{ "apiVersion": "v1", "resource": "charts", "total": 136, "data": [ { "slug": "airflow", "name": "airflow", "category": "Workflow", "summary": "Apache Airflow, the programmatic workflow orchestration platform for authoring, scheduling, and monitoring DAGs. Built clean-room from source as a Python venv on Wolfi (python-3.12, official constraints), nonroot on a hardened read-only-rootfs base. Ships the 3.2 line (older lines carry unfixed CVEs in Airflow itself). Runs api-server + scheduler + dag-processor + triggerer (and Celery workers) from one image; needs PostgreSQL (and Redis for CeleryExecutor), provided by the chart.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.6", "appVersion": "3.3.0", "description": "Hardened Apache Airflow 3 workflow orchestration (api-server + scheduler + dag-processor + triggerer, optional Celery workers) on a 0-CVE image", "imageRepository": "ghcr.io/quenchworks/images/airflow", "imageDigest": "sha256:8142a61a094858e3c063c6c0d8c64f8fb60c41603b0684d568fe5104dc071aad", "repositoryID": "176f09db-d12c-4541-867b-9f5c91340731", "port": 8080, "upstream": "https://airflow.apache.org", "chartRef": "oci://ghcr.io/quenchworks/charts/airflow", "images": [ { "name": "airflow", "image": "ghcr.io/quenchworks/images/airflow@sha256:8142a61a094858e3c063c6c0d8c64f8fb60c41603b0684d568fe5104dc071aad" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:4482926665b4e9fbe73b6ab15e403e1f4d9285112aca313ce4994095346c6565" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:f027d0109a0bdd1779bfac85a10744336f4af80518e9bc2c290984e206b3bf14" } ], "security": { "image": "ghcr.io/quenchworks/images/airflow", "version": "3.3.0", "tag": "ghcr.io/quenchworks/images/airflow:3.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.3.0", "tag": "ghcr.io/quenchworks/images/airflow:3.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.2.2", "tag": "ghcr.io/quenchworks/images/airflow:3.2.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "alertmanager", "name": "Alertmanager", "category": "Observability", "summary": "Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "0.33.1", "description": "Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/alertmanager", "imageDigest": "sha256:f9f5f7260be1d324024cf782f1f5e5cb465a942a70896e5b142197e1988df651", "repositoryID": "ec60d3e2-eb6a-497b-b02f-f590e9844186", "port": 9093, "upstream": "https://github.com/prometheus/alertmanager", "chartRef": "oci://ghcr.io/quenchworks/charts/alertmanager", "images": [ { "name": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager@sha256:f9f5f7260be1d324024cf782f1f5e5cb465a942a70896e5b142197e1988df651" } ], "security": { "image": "ghcr.io/quenchworks/images/alertmanager", "version": "0.33.1", "tag": "ghcr.io/quenchworks/images/alertmanager:0.33.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] } ], "versions": [ { "version": "0.33.1", "tag": "ghcr.io/quenchworks/images/alertmanager:0.33.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/alertmanager", "usr/bin/amtool" ] } ] } ] } }, { "slug": "atlantis", "name": "Atlantis", "category": "GitOps", "summary": "Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "0.46.0", "description": "Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/atlantis", "imageDigest": "sha256:769481554211806644df3e931c7021faa9d226a45aff333dd857b5f464936e0e", "repositoryID": "c0d03a91-0b40-4726-8301-affbc45a972f", "port": 4141, "upstream": "https://github.com/runatlantis/atlantis", "chartRef": "oci://ghcr.io/quenchworks/charts/atlantis", "images": [ { "name": "atlantis", "image": "ghcr.io/quenchworks/images/atlantis@sha256:769481554211806644df3e931c7021faa9d226a45aff333dd857b5f464936e0e" } ], "security": { "image": "ghcr.io/quenchworks/images/atlantis", "version": "0.46.0", "tag": "ghcr.io/quenchworks/images/atlantis:0.46.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 0, "grade": "D", "score": 86, "cves": [ { "id": "CVE-2026-50163", "severity": "HIGH", "pkg": "oras.land/oras-go/v2", "installed": "v2.6.1", "fixed": null, "title": "oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks", "url": "https://avd.aquasec.com/nvd/cve-2026-50163", "targets": [ "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] } ], "versions": [ { "version": "0.46.0", "tag": "ghcr.io/quenchworks/images/atlantis:0.46.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 2, "total": 3, "fixable": 0, "grade": "D", "score": 86, "cves": [ { "id": "CVE-2026-50163", "severity": "HIGH", "pkg": "oras.land/oras-go/v2", "installed": "v2.6.1", "fixed": null, "title": "oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks", "url": "https://avd.aquasec.com/nvd/cve-2026-50163", "targets": [ "usr/bin/tofu" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/atlantis", "usr/bin/tofu" ] } ] } ] } }, { "slug": "authelia", "name": "authelia", "category": "Identity", "summary": "Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies. Packaged from Authelia's official prebuilt binary; needs a config plus a SQLite or PostgreSQL storage backend.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "4.39.20", "description": "Hardened Authelia authentication and authorization server on a 0-CVE image", "imageRepository": "ghcr.io/quenchworks/images/authelia", "imageDigest": "sha256:e9e9a5b5edcd91838d31ddc85df9a27e5e44c6be7371d45930c04437028cda96", "repositoryID": "c3292f9d-22ca-45cd-aad9-b8b96894fa81", "port": 9091, "upstream": "https://www.authelia.com", "chartRef": "oci://ghcr.io/quenchworks/charts/authelia", "images": [ { "name": "authelia", "image": "ghcr.io/quenchworks/images/authelia@sha256:e9e9a5b5edcd91838d31ddc85df9a27e5e44c6be7371d45930c04437028cda96" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:4482926665b4e9fbe73b6ab15e403e1f4d9285112aca313ce4994095346c6565" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:f027d0109a0bdd1779bfac85a10744336f4af80518e9bc2c290984e206b3bf14" } ], "security": { "image": "ghcr.io/quenchworks/images/authelia", "version": "4.39.20", "tag": "ghcr.io/quenchworks/images/authelia:4.39.20", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/authelia" ] } ], "versions": [ { "version": "4.39.20", "tag": "ghcr.io/quenchworks/images/authelia:4.39.20", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/authelia" ] } ] } ] } }, { "slug": "authentik", "name": "authentik", "category": "Secrets & identity", "summary": "Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on Wolfi as a four-language image (nodejs web UI, Go server/proxy, Rust worker, Python/Django core via uv) on a hardened nonroot base; FIPS mode is not forced and the license-gated MaxMind GeoIP download is omitted. Needs PostgreSQL and Redis at runtime, provided by the chart.