gcm-pp58 source
CVE-2026-39882
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
golang
v1.39.01.43.0✓not in released binaryno0.2%go.modDispute
MediumGHSA-45gg-vh54-h5m9 source
CVE-2026-39828
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.4%go.modDispute
MediumGHSA-78mq-xcr3-xm33 source
CVE-2026-39835
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.5%go.modDispute
MediumGHSA-9m57-25v3-79x9 source
CVE-2026-46598
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.4%go.modDispute
MediumGHSA-qpw4-5x99-6vjp source
CVE-2026-39827
golang.org/x/crypto
golang
v0.45.00.52.0✓vulnerable code in binaryno0.3%go.modDispute
MediumGHSA-5cv4-jp36-h3mw source
CVE-2026-25680
golang.org/x/net
golang
v0.47.00.55.0✓vulnerable code in binaryno0.3%go.modDispute
MediumGO-2026-5025 source
CVE-2026-42506
golang.org/x/net
golang
v0.47.00.55.0✓vulnerable code in binaryno0.2%go.modDispute
MediumGO-2026-5027 source
CVE-2026-42502
golang.org/x/net
golang
v0.47.00.55.0✓vulnerable code in binaryno0.2%go.modDispute
MediumGO-2026-5029 source
CVE-2026-25681
golang.org/x/net
golang
v0.47.00.55.0✓vulnerable code in binaryno0.2%go.modDispute
MediumGO-2026-5030 source
CVE-2026-27136
golang.org/x/net
golang
v0.47.00.55.0✓vulnerable code in binaryno0.2%go.modDispute
MediumGHSA-qc2q-p7wx-3px3 source
CVE-2026-84303
google.golang.org/grpc
golang
v1.77.01.83.1✓not in released binaryno0.3%go.modDispute
LowGHSA-j88v-2chj-qfwx source
CVE-2026-41889
github.com/jackc/pgx/v5
golang
v5.7.65.9.2✓vulnerable code in binaryno0.4%go.modDispute
LowGHSA-8wmf-6v46-5gfg source
CVE-2026-81870
go.opentelemetry.io/otel/exporters/otlp/otlptrace
golang
v1.39.01.45.0✓not in released binaryno0.3%go.modDispute
LowGHSA-8wmf-6v46-5gfg source
CVE-2026-81870
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
golang
v1.39.01.45.0✓not in released binaryno0.3%go.modDispute
LowGHSA-8wmf-6v46-5gfg source
CVE-2026-81870
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
golang
v1.39.01.45.0✓not in released binaryno0.3%go.modDispute
LowGHSA-8wmf-6v46-5gfg source
CVE-2026-81870
go.opentelemetry.io/otel/sdk
golang
v1.39.01.45.0✓not in released binaryno0.3%go.modDispute
LowGO-2026-5024 source
CVE-2026-39824
golang.org/x/sys
golang
v0.39.00.44.0✓vulnerable code not in binaryno0.1%go.modDispute
UnknownGO-2026-5932 sourcegolang.org/x/crypto
golang
v0.45.0no fix listed✓vulnerable code in binaryno—go.modDispute
UnknownGO-2026-6860 source
CVE-2026-78661
golang.org/x/net
golang
v0.47.00.62.0✓vulnerable code in binaryno0.2%go.modDispute
UnknownGO-2026-6866 source
CVE-2026-97045
golang.org/x/net
golang
v0.47.00.62.0✓vulnerable code in binaryno0.2%go.modDispute

Second opinion: OSV-Scanner

OSV-Scanner found 74 advisories in the same files; 74 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Vulnerable code in the released binary

govulncheck analyzed clairctl-linux-amd64 from clairctl-linux-amd64, built with go1.24.10. 82 advisories have vulnerable functions compiled into it: 48 in the Go standard library and 34 in dependencies.