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.1.9", "appVersion": "2026.5.6", "description": "Hardened Authentik identity provider (OIDC/SAML/LDAP/SCIM) on a 0-CVE image", "imageRepository": "ghcr.io/quenchworks/images/authentik", "imageDigest": "sha256:ae674559d1ed7cc9820d5128c914d5647f36effe3f3fed632e886946fcf5f634", "repositoryID": "50bb4aa5-5b51-4158-bafa-3e0a9204ef5b", "port": 80, "upstream": "https://goauthentik.io", "chartRef": "oci://ghcr.io/quenchworks/charts/authentik", "images": [ { "name": "authentik", "image": "ghcr.io/quenchworks/images/authentik@sha256:ae674559d1ed7cc9820d5128c914d5647f36effe3f3fed632e886946fcf5f634" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:4482926665b4e9fbe73b6ab15e403e1f4d9285112aca313ce4994095346c6565" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:f027d0109a0bdd1779bfac85a10744336f4af80518e9bc2c290984e206b3bf14" } ], "security": { "image": "ghcr.io/quenchworks/images/authentik", "version": "2026.5.6", "tag": "ghcr.io/quenchworks/images/authentik:2026.5.6", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 0, "total": 1, "fixable": 0, "grade": "B", "score": 99, "cves": [ { "id": "CVE-2026-44405", "severity": "LOW", "pkg": "paramiko", "installed": "4.0.0", "fixed": null, "title": "paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use", "url": "https://avd.aquasec.com/nvd/cve-2026-44405", "targets": [ "Python" ] } ], "versions": [ { "version": "2026.5.6", "tag": "ghcr.io/quenchworks/images/authentik:2026.5.6", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 0, "total": 1, "fixable": 0, "grade": "B", "score": 99, "cves": [ { "id": "CVE-2026-44405", "severity": "LOW", "pkg": "paramiko", "installed": "4.0.0", "fixed": null, "title": "paramiko: Paramiko: Data integrity could be compromised due to SHA-1 algorithm use", "url": "https://avd.aquasec.com/nvd/cve-2026-44405", "targets": [ "Python" ] } ] } ] } }, { "slug": "caddy", "name": "Caddy", "category": "Gateway", "summary": "Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "2.11.4", "description": "Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/caddy", "imageDigest": "sha256:916aca2000f2bc50c2fa01c4e30f3f44906fb339e159cb30e2d2611cf60c0303", "repositoryID": "0f266320-b1d0-4ec0-a9b0-0b5dd5a71f9e", "port": 8080, "upstream": "https://github.com/caddyserver/caddy", "chartRef": "oci://ghcr.io/quenchworks/charts/caddy", "images": [ { "name": "caddy", "image": "ghcr.io/quenchworks/images/caddy@sha256:916aca2000f2bc50c2fa01c4e30f3f44906fb339e159cb30e2d2611cf60c0303" } ], "security": { "image": "ghcr.io/quenchworks/images/caddy", "version": "2.11.4", "tag": "ghcr.io/quenchworks/images/caddy:2.11.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/caddy" ] } ], "versions": [ { "version": "2.11.4", "tag": "ghcr.io/quenchworks/images/caddy:2.11.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/caddy" ] } ] } ] } }, { "slug": "cadence", "name": "cadence", "category": "Workflow", "summary": "Fault-tolerant, stateful workflow orchestration engine by Uber. Ships the cadence server and CLI as static Go binaries on a hardened nonroot Wolfi base; Cassandra or a SQL store is the operator's concern.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.4.1", "description": "Uber Cadence: a fault-tolerant, stateful workflow orchestration engine that runs long-running business logic as durable code, persisting execution state in Cassandra so workflows survive process crashes and resume where they left off. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled Cassandra by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/cadence", "imageDigest": "sha256:d58de1ef90e3ae2f79977d1cf800c29a96de67f2340d17b438ecd7589ac7b21f", "repositoryID": "aabd7ba2-3393-4c72-bda9-02200215db38", "upstream": "https://cadenceworkflow.io", "chartRef": "oci://ghcr.io/quenchworks/charts/cadence", "images": [ { "name": "cadence", "image": "ghcr.io/quenchworks/images/cadence@sha256:d58de1ef90e3ae2f79977d1cf800c29a96de67f2340d17b438ecd7589ac7b21f" }, { "name": "cassandra", "image": "ghcr.io/quenchworks/images/cassandra@sha256:bde2cd5b03e626d62207db8a513d0af7512d9a31b373d20c0b789c08e75a50df" } ], "security": { "image": "ghcr.io/quenchworks/images/cadence", "version": "1.4.1", "tag": "ghcr.io/quenchworks/images/cadence:1.4.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadence", "usr/bin/cadence-server" ] } ], "versions": [ { "version": "1.4.1", "tag": "ghcr.io/quenchworks/images/cadence:1.4.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cadence", "usr/bin/cadence-server" ] } ] } ] } }, { "slug": "cassandra", "name": "Cassandra", "category": "Wide-column", "summary": "Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "5.0.8", "description": "Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cassandra", "imageDigest": "sha256:5cdec9fcc9ecab75add9790da63ee05463184d0f13416fea9e847ed95d4bbcb2", "repositoryID": "a2c07ae3-ae2a-421e-9013-f3495d338e09", "upstream": "https://github.com/apache/cassandra", "chartRef": "oci://ghcr.io/quenchworks/charts/cassandra", "images": [ { "name": "cassandra", "image": "ghcr.io/quenchworks/images/cassandra@sha256:5cdec9fcc9ecab75add9790da63ee05463184d0f13416fea9e847ed95d4bbcb2" } ], "security": { "image": "ghcr.io/quenchworks/images/cassandra", "version": "5.0.8", "tag": "ghcr.io/quenchworks/images/cassandra:5.0.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.0.8", "tag": "ghcr.io/quenchworks/images/cassandra:5.0.