Of the 74 Go advisories Grype matched in the source, 32 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

AdvisoryModuleVersionFixed inSummary
GO-2025-4155
CVE-2025-61729, CVE-2025-61729
stdlibv1.24.10v1.24.11Excessive resource consumption when printing error string for host certificate validation in crypto/x509
GO-2025-4175
CVE-2025-61727
stdlibv1.24.10v1.24.11Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
GO-2026-4337
CVE-2025-68121
stdlibv1.24.10v1.24.13Unexpected session resumption in crypto/tls
GO-2026-4340
CVE-2025-61730, CVE-2025-61730
stdlibv1.24.10v1.24.12Handshake messages may be processed at the incorrect encryption level in crypto/tls
GO-2026-4341
CVE-2025-61726, CVE-2025-61726
stdlibv1.24.10v1.24.12Memory exhaustion in query parameter parsing in net/url
GO-2026-4342
CVE-2025-61728, CVE-2025-61728
stdlibv1.24.10v1.24.12Excessive CPU consumption when building archive index in archive/zip
GO-2026-4601
CVE-2026-25679
stdlibv1.24.10v1.25.8Incorrect parsing of IPv6 host literals in net/url
GO-2026-4602
CVE-2026-27139
stdlibv1.24.10v1.25.8FileInfo can escape from a Root in os
GO-2026-4603
CVE-2026-27142
stdlibv1.24.10v1.25.8URLs in meta content attribute actions are not escaped in html/template
GO-2026-4864
CVE-2026-32282
stdlibv1.24.10v1.25.9TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
GO-2026-4865
CVE-2026-32289
stdlibv1.24.10v1.25.9JsBraceDepth Context Tracking Bugs (XSS) in html/template
GO-2026-4869
CVE-2026-32288
stdlibv1.24.10v1.25.9Unbounded allocation for old GNU sparse in archive/tar
GO-2026-4870
CVE-2026-32283
stdlibv1.24.10v1.25.9Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
GO-2026-4918
CVE-2026-33814
stdlibv1.24.10v1.25.10Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-4946
CVE-2026-32281
stdlibv1.24.10v1.25.9Inefficient policy validation in crypto/x509
GO-2026-4947
CVE-2026-32280
stdlibv1.24.10v1.25.9Unexpected work during chain building in crypto/x509
GO-2026-4970
CVE-2026-39822
stdlibv1.24.10v1.25.12Root escape via symlink plus trailing slash in os
GO-2026-4971
CVE-2026-39836
stdlibv1.24.10v1.25.10Panic in Dial and LookupPort when handling NUL byte on Windows in net
GO-2026-4976
CVE-2026-39825
stdlibv1.24.10v1.25.10ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
GO-2026-4977
CVE-2026-42499
stdlibv1.24.10v1.25.10Quadratic string concatenation in consumePhrase in net/mail
GO-2026-4980
CVE-2026-39826
stdlibv1.24.10v1.25.10Escaper bypass leads to XSS in html/template
GO-2026-4981
CVE-2026-33811
stdlibv1.24.10v1.25.10Crash when handling long CNAME response in net
GO-2026-4982
CVE-2026-39823
stdlibv1.24.10v1.25.10Bypass of meta content URL escaping causes XSS in html/template
GO-2026-4986
CVE-2026-39820
stdlibv1.24.10v1.25.10Quadratic string concatentation in consumeComment in net/mail
GO-2026-5026
CVE-2026-39821
stdlibv1.24.10v1.25.13Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5037
CVE-2026-27145
stdlibv1.24.10v1.25.11Inefficient candidate hostname parsing in crypto/x509
GO-2026-5038
CVE-2026-42504
stdlibv1.24.10v1.25.11Quadratic complexity in WordDecoder.DecodeHeader in mime
GO-2026-5039
CVE-2026-42507
stdlibv1.24.10v1.25.11Arbitrary inputs are included in errors without any escaping in net/textproto
GO-2026-5856
CVE-2026-42505
stdlibv1.24.10v1.25.12Invoking Encrypted Client Hello privacy leak in crypto/tls
GO-2026-5972
CVE-2026-33818
stdlibv1.24.10v1.25.13Enforce maximum recursion depth in encoding/asn1
GO-2026-6088
CVE-2026-56859
stdlibv1.24.10v1.25.13Add recursion depth guard during decode in encoding/xml
GO-2026-6089
CVE-2026-56853
stdlibv1.24.10v1.25.13Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
GO-2026-6090
CVE-2026-56862
stdlibv1.24.10v1.25.13Limit handshake messages we are willing to accept post-handshake in crypto/tls
GO-2026-6091
CVE-2026-56858
stdlibv1.24.10v1.25.13Fix Javascript regexp context tracking in html/template
GO-2026-6218
CVE-2026-56860
stdlibv1.24.10v1.25.13Avoid quadratic complexity in resolvePath in net/url
GO-2026-6599
CVE-2026-94448
stdlibv1.24.10v1.26.9Reset context tracking on consecutive template expressions in html/template
GO-2026-6600
CVE-2026-97030
stdlibv1.24.10v1.26.9Recognize yield as regexp preceder keyword in html/template
GO-2026-6603
CVE-2026-78659
stdlibv1.24.10v1.26.9HTTP/2 server memory exhaustion due to Trailer headers in net/http
GO-2026-6605
CVE-2026-56866
stdlibv1.24.10v1.26.9HTTP/1 client connection desynchronization after CONNECT rejection in net/http
GO-2026-6607
CVE-2026-97031
stdlibv1.24.10v1.26.9Reject malformed ECH outer extension references in crypto/tls
GO-2026-6608
CVE-2026-94440
stdlibv1.24.10v1.26.9Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
GO-2026-6609
CVE-2026-78667
stdlibv1.24.10v1.26.9Lack of limit on size of parsed Range headers in net/http
GO-2026-6610
CVE-2026-78660
stdlibv1.24.10v1.26.9HTTP/2 transport accepts malformed framing-related headers in net/http
GO-2026-6611
CVE-2026-78669
stdlibv1.24.10v1.26.9Excessive CPU consumption from repeated initial window changes in net/http
GO-2026-6612
CVE-2026-78663
stdlibv1.24.10v1.26.9Double flow control refund on HTTP/2 server streams in net/http
GO-2026-6613
CVE-2026-94439
stdlibv1.24.10v1.26.9HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
GO-2026-6617
CVE-2026-97032
stdlibv1.24.10v1.26.9HTTP/2 server crash due to HPACK encoder race in net/http
GO-2026-6809
CVE-2026-111943
stdlibv1.24.10v1.26.10Distrust compromised intermediate certificates in crypto/x509
GO-2026-4610
CVE-2025-15558, GHSA-p436-gjf2-799p
github.com/docker/cliv29.0.3+incompatiblev29.2.0+incompatibleDocker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
GO-2026-4945
CVE-2026-34986, GHSA-78h2-9frx-2jm8
github.com/go-jose/go-jose/v3v3.0.4v3.0.5Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
GO-2026-4771
CVE-2026-33815, GHSA-xgrm-4fwx-7qm8
github.com/jackc/pgx/v5v5.7.6v5.9.0CVE-2026-33815 in github.com/jackc/pgx
GO-2026-4772
CVE-2026-33816, GHSA-9jj7-4m8r-rfcm
github.com/jackc/pgx/v5v5.7.6v5.9.0CVE-2026-33816 in github.com/jackc/pgx
GO-2026-5004
CVE-2026-41889, GHSA-j88v-2chj-qfwx
github.com/jackc/pgx/v5v5.7.6v5.9.2SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx
GO-2026-5841
GHSA-259r-337f-4rfw
github.com/klauspost/compressv1.18.2v1.18.7OOB read in github.com/klauspost/compress/s2
GO-2026-5506
CVE-2026-29181, GHSA-mh2q-q3fh-2475
go.opentelemetry.io/otelv1.39.0v1.41.0OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel
GO-2026-5005
CVE-2026-39833, GHSA-jppx-rxg9-jmrx
golang.org/x/cryptov0.45.0v0.52.0Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
GO-2026-5006
CVE-2026-39832, GHSA-f5wc-c3c7-36mc
golang.org/x/cryptov0.45.0v0.52.0Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
GO-2026-5013
CVE-2026-46597
golang.org/x/cryptov0.45.0v0.52.0Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
GO-2026-5014
CVE-2026-39828
golang.org/x/cryptov0.45.0v0.52.0Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
GO-2026-5015
CVE-2026-39835
golang.org/x/cryptov0.45.0v0.52.0Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
GO-2026-5016
CVE-2026-39827
golang.org/x/cryptov0.45.0v0.52.0Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
GO-2026-5017
CVE-2026-39830
golang.org/x/cryptov0.45.0v0.52.0Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
GO-2026-5018
CVE-2026-39829
golang.org/x/cryptov0.45.0v0.52.0Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
GO-2026-5019
CVE-2026-39831
golang.org/x/cryptov0.45.0v0.52.0Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
GO-2026-5020
CVE-2026-39834
golang.org/x/cryptov0.45.0v0.52.0Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
GO-2026-5021
CVE-2026-42508, GHSA-5cgq-3rg8-m6cv
golang.org/x/cryptov0.45.0v0.52.0Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
GO-2026-5023
CVE-2026-46595
golang.org/x/cryptov0.45.0v0.52.0Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
GO-2026-5033
CVE-2026-46598
golang.org/x/cryptov0.45.0v0.52.0Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
GO-2026-5932
golang.org/x/cryptov0.45.0—The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
GO-2026-6303
CVE-2026-56854
golang.org/x/cryptov0.45.0v0.55.0Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
GO-2026-6354
CVE-2026-78662
golang.org/x/cryptov0.45.0v0.56.0Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
GO-2026-6355
CVE-2026-56855
golang.org/x/cryptov0.45.0v0.56.0Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
GO-2026-5025
CVE-2026-42506
golang.org/x/netv0.47.0v0.55.0Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
GO-2026-5027
CVE-2026-42502
golang.org/x/netv0.47.0v0.55.0Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
GO-2026-5028
CVE-2026-25680
golang.org/x/netv0.47.0v0.55.0Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
GO-2026-5029
CVE-2026-25681
golang.org/x/netv0.47.0v0.55.0Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5030
CVE-2026-27136
golang.org/x/netv0.47.0v0.55.0Invoking duplicate attributes can cause XSS in golang.org/x/net/html
GO-2026-5942
CVE-2026-46600
golang.org/x/netv0.47.0v0.56.0Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
GO-2026-6860
CVE-2026-78661
golang.org/x/netv0.47.0v0.62.0Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
GO-2026-6866
CVE-2026-97045
golang.org/x/netv0.47.0v0.62.0Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
GO-2026-5970
CVE-2026-56852
golang.org/x/textv0.31.0v0.39.0Infinite loop on invalid input in golang.org/x/text
GO-2026-6629
CVE-2026-56851
golang.org/x/textv0.31.0v0.41.0Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