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "centrifugo", "name": "centrifugo", "category": "Messaging", "summary": "Scalable real-time messaging server (WebSocket, SSE, GRPC) with channels, presence, and JWT auth. Built from source as a static Go binary on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "6.9.1", "description": "Centrifugo, the scalable real-time messaging server (WebSocket, SSE, HTTP-streaming, GRPC) with JWT auth, an admin UI, and a server HTTP API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/centrifugo", "imageDigest": "sha256:0a21d8e336e37e093817a6691a477acabe784d325f65bc1444d4e65e0bdb5ddc", "repositoryID": "5d46994a-a414-4969-8080-eae14a7aa36a", "port": 8000, "upstream": "https://centrifugal.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/centrifugo", "images": [ { "name": "centrifugo", "image": "ghcr.io/quenchworks/images/centrifugo@sha256:0a21d8e336e37e093817a6691a477acabe784d325f65bc1444d4e65e0bdb5ddc" } ], "security": { "image": "ghcr.io/quenchworks/images/centrifugo", "version": "6.9.1", "tag": "ghcr.io/quenchworks/images/centrifugo:6.9.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ], "versions": [ { "version": "6.9.1", "tag": "ghcr.io/quenchworks/images/centrifugo:6.9.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/centrifugo" ] } ] } ] } }, { "slug": "cert-manager", "name": "cert-manager", "category": "Datastore", "summary": "Hardened cert-manager image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.21.0", "description": "cert-manager: automated X.509 certificate management for Kubernetes. Issues and renews certificates from ACME (Let's Encrypt), self-signed, CA, Vault and other Issuers via the Certificate/Issuer/ClusterIssuer CRDs. Hardened by QuenchWorks as minimal, nonroot, 0-CVE images, cosign-signed and pinned by digest. Runs the controller, webhook and cainjector as three deployments; the webhook self-bootstraps its serving CA and the cainjector injects that CA bundle into the admission webhooks, so no external cert-manager dependency is required.", "imageRepository": "ghcr.io/quenchworks/images/cert-manager", "repositoryID": "81bae89c-5c8d-4c9b-b5a7-3650ca7d15e0", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cert-manager", "images": [ { "name": "cert-manager-controller", "image": "ghcr.io/quenchworks/images/cert-manager-controller@sha256:231ca38244231bc7cc33bed93e7a2d82b1189501b372bf30c10d563402bb0fbf" }, { "name": "cert-manager-webhook", "image": "ghcr.io/quenchworks/images/cert-manager-webhook@sha256:ba6c9d5907c62029248e728b2d5d339a7895d85c86b2a51443946b2dd077168c" }, { "name": "cert-manager-cainjector", "image": "ghcr.io/quenchworks/images/cert-manager-cainjector@sha256:1b8df0af33366d59d7b453f0f5188fc56cb3391c8455a5830b95749bf15f2f29" }, { "name": "cert-manager-acmesolver", "image": "ghcr.io/quenchworks/images/cert-manager-acmesolver@sha256:9c17f3978afbcac8eb06cea3bf79e61ff9c9dfef412e9dad7f07b0e6417ba930" } ], "security": null }, { "slug": "clickhouse", "name": "ClickHouse", "category": "Analytical", "summary": "Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "26.7.1.1315", "description": "Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/clickhouse", "imageDigest": "sha256:0fe6b62479965049517e9f59800529422f36038932676b798fa56d3db83757b4", "repositoryID": "1ad6f385-dcc4-4892-b1f9-f3fb12a906e0", "upstream": "https://github.com/ClickHouse/ClickHouse", "chartRef": "oci://ghcr.io/quenchworks/charts/clickhouse", "images": [ { "name": "clickhouse", "image": "ghcr.io/quenchworks/images/clickhouse@sha256:0fe6b62479965049517e9f59800529422f36038932676b798fa56d3db83757b4" } ], "security": { "image": "ghcr.io/quenchworks/images/clickhouse", "version": "26.7.1.1315", "tag": "ghcr.io/quenchworks/images/clickhouse:26.7.1.1315", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "26.7.1.1315", "tag": "ghcr.io/quenchworks/images/clickhouse:26.7.1.1315", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "26.6.2.81", "tag": "ghcr.io/quenchworks/images/clickhouse:26.6.2.81", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "26.5.3.52", "tag": "ghcr.io/quenchworks/images/clickhouse:26.5.3.52", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "cockroachdb", "name": "CockroachDB", "category": "Datastore", "summary": "Hardened cockroachdb image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "26.2.2", "description": "Distributed SQL database with PostgreSQL wire compatibility and automatic horizontal scaling and survivability. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/cockroachdb", "imageDigest": "sha256:ae9726365f7684e710aefc8a214b641e5c788b79993a0b4b30777377b6e38cd2", "repositoryID": "5920d963-0c6f-4c4b-9ece-d3056bc50ef9", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/cockroachdb", "images": [ { "name": "cockroachdb", "image": "ghcr.io/quenchworks/images/cockroachdb@sha256:ae9726365f7684e710aefc8a214b641e5c788b79993a0b4b30777377b6e38cd2" } ], "security": null }, { "slug": "code-server", "name": "code-server", "category": "Developer tools / IDE", "summary": "VS Code in the browser (Coder's code-server), a full IDE served over HTTP. Ships Coder's official prebuilt release (bundled Node 24 + compiled VS Code) hardened on a minimal, nonroot Wolfi base; runs as a single-replica Deployment with a persistent workspace and PASSWORD login.