Release integrity

Verdict: no checksums or signatures for clairctl-linux-amd64. The download matches GitHub's recorded digest.

Verified means a signature, provenance, or attestation was checked against an identity in quay/clair's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 5/10, assessed 2026-10-26 (OpenSSF public dataset). Scorecard viewer

All checks
CheckScoreReason
CII-Best-Practices0no effort to earn an OpenSSF best practices badge detected
Fuzzing0project is not fuzzed
Pinned-Dependencies0dependency not pinned by hash detected -- score normalized to 0
SAST0SAST tool is not run on all commits -- score normalized to 0
Security-Policy0security policy file not detected
Signed-Releases0Project has not signed or included provenance with any releases.
Token-Permissions0detected GitHub workflow tokens with excessive permissions
Branch-Protection5branch protection is not maximal on development and all release branches
Maintained89 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 8
Binary-Artifacts10no binaries found in the repo
Code-Review10all changesets reviewed
Dangerous-Workflow10no dangerous workflow patterns detected
License10license file detected
Packaging10packaging workflow detected

GitHub Actions workflow audit (zizmor)

105 potential issues in 15 workflow files at this release: 69 high, 24 medium, 11 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings
SeverityRuleLocationNote
Highunpinned-uses
unpinned action reference
.github/actions/documentation/action.yml:13this step
Highunpinned-uses
unpinned action reference
.github/actions/documentation/action.yml:24this step
Highunpinned-uses
unpinned action reference
.github/actions/go-cache/action.yml:9this step
Hightemplate-injection
code injection via template expansion
.github/actions/go-tidy/action.yml:15this step
Hightemplate-injection
code injection via template expansion
.github/actions/set-image-expiration/action.yml:24this step
Hightemplate-injection
code injection via template expansion
.github/actions/set-image-expiration/action.yml:29this step
Hightemplate-injection
code injection via template expansion
.github/actions/set-image-expiration/action.yml:29this step
Hightemplate-injection
code injection via template expansion
.github/actions/set-image-expiration/action.yml:29this step
Hightemplate-injection
code injection via template expansion
.github/actions/set-image-expiration/action.yml:29this step
Hightemplate-injection
code injection via template expansion
.github/actions/set-image-expiration/action.yml:29this step
Highunpinned-uses
unpinned action reference
.github/workflows/check-fast-forward.yml:18this step
Highunpinned-uses
unpinned action reference
.github/workflows/config-ci.yml:23this step
Highunpinned-uses
unpinned action reference
.github/workflows/config-ci.yml:39this step
Highunpinned-uses
unpinned action reference
.github/workflows/config-ci.yml:43this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:51this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:67this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:93this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:128this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:136this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:146this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:161this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:166this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:180this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:185this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:189this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:191this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:201this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:211this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:244this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:250this step
Highunpinned-uses
unpinned action reference
.github/workflows/cut-release.yml:265this step
Highunpinned-uses
unpinned action reference
.github/workflows/documentation.yml:16this step
Highdangerous-triggers
use of fundamentally insecure workflow trigger
.github/workflows/fast-forward.yml:3this workflow
Highunpinned-uses
unpinned action reference
.github/workflows/fast-forward.yml:29this step
Highunpinned-uses
unpinned action reference
.github/workflows/main.yml:19this step
Highunpinned-uses
unpinned action reference
.github/workflows/main.yml:30this step
Highunpinned-uses
unpinned action reference
.github/workflows/main.yml:52this step
Highunpinned-uses
unpinned action reference
.github/workflows/main.yml:72this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly-ci.yml:21this step
Hightemplate-injection
code injection via template expansion
.github/workflows/nightly-ci.yml:24this step
Hightemplate-injection
code injection via template expansion
.github/workflows/nightly-ci.yml:24this step
Hightemplate-injection
code injection via template expansion
.github/workflows/nightly.yml:21this step
Hightemplate-injection
code injection via template expansion
.github/workflows/nightly.yml:21this step
Hightemplate-injection
code injection via template expansion
.github/workflows/nightly.yml:21this step
Hightemplate-injection
code injection via template expansion
.github/workflows/nightly.yml:21this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:42this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:45this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:46this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:49this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:61this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:66this step
Highunpinned-uses
unpinned action reference
.github/workflows/nightly.yml:83this step
Highunpinned-uses
unpinned action reference
.github/workflows/prepare-release.yml:20this step
Hightemplate-injection
code injection via template expansion
.github/workflows/prepare-release.yml:25this step
Hightemplate-injection
code injection via template expansion
.github/workflows/prepare-release.yml:25this step
Hightemplate-injection
code injection via template expansion
.github/workflows/prepare-release.yml:25this step
Highunpinned-uses
unpinned action reference
.github/workflows/prepare-release.yml:47this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:33this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:48this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:52this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:59this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:69this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:80this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:145this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:147this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:153this step
Highunpinned-uses
unpinned action reference
.github/workflows/tests.yml:162this step
Hightemplate-injection
code injection via template expansion
.github/workflows/tests.yml:168this step
Highunpinned-uses
unpinned action reference
.github/workflows/v2-issues.yml:17this step
Mediumexcessive-permissions
overly broad permissions
.github/workflows/config-ci.yml:2default permissions used due to no permissions: block
Mediumexcessive-permissions
overly broad permissions
.github/workflows/config-ci.yml:19this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/config-ci.yml:35this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/config-ci.yml:58this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:2default permissions used due to no permissions: block
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:11this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:46this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:102this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:153this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:175this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:222this job
Mediumarchived-uses
action or reusable workflow from archived repository
.github/workflows/cut-release.yml:250this step
Mediumexcessive-permissions
overly broad permissions
.github/workflows/cut-release.yml:260this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/documentation.yml:12this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/main.yml:2default permissions used due to no permissions: block
Mediumexcessive-permissions
overly broad permissions
.github/workflows/main.yml:15this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/main.yml:67this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/main.yml:77this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/nightly-ci.yml:2default permissions used due to no permissions: block
Mediumexcessive-permissions
overly broad permissions
.github/workflows/nightly-ci.yml:15this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/nightly-ci.yml:34this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/nightly.yml:17this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/prepare-release.yml:16this job
Mediumexcessive-permissions
overly broad permissions
.github/workflows/v2-issues.yml:14this job
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/actions/go-tidy/action.yml:12this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/config-ci.yml:59this job
Lowobfuscation
obfuscated usage of GitHub Actions features
.github/workflows/cut-release.yml:28can be replaced by its static evaluation
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/cut-release.yml:55this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/cut-release.yml:214this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/cut-release.yml:266this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/documentation.yml:17this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/main.yml:73this step
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/main.yml:78this job
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/nightly-ci.yml:35this job
Lowself-repository
use GitHub's dedicated self-repository syntax
.github/workflows/nightly.yml:94this step
Informationalsuperfluous-actions
action functionality is already included by the runner
.github/workflows/cut-release.yml:166this step