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.2", "appVersion": "4.130.0", "description": "code-server (VS Code in the browser) by Coder, hardened by QuenchWorks as a minimal, nonroot, 0-CVE image on Wolfi, cosign-signed and pinned by digest. Runs as a single-replica Deployment with a persistent workspace ($HOME) and PASSWORD login.", "imageRepository": "ghcr.io/quenchworks/images/code-server", "imageDigest": "sha256:886ebb269dbbb27cd8393fdb16c86beeed326a3eee8cd8cbf79917e7b384e38f", "repositoryID": "dbd5173d-2b60-41bb-adce-a6a86bf22075", "port": 8080, "upstream": "https://coder.com", "chartRef": "oci://ghcr.io/quenchworks/charts/code-server", "images": [ { "name": "code-server", "image": "ghcr.io/quenchworks/images/code-server@sha256:886ebb269dbbb27cd8393fdb16c86beeed326a3eee8cd8cbf79917e7b384e38f" } ], "security": { "image": "ghcr.io/quenchworks/images/code-server", "version": "4.130.0", "tag": "ghcr.io/quenchworks/images/code-server:4.130.0", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 0, "total": 1, "fixable": 0, "grade": "B", "score": 99, "cves": [ { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ], "versions": [ { "version": "4.130.0", "tag": "ghcr.io/quenchworks/images/code-server:4.130.0", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 0, "total": 1, "fixable": 0, "grade": "B", "score": 99, "cves": [ { "id": "GHSA-wx77-rp39-c6vg", "severity": "LOW", "pkg": "markdown", "installed": "30.0.0", "fixed": null, "title": "Regular Expression Denial of Service in markdown", "url": "https://github.com/advisories/GHSA-wx77-rp39-c6vg", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "coolify", "name": "coolify", "category": "Datastore", "summary": "Hardened coolify image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "4.1.2", "description": "Self-hostable platform-as-a-service and open alternative to Heroku and Netlify. This umbrella chart wires the QuenchWorks Coolify control-plane images (the PHP/Laravel app running php-fpm, nginx, Horizon, and the scheduler under supervisord, plus the realtime tier of soketi and a terminal bridge) over bundled QuenchWorks PostgreSQL 15 and Redis, each a minimal, nonroot, 0-CVE image pinned by digest. Coolify manages external Docker hosts over SSH, so the privileged helper and proxy build tier runs on those managed hosts, not in this cluster.", "imageRepository": "ghcr.io/quenchworks/images/coolify", "repositoryID": "afdd5b2a-d315-4342-a18d-24bc4677497b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/coolify", "images": [ { "name": "coolify-app", "image": "ghcr.io/quenchworks/images/coolify-app@sha256:909af37137204709bfeea44319676405d50530227d04c96599b9b09bc90b563e" }, { "name": "coolify-realtime", "image": "ghcr.io/quenchworks/images/coolify-realtime@sha256:91e80b74ab6614367a8f72c36af202ca9799d83099d2546d4746bce79cd4d558" }, { "name": "coolify-helper", "image": "ghcr.io/quenchworks/images/coolify-helper@sha256:3ac8c059ddec50582bb80d6f9626f2e2d06fd7ff67b99f8204976fe3cfd5815b" }, { "name": "postgresql-15", "image": "ghcr.io/quenchworks/images/postgresql-15@sha256:037f012988d7de9e7fad2d4407c3179c37dc8aeff0c616d010a77ea8b16615b6" }, { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:f027d0109a0bdd1779bfac85a10744336f4af80518e9bc2c290984e206b3bf14" } ], "security": null }, { "slug": "coolify-realtime", "name": "Coolify Realtime", "category": "PaaS", "summary": "Realtime server component of Coolify, providing the websocket connections and terminal/log gateway for the dashboard. Licensed AGPL.", "tier": "standard", "license": "AGPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.3", "appVersion": "1.0.16", "description": "Coolify's realtime component: a Pusher-compatible soketi WebSocket server (:6001) plus a node-pty terminal bridge (:6002), the pub/sub tier the Coolify UI subscribes to. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/coolify-realtime", "imageDigest": "sha256:1a9514a1e15cf9901cc2f93817a26bcc34a4838b2f033778fbae49207f1201fd", "repositoryID": "bbc3aa3f-f63d-4d77-8293-70d4c8b05435", "upstream": "https://github.com/coollabsio/coolify", "chartRef": "oci://ghcr.io/quenchworks/charts/coolify-realtime", "images": [ { "name": "coolify-realtime", "image": "ghcr.io/quenchworks/images/coolify-realtime@sha256:1a9514a1e15cf9901cc2f93817a26bcc34a4838b2f033778fbae49207f1201fd" } ], "security": { "image": "ghcr.io/quenchworks/images/coolify-realtime", "version": "1.0.16", "tag": "ghcr.io/quenchworks/images/coolify-realtime:1.0.16", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 2, "fixable": 0, "grade": "B", "score": 97, "cves": [ { "id": "GHSA-j965-2qgj-vjmq", "severity": "LOW", "pkg": "aws-sdk", "installed": "2.1426.0", "fixed": null, "title": "JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3", "url": "https://github.com/advisories/GHSA-j965-2qgj-vjmq", "targets": [ "Node.js" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cloudflared" ] } ], "versions": [ { "version": "1.0.16", "tag": "ghcr.io/quenchworks/images/coolify-realtime:1.0.16", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 2, "fixable": 0, "grade": "B", "score": 97, "cves": [ { "id": "GHSA-j965-2qgj-vjmq", "severity": "LOW", "pkg": "aws-sdk", "installed": "2.1426.0", "fixed": null, "title": "JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3", "url": "https://github.com/advisories/GHSA-j965-2qgj-vjmq", "targets": [ "Node.js" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/cloudflared" ] } ] } ] } }, { "slug": "coredns", "name": "coredns", "category": "Coordination", "summary": "Fast, flexible DNS server that chains plugins to serve DNS and service discovery, the default cluster DNS for Kubernetes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "1.14.6", "description": "Fast, flexible DNS server that chains plugins to serve DNS and service discovery, the default cluster DNS for Kubernetes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/coredns", "imageDigest": "sha256:cc733bae7b57919437ee0c306ef066419d742ef5ffb71e81254cd760f813a477", "repositoryID": "847fc001-bca9-4673-ba1a-d7a84d2df540", "port": 53, "upstream": "https://coredns.io", "chartRef": "oci://ghcr.io/quenchworks/charts/coredns", "images": [ { "name": "coredns", "image": "ghcr.io/quenchworks/images/coredns@sha256:cc733bae7b57919437ee0c306ef066419d742ef5ffb71e81254cd760f813a477" } ], "security": { "image": "ghcr.io/quenchworks/images/coredns", "version": "1.14.6", "tag": "ghcr.io/quenchworks/images/coredns:1.14.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ], "versions": [ { "version": "1.14.6", "tag": "ghcr.io/quenchworks/images/coredns:1.14.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coredns" ] } ] } ] } }, { "slug": "coroot", "name": "coroot", "category": "Observability", "summary": "Coroot — open-source observability/APM (eBPF-based metrics, logs, traces, cost insights and service maps) with an embedded Vue UI. Built from source on Wolfi (go:embedded frontend, cgo lz4), prometheus/ch-go bumped to their fixed lines. Image only, no chart.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.2", "appVersion": "1.23.3", "description": "Open-source observability/APM server: eBPF-based metrics, logs, traces, cost insights and service maps with an embedded Vue UI (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/coroot", "imageDigest": "sha256:4ca63d624cc8462c9844fc92319fe53b746fe355403f3f2332354357fb93b0f8", "repositoryID": "7314e5d7-4903-4248-bbd4-3c6645ed019e", "upstream": "https://coroot.com", "chartRef": "oci://ghcr.io/quenchworks/charts/coroot", "images": [ { "name": "coroot", "image": "ghcr.io/quenchworks/images/coroot@sha256:4ca63d624cc8462c9844fc92319fe53b746fe355403f3f2332354357fb93b0f8" } ], "security": { "image": "ghcr.io/quenchworks/images/coroot", "version": "1.23.3", "tag": "ghcr.io/quenchworks/images/coroot:1.23.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ], "versions": [ { "version": "1.23.3", "tag": "ghcr.io/quenchworks/images/coroot:1.23.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/coroot" ] } ] } ] } }, { "slug": "couchdb", "name": "CouchDB", "category": "Document", "summary": "Document database with an HTTP/JSON API and multi-master replication, designed for offline-first sync across nodes and devices.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "3.5.2", "description": "Document database with an HTTP/JSON API and multi-master replication, designed for offline-first sync across nodes and devices. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/couchdb", "imageDigest": "sha256:e654f0c3753e9bbc2ed975b07f447a48d3fe963bcb6e4e2f1627f3efcf11a524", "repositoryID": "2a97106c-4e54-4881-8b84-2c4eefa64dee", "port": 5984, "upstream": "https://github.com/apache/couchdb", "chartRef": "oci://ghcr.io/quenchworks/charts/couchdb", "images": [ { "name": "couchdb", "image": "ghcr.io/quenchworks/images/couchdb@sha256:e654f0c3753e9bbc2ed975b07f447a48d3fe963bcb6e4e2f1627f3efcf11a524" } ], "security": { "image": "ghcr.io/quenchworks/images/couchdb", "version": "3.5.2", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.5.2", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.5.1", "tag": "ghcr.io/quenchworks/images/couchdb:3.5.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.4.3", "tag": "ghcr.io/quenchworks/images/couchdb:3.4.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "crossplane", "name": "crossplane", "category": "GitOps", "summary": "Crossplane, the CNCF control-plane framework that turns Kubernetes into a universal API for infrastructure. Installs Providers, Functions and Configurations as OCI packages, and lets platform teams publish their own composite APIs from CompositeResourceDefinitions and Compositions.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "2.3.4", "description": "Crossplane, the CNCF control-plane framework that turns Kubernetes into a universal API for infrastructure. Installs Providers, Functions and Configurations as packages, and lets platform teams publish their own composite APIs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/crossplane", "imageDigest": "sha256:8d6341bf870f28c451523991b9ad8248a50deab2fdc6b5987762bfc59f22d5e7", "repositoryID": "7682293d-c090-49c6-aaa4-a3d8598d92cc", "port": 9443, "upstream": "https://crossplane.io", "chartRef": "oci://ghcr.io/quenchworks/charts/crossplane", "images": [ { "name": "crossplane", "image": "ghcr.io/quenchworks/images/crossplane@sha256:8d6341bf870f28c451523991b9ad8248a50deab2fdc6b5987762bfc59f22d5e7" } ], "security": { "image": "ghcr.io/quenchworks/images/crossplane", "version": "2.3.4", "tag": "ghcr.io/quenchworks/images/crossplane:2.3.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ], "versions": [ { "version": "2.3.4", "tag": "ghcr.io/quenchworks/images/crossplane:2.3.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] }, { "version": "2.2.4", "tag": "ghcr.io/quenchworks/images/crossplane:2.2.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] }, { "version": "2.1.8", "tag": "ghcr.io/quenchworks/images/crossplane:2.1.8", "critical": 1, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 2, "fixable": 0, "grade": "F", "score": 73, "cves": [ { "id": "GHSA-wfqx-gjrf-g28r", "severity": "CRITICAL", "pkg": "github.com/crossplane/crossplane/v2", "installed": "v2.1.8", "fixed": null, "title": "Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag", "url": "https://github.com/advisories/GHSA-wfqx-gjrf-g28r", "targets": [ "usr/bin/crossplane" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/crossplane" ] } ] } ] } }, { "slug": "descheduler", "name": "descheduler", "category": "Coordination", "summary": "Kubernetes descheduler that evicts pods so the scheduler can re-place them for better cluster balance. Single static Go binary on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.36.0", "description": "The Kubernetes descheduler evicts running pods so the scheduler can reschedule them onto more suitable nodes, correcting drift from node taints, affinity, topology spread and utilisation over time. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/descheduler", "imageDigest": "sha256:184afaae471b6635fb26741d2829914d7f49c1bf1955cab5af32d335ab4fe534", "repositoryID": "a6c57005-ea4b-4a62-8ee2-64e47fd85ea7", "port": 10258, "upstream": "https://github.com/kubernetes-sigs/descheduler", "chartRef": "oci://ghcr.io/quenchworks/charts/descheduler", "images": [ { "name": "descheduler", "image": "ghcr.io/quenchworks/images/descheduler@sha256:184afaae471b6635fb26741d2829914d7f49c1bf1955cab5af32d335ab4fe534" } ], "security": { "image": "ghcr.io/quenchworks/images/descheduler", "version": "0.36.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.36.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ], "versions": [ { "version": "0.36.0", "tag": "ghcr.io/quenchworks/images/descheduler:0.36.