Dependencies (128)

By ecosystem: golang 105, github 19, unknown 4.

Licenses (as declared in the SBOM): unknown 128.

golang (105)
NameVersionLicenseDeclared in
github.com/beorn7/perksv1.0.1go.mod
github.com/cenkalti/backoff/v5v5.0.3go.mod
github.com/cespare/xxhash/v2v2.3.0go.mod
github.com/containerd/stargz-snapshotter/estargzv0.18.1go.mod
github.com/cpuguy83/go-md2man/v2v2.0.7go.mod
github.com/docker/cliv29.0.3+incompatiblego.mod
github.com/docker/distributionv2.8.3+incompatiblego.mod
github.com/docker/docker-credential-helpersv0.9.3go.mod
github.com/doug-martin/goqu/v8v8.6.0go.mod
github.com/dustin/go-humanizev1.0.1go.mod
github.com/evanphx/json-patch/v5v5.9.11go.mod
github.com/felixge/httpsnoopv1.0.4go.mod
github.com/go-jose/go-jose/v3v3.0.4go.mod
github.com/go-logr/logrv1.4.3go.mod
github.com/go-logr/stdrv1.2.2go.mod
github.com/go-stomp/stomp/v3v3.1.5go.mod
github.com/google/go-cmpv0.7.0config/go.mod
github.com/google/go-containerregistryv0.20.7go.mod
github.com/google/uuidv1.6.0go.mod
github.com/grafana/pyroscope-go/godeltaprofv0.1.9go.mod
github.com/grpc-ecosystem/grpc-gateway/v2v2.27.3go.mod
github.com/jackc/chunkreader/v2v2.0.1go.mod
github.com/jackc/pgconnv1.14.3go.mod
github.com/jackc/pgiov1.0.0go.mod
github.com/jackc/pgpassfilev1.0.0go.mod
github.com/jackc/pgproto3/v2v2.3.3go.mod
github.com/jackc/pgservicefilev0.0.0-20240606120523-5a60cdf6a761go.mod
github.com/jackc/pgx/v5v5.7.6go.mod
github.com/jackc/puddle/v2v2.2.2go.mod
github.com/klauspost/compressv1.18.2go.mod
github.com/knqyf263/go-apk-versionv0.0.0-20200609155635-041fdbb8563fgo.mod
github.com/knqyf263/go-deb-versionv0.0.0-20190517075300-09fca494f03dgo.mod
github.com/knqyf263/go-rpm-versionv0.0.0-20170716094938-74609b86c936go.mod
github.com/kylelemons/godebugv1.1.0go.mod
github.com/Masterminds/semverv1.5.0go.mod
github.com/mattn/go-colorablev0.1.13go.mod
github.com/mattn/go-isattyv0.0.20go.mod
github.com/mitchellh/go-homedirv1.1.0go.mod
github.com/munnerz/goautonegv0.0.0-20191010083416-a7dc8b61c822go.mod
github.com/ncruces/go-strftimev0.1.9go.mod
github.com/opencontainers/go-digestv1.0.0go.mod
github.com/opencontainers/image-specv1.1.1go.mod
github.com/package-url/packageurl-gov0.1.3go.mod
github.com/prometheus/client_golangv1.23.2go.mod
github.com/prometheus/client_modelv0.6.2go.mod
github.com/prometheus/commonv0.67.4go.mod
github.com/prometheus/otlptranslatorv1.0.0go.mod
github.com/prometheus/procfsv0.19.2go.mod
github.com/quay/clair/configv1.4.3go.mod
github.com/quay/claircorev1.5.48go.mod
github.com/quay/claircore/toolkitv1.3.0go.mod
github.com/quay/claircore/updater/driverv1.0.0go.mod
github.com/quay/goval-parserv0.8.8go.mod
github.com/quay/zlogv1.1.9go.mod
github.com/rabbitmq/amqp091-gov1.10.0go.mod
github.com/remind101/migratev0.0.0-20170729031349-52c1edff7319go.mod
github.com/remyoudompheng/bigfftv0.0.0-20230129092748-24d4a6f8daecgo.mod
github.com/rogpeppe/go-internalv1.14.1go.mod
github.com/rs/zerologv1.34.0go.mod
github.com/russross/blackfriday/v2v2.1.0go.mod
github.com/sirupsen/logrusv1.9.3go.mod
github.com/tomnomnom/linkheaderv0.0.0-20180905144013-02ca5825eb80go.mod
github.com/ugorji/go/codecv1.2.14go.mod
github.com/ulikunitz/xzv0.5.15go.mod
github.com/urfave/cli/v2v2.27.7go.mod
github.com/vbatts/tar-splitv0.12.2go.mod
github.com/xrash/smetricsv0.0.0-20240521201337-686a1a2994c1go.mod