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/descheduler" ] } ] } ] } }, { "slug": "dex", "name": "dex", "category": "Identity", "summary": "Federated OpenID Connect (OIDC) identity provider. Acts as a portal to other identity providers (LDAP, SAML, GitHub, Google, OIDC) and issues OIDC tokens to apps and Kubernetes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "2.45.1", "description": "Dex, the CNCF OpenID Connect (OIDC) identity provider and federated SSO gateway with pluggable connectors (LDAP, SAML, GitHub, Google, OIDC). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/dex", "imageDigest": "sha256:d2e9efd7188d66b120d975effdbb3d950945a921b0c69642f4151b53c5febe1e", "repositoryID": "0744381b-8579-4b27-b25d-35e351f8a87a", "upstream": "https://dexidp.io", "chartRef": "oci://ghcr.io/quenchworks/charts/dex", "images": [ { "name": "dex", "image": "ghcr.io/quenchworks/images/dex@sha256:d2e9efd7188d66b120d975effdbb3d950945a921b0c69642f4151b53c5febe1e" } ], "security": { "image": "ghcr.io/quenchworks/images/dex", "version": "2.45.1", "tag": "ghcr.io/quenchworks/images/dex:2.45.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ], "versions": [ { "version": "2.45.1", "tag": "ghcr.io/quenchworks/images/dex:2.45.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/dex" ] } ] } ] } }, { "slug": "distribution", "name": "distribution", "category": "Registry", "summary": "The CNCF reference OCI and Docker registry server for storing and distributing container images and other OCI artifacts.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "3.1.1", "description": "The CNCF reference OCI and Docker registry server for storing and distributing container images and other OCI artifacts. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/distribution", "imageDigest": "sha256:d36575774b4742443ac5c4296b443f4b394caaf4340070d8fae6ca1378321de3", "repositoryID": "7996908f-74a7-475e-91a2-f3f68f11e71d", "port": 5000, "upstream": "https://distribution.github.io/distribution", "chartRef": "oci://ghcr.io/quenchworks/charts/distribution", "images": [ { "name": "distribution", "image": "ghcr.io/quenchworks/images/distribution@sha256:d36575774b4742443ac5c4296b443f4b394caaf4340070d8fae6ca1378321de3" } ], "security": { "image": "ghcr.io/quenchworks/images/distribution", "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/distribution:3.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ], "versions": [ { "version": "3.1.1", "tag": "ghcr.io/quenchworks/images/distribution:3.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/registry" ] } ] } ] } }, { "slug": "documentdb", "name": "DocumentDB", "category": "Document", "summary": "Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Linux Foundation project, truly open under MIT.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "0.113.0", "description": "Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/documentdb", "imageDigest": "sha256:f08e3a64e8c1367858e6b75c99888fca1d0a990b4a4e8607f134fb07f5f55ad8", "repositoryID": "8a88d701-6590-4e8f-9739-822208f2633f", "port": 10260, "upstream": "https://github.com/documentdb/documentdb", "chartRef": "oci://ghcr.io/quenchworks/charts/documentdb", "images": [ { "name": "documentdb", "image": "ghcr.io/quenchworks/images/documentdb@sha256:f08e3a64e8c1367858e6b75c99888fca1d0a990b4a4e8607f134fb07f5f55ad8" } ], "security": { "image": "ghcr.io/quenchworks/images/documentdb", "version": "0.114.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.114.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.114.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.114.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.113.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.113.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.112.0", "tag": "ghcr.io/quenchworks/images/documentdb:0.112.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "dragonfly", "name": "Dragonfly", "category": "Cache", "summary": "Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. BUSL is source-available, not open source; prefer Valkey (BSD-3-Clause).", "tier": "low", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.10", "appVersion": "1.39.0", "description": "Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/dragonfly", "imageDigest": "sha256:9950a9aae3bd7292ceac904508f7ce9002c0cd76e959711b8364ab23e9751c74", "repositoryID": "c4f8f9c2-1676-4b4a-9b61-c945e0274e2a", "port": 6379, "upstream": "https://github.com/dragonflydb/dragonfly", "chartRef": "oci://ghcr.io/quenchworks/charts/dragonfly", "images": [ { "name": "dragonfly", "image": "ghcr.io/quenchworks/images/dragonfly@sha256:9950a9aae3bd7292ceac904508f7ce9002c0cd76e959711b8364ab23e9751c74" }, { "name": "valkey-sentinel", "image": "ghcr.io/quenchworks/images/valkey@sha256:f03ad3203cfaba0224cde68d152ed0839deca6db72aeef7111ad91c5b7a101a0" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:379b162cd4794ee14c63fec0cc501b855b804f33f824c4e46ced6183f644adfe" } ], "caution": true, "cleanAlternative": "Valkey (BSD-3-Clause) — the truly-open Redis-compatible cache.", "security": { "image": "ghcr.io/quenchworks/images/dragonfly", "version": "1.39.0", "tag": "ghcr.io/quenchworks/images/dragonfly:1.39.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.39.0", "tag": "ghcr.io/quenchworks/images/dragonfly:1.39.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/dragonfly:1.38.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.37.2", "tag": "ghcr.io/quenchworks/images/dragonfly:1.37.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "drupal", "name": "drupal", "category": "Apps & productivity", "summary": "Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord); the chart supplies settings.php via ConfigMap and a MySQL backend. Ships the 11.3/11.4 lines (11.2 is held because drupal/core-recommended pins guzzle below its CVE fix).", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "11.4.4", "description": "Hardened Drupal CMS (PHP-FPM + nginx) on a 0-CVE nonroot image, with a bundled MySQL backend.", "imageRepository": "ghcr.io/quenchworks/images/drupal", "imageDigest": "sha256:23aa2bdb493cedda7c0d64d0f3f423d463f65e55abbed1bbfd45066ec8976eb0", "repositoryID": "a2eea5e8-53da-4235-b31c-0f84c241303b", "port": 8080, "upstream": "https://www.drupal.org", "chartRef": "oci://ghcr.io/quenchworks/charts/drupal", "images": [ { "name": "drupal", "image": "ghcr.io/quenchworks/images/drupal@sha256:23aa2bdb493cedda7c0d64d0f3f423d463f65e55abbed1bbfd45066ec8976eb0" }, { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:e345a54ed4d42b030515ec9e5b6bf359e3d303f4fbc7deea83800e28e5cc1cee" } ], "security": { "image": "ghcr.io/quenchworks/images/drupal", "version": "11.4.4", "tag": "ghcr.io/quenchworks/images/drupal:11.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "11.4.4", "tag": "ghcr.io/quenchworks/images/drupal:11.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "elasticsearch", "name": "Elasticsearch", "category": "Search", "summary": "Distributed search and analytics engine. Shipped under SSPL/Elastic License, which are not OSI-approved; OpenSearch (Apache-2.0) is the open drop-in fork.", "tier": "low", "license": "SSPL-1.0", "licenseClean": "caution", "chartVersion": "0.0.11", "appVersion": "9.4.3", "description": "Distributed search and analytics engine. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/elasticsearch", "imageDigest": "sha256:5d0a0344abf06526c9d851326cbb80a162c459dad7d5465f438773e8992ba718", "repositoryID": "5510adc6-3400-48ab-b57c-807b6b0b815c", "upstream": "https://github.com/elastic/elasticsearch", "chartRef": "oci://ghcr.io/quenchworks/charts/elasticsearch", "images": [ { "name": "elasticsearch", "image": "ghcr.io/quenchworks/images/elasticsearch@sha256:5d0a0344abf06526c9d851326cbb80a162c459dad7d5465f438773e8992ba718" } ], "caution": true, "cleanAlternative": "OpenSearch (Apache-2.0) — the open drop-in fork of Elasticsearch.", "security": { "image": "ghcr.io/quenchworks/images/elasticsearch", "version": "9.4.4", "tag": "ghcr.io/quenchworks/images/elasticsearch:9.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.4.4", "tag": "ghcr.io/quenchworks/images/elasticsearch:9.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "emqx", "name": "emqx", "category": "Messaging", "summary": "Massively scalable, distributed MQTT broker for IoT, IIoT, and connected vehicles. Speaks MQTT 5.0 over TCP/TLS/websockets with a clustering engine and a web dashboard. Packaged from EMQX's official Erlang/OTP release. Licensed BSL 1.1 (single node free; clustering requires a commercial license).", "tier": "standard", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.5", "appVersion": "6.2.2", "description": "EMQX, the massively scalable distributed MQTT broker for IoT, IIoT, and connected vehicles (MQTT 5.0 over TCP, TLS, and websockets, with a web dashboard). Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. Runs as a StatefulSet with a persistent data volume. Licensed BSL 1.1 (single node free; clustering requires a commercial license).", "imageRepository": "ghcr.io/quenchworks/images/emqx", "imageDigest": "sha256:618646bdf882cff28aee50ca1ecaf196f7c5ade15c52d9ead72fc0e8c3070819", "repositoryID": "64f5a76a-7426-440d-9859-26d34d4d7473", "upstream": "https://www.emqx.io", "chartRef": "oci://ghcr.io/quenchworks/charts/emqx", "images": [ { "name": "emqx", "image": "ghcr.io/quenchworks/images/emqx@sha256:618646bdf882cff28aee50ca1ecaf196f7c5ade15c52d9ead72fc0e8c3070819" } ], "caution": true, "security": { "image": "ghcr.io/quenchworks/images/emqx", "version": "6.2.2", "tag": "ghcr.io/quenchworks/images/emqx:6.2.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "6.2.2", "tag": "ghcr.io/quenchworks/images/emqx:6.2.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "envoy", "name": "envoy", "category": "Gateway", "summary": "Cloud-native L7 proxy and communication bus, the data plane behind API gateways and service meshes. HTTP/gRPC routing, load balancing, rich observability, and an admin/health endpoint. The chart supplies the bootstrap config.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.38.1", "description": "Envoy, the CNCF high-performance L7 edge/service proxy. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a sensible default bootstrap so the pod is useful out-of-the-box.", "imageRepository": "ghcr.io/quenchworks/images/envoy", "imageDigest": "sha256:99cf0132c2d9521d564329f78512f5ba521d8e147a824bf64f3c27352efbc0af", "repositoryID": "54d769f7-dfed-4af0-b906-13ea462e9f0a", "port": 10000, "upstream": "https://www.envoyproxy.io", "chartRef": "oci://ghcr.io/quenchworks/charts/envoy", "images": [ { "name": "envoy", "image": "ghcr.io/quenchworks/images/envoy@sha256:99cf0132c2d9521d564329f78512f5ba521d8e147a824bf64f3c27352efbc0af" } ], "security": { "image": "ghcr.io/quenchworks/images/envoy", "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/envoy:1.38.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.38.1", "tag": "ghcr.io/quenchworks/images/envoy:1.38.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.37.1", "tag": "ghcr.io/quenchworks/images/envoy:1.37.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.36.4", "tag": "ghcr.io/quenchworks/images/envoy:1.36.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "etcd", "name": "etcd", "category": "Coordination", "summary": "Distributed, strongly consistent key-value store using Raft consensus. The backing store for Kubernetes and a building block for service coordination and config.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "3.7.1", "description": "Distributed, strongly consistent key-value store using Raft consensus. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/etcd", "imageDigest": "sha256:f3ddaeabc17db4deddc07aaf13a60351370a440934ecc929721a4a75e4f8282a", "repositoryID": "98517665-9758-4b43-aa34-1f32a092ab19", "upstream": "https://github.com/etcd-io/etcd", "chartRef": "oci://ghcr.io/quenchworks/charts/etcd", "images": [ { "name": "etcd", "image": "ghcr.io/quenchworks/images/etcd@sha256:f3ddaeabc17db4deddc07aaf13a60351370a440934ecc929721a4a75e4f8282a" } ], "security": { "image": "ghcr.io/quenchworks/images/etcd", "version": "3.7.1", "tag": "ghcr.io/quenchworks/images/etcd:3.