go.opentelemetry.io/auto/sdkv1.2.1go.mod
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptracev0.63.0go.mod
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.64.0go.mod
go.opentelemetry.io/otelv1.39.0go.mod
go.opentelemetry.io/otel/exporters/jaegerv1.17.0go.mod
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpcv1.39.0go.mod
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpv1.39.0go.mod
go.opentelemetry.io/otel/exporters/otlp/otlptracev1.39.0go.mod
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpcv1.39.0go.mod
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.39.0go.mod
go.opentelemetry.io/otel/exporters/prometheusv0.61.0go.mod
go.opentelemetry.io/otel/exporters/stdout/stdoutmetricv1.39.0go.mod
go.opentelemetry.io/otel/exporters/stdout/stdouttracev1.39.0go.mod
go.opentelemetry.io/otel/metricv1.39.0go.mod
go.opentelemetry.io/otel/sdkv1.39.0go.mod
go.opentelemetry.io/otel/sdk/metricv1.39.0go.mod
go.opentelemetry.io/otel/tracev1.39.0go.mod
go.opentelemetry.io/proto/otlpv1.9.0go.mod
go.uber.org/mockv0.6.0go.mod
go.yaml.in/yaml/v2v2.4.3go.mod
golang.org/x/cryptov0.45.0go.mod
golang.org/x/expv0.0.0-20250620022241-b7579e27df2bgo.mod
golang.org/x/modv0.30.0go.mod
golang.org/x/netv0.47.0go.mod
golang.org/x/syncv0.18.0go.mod
golang.org/x/sysv0.39.0go.mod
golang.org/x/textv0.31.0go.mod
golang.org/x/timev0.14.0go.mod
golang.org/x/toolsv0.39.0go.mod
google.golang.org/genproto/googleapis/apiv0.0.0-20251202230838-ff82c1b0f217go.mod
google.golang.org/genproto/googleapis/rpcv0.0.0-20251202230838-ff82c1b0f217go.mod
google.golang.org/grpcv1.77.0go.mod
google.golang.org/protobufv1.36.10go.mod
gopkg.in/yaml.v3v3.0.1go.mod
modernc.org/libcv1.66.10go.mod
modernc.org/mathutilv1.7.1go.mod
modernc.org/memoryv1.11.0go.mod
modernc.org/sqlitev1.39.1go.mod
github (19)
NameVersionLicenseDeclared in
actions/cachev4.github/actions/go-cache/action.yml
actions/cache/restorev4.github/workflows/tests.yml
actions/checkoutv6.github/workflows/config-ci.yml
actions/download-artifactv6.github/workflows/cut-release.yml
actions/github-scriptv8.github/workflows/tests.yml
actions/setup-gov6.github/workflows/config-ci.yml
actions/stalev10.github/workflows/v2-issues.yml
actions/upload-artifactv5.github/workflows/cut-release.yml
actions/upload-release-assetv1.github/workflows/cut-release.yml
docker/build-push-actionv6.github/workflows/cut-release.yml
docker/login-actionv3.github/workflows/cut-release.yml
docker/setup-buildx-actionv3.github/workflows/cut-release.yml
docker/setup-qemu-actionv3.github/workflows/cut-release.yml
gsactions/commit-message-checkerv2.github/workflows/config-ci.yml
ncipollo/release-actionv1.github/workflows/cut-release.yml
peaceiris/actions-gh-pagesv3.github/actions/documentation/action.yml
peaceiris/actions-mdbookv1.github/actions/documentation/action.yml
peter-evans/create-pull-requestv7.github/workflows/prepare-release.yml
sequoia-pgp/fast-forwardv1.github/workflows/check-fast-forward.yml
unknown (4)
NameVersionLicenseDeclared in
./.github/actions/documentationUNKNOWN.github/workflows/cut-release.yml
./.github/actions/go-cacheUNKNOWN.github/actions/go-tidy/action.yml
./.github/actions/set-image-expirationUNKNOWN.github/workflows/cut-release.yml
./.github/workflows/tests.ymlUNKNOWN.github/workflows/config-ci.yml