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/etcd", "usr/bin/etcdutl" ] } ], "versions": [ { "version": "3.7.1", "tag": "ghcr.io/quenchworks/images/etcd:3.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/etcd", "usr/bin/etcdutl" ] } ] } ] } }, { "slug": "excalidraw", "name": "excalidraw", "category": "Apps & productivity", "summary": "Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or account required.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.18.1", "description": "Open-source virtual whiteboard for sketching hand-drawn-style diagrams, served as a static SPA. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/excalidraw", "imageDigest": "sha256:85ccb1fd7b34146ffecc67c3ded9cf814200a01863bab9922213988e6bb2ff51", "repositoryID": "034078d1-9a32-44da-b2e1-636b566e8dba", "port": 80, "upstream": "https://excalidraw.com", "chartRef": "oci://ghcr.io/quenchworks/charts/excalidraw", "images": [ { "name": "excalidraw", "image": "ghcr.io/quenchworks/images/excalidraw@sha256:85ccb1fd7b34146ffecc67c3ded9cf814200a01863bab9922213988e6bb2ff51" } ], "security": { "image": "ghcr.io/quenchworks/images/excalidraw", "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/excalidraw:0.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.18.1", "tag": "ghcr.io/quenchworks/images/excalidraw:0.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "external-secrets", "name": "external-secrets", "category": "Security & supply chain", "summary": "External Secrets Operator, the CNCF operator that syncs secrets from external APIs (AWS/GCP/Azure Secrets Manager, Vault, and many more) into Kubernetes Secrets. The single controller binary also serves the webhook and cert-controller, with every provider compiled in.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "2.8.0", "description": "External Secrets Operator: syncs secrets from external APIs (Vault, cloud secret managers, and more) into Kubernetes Secrets via ExternalSecret/SecretStore CRDs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Runs the single ESO binary as three deployments (controller, webhook, cert-controller); the cert-controller manages the webhook's self-signed CA, so no cert-manager dependency is required.", "imageRepository": "ghcr.io/quenchworks/images/external-secrets", "imageDigest": "sha256:103de9fbbcc8a4059bf216ad89562e358370605b46986ed21a48a79e5b7912e5", "repositoryID": "a43cf3cf-e802-4bd6-8910-40e27275bb18", "upstream": "https://external-secrets.io", "chartRef": "oci://ghcr.io/quenchworks/charts/external-secrets", "images": [ { "name": "external-secrets", "image": "ghcr.io/quenchworks/images/external-secrets@sha256:103de9fbbcc8a4059bf216ad89562e358370605b46986ed21a48a79e5b7912e5" } ], "security": { "image": "ghcr.io/quenchworks/images/external-secrets", "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ], "versions": [ { "version": "2.8.0", "tag": "ghcr.io/quenchworks/images/external-secrets:2.8.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/external-secrets" ] } ] } ] } }, { "slug": "ferretdb", "name": "FerretDB", "category": "Document", "summary": "MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. The clean-license substitute for MongoDB.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.7.0", "description": "MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/ferretdb", "imageDigest": "sha256:f61e374207f05beb027f1d5360a7f9a9c504a80e08b0f0bf942a13de0f92c558", "repositoryID": "f98e193b-63b5-44ff-a253-0be60665dfdd", "port": 27017, "upstream": "https://github.com/FerretDB/FerretDB", "chartRef": "oci://ghcr.io/quenchworks/charts/ferretdb", "images": [ { "name": "ferretdb", "image": "ghcr.io/quenchworks/images/ferretdb@sha256:f61e374207f05beb027f1d5360a7f9a9c504a80e08b0f0bf942a13de0f92c558" } ], "security": { "image": "ghcr.io/quenchworks/images/ferretdb", "version": "2.7.0", "tag": "ghcr.io/quenchworks/images/ferretdb:2.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ferretdb" ] } ], "versions": [ { "version": "2.7.0", "tag": "ghcr.io/quenchworks/images/ferretdb:2.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ferretdb" ] } ] } ] } }, { "slug": "filebrowser", "name": "filebrowser", "category": "Apps & productivity", "summary": "Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi base; data and served roots are volumes.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "2.63.17", "description": "Self-hosted web file manager (Go + embedded web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/filebrowser", "imageDigest": "sha256:3670cc55cdf28cd9fcb541bff747efd0f66ede4c8e702263135f32ca7d8a5942", "repositoryID": "e1537f00-10e7-462d-b5c8-542792ca9b78", "port": 80, "upstream": "https://filebrowser.org", "chartRef": "oci://ghcr.io/quenchworks/charts/filebrowser", "images": [ { "name": "filebrowser", "image": "ghcr.io/quenchworks/images/filebrowser@sha256:3670cc55cdf28cd9fcb541bff747efd0f66ede4c8e702263135f32ca7d8a5942" } ], "security": { "image": "ghcr.io/quenchworks/images/filebrowser", "version": "2.63.18", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.18", "critical": 1, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 3, "fixable": 0, "grade": "F", "score": 72, "cves": [ { "id": "CVE-2026-54089", "severity": "CRITICAL", "pkg": "github.com/filebrowser/filebrowser/v2", "installed": "2.63.18", "fixed": null, "title": "File Browser: Authentication Bypass via Proxy Auth Header Forgery", "url": "https://avd.aquasec.com/nvd/cve-2026-54089", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ], "versions": [ { "version": "2.63.18", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.18", "critical": 1, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 3, "fixable": 0, "grade": "F", "score": 72, "cves": [ { "id": "CVE-2026-54089", "severity": "CRITICAL", "pkg": "github.com/filebrowser/filebrowser/v2", "installed": "2.63.18", "fixed": null, "title": "File Browser: Authentication Bypass via Proxy Auth Header Forgery", "url": "https://avd.aquasec.com/nvd/cve-