History

WeekVersionDependenciesCriticalHighMediumLowUnknownChanges
2026-11-02v4.9.012814341763—
2026-11-01v4.9.012814341763—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

StandardScoreChecks passedFailed checks
NTIA 2021715/7Supplier Name, Dependency Relationship
CISA 2025505/10Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183444/9Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/quay__clair/.

19 manifests and lockfiles scanned

.github/actions/documentation/action.yml, .github/actions/go-cache/action.yml, .github/actions/go-tidy/action.yml, .github/actions/set-image-expiration/action.yml, .github/workflows/check-fast-forward.yml, .github/workflows/config-ci.yml, .github/workflows/cut-release.yml, .github/workflows/documentation.yml, .github/workflows/fast-forward.yml, .github/workflows/main.yml, .github/workflows/nightly-ci.yml, .github/workflows/nightly.yml, .github/workflows/prepare-release.yml, .github/workflows/tests.yml, .github/workflows/v2-issues.yml, config/go.mod, config/go.sum, go.mod, go.sum

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fquay%2Fclair%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/quay/clair/index.html)
[![vulnerable code in binary](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fquay%2Fclair%2Fin-binary.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/quay/clair/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

How the weekly supply-chain report is producedEvery Sunday the catalog's tools are resolved to their latest release. Manifests and workflows go to Syft, Grype, OSV-Scanner, sbomlyze, and zizmor; the release binary and its signatures go to govulncheck, Cosign, slsa-verifier, and GitHub attestation verification; the repository goes to OpenSSF Scorecard. Results are compared with the previous week and published here.Catalog78 tools in READMELatest releaseGitHub API, every SundayManifests & workflowssparse checkout, no testsRelease binaryLinux amd64 + signaturesRepositoryGitHub & OpenSSF dataSyftSBOMGrype + OSV-Scannerknown advisoriessbomlyzediff + minimum elementszizmorworkflow auditgovulncheckvulnerable code in binaryCosign · slsa-verifier · ghrelease verificationOpenSSF Scorecardrepository practicesCompare with last weekdata branch historyThis reportoverview + project pages
ToolWhat it does hereVersion this week
SyftGenerates a CycloneDX SBOM from each release's manifests and lockfiles.1.55.0
GrypeMatches the SBOM against known vulnerabilities.0.121.0
OSV-ScannerChecks the same files against the OSV database to confirm or add matches.2.7.0
govulncheckFor Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.1.9.0
zizmorAudits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.1.31.1
OpenSSF ScorecardScores repository security practices such as code review, branch protection, and pinned dependencies.5.6.0
CosignVerifies Sigstore signatures on the release binary or its checksums file.3.1.4
slsa-verifierVerifies SLSA build provenance published with the release.2.7.1
GitHub CLI attestationsVerifies GitHub artifact attestations for the release binary.—
sbomlyzeDiffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.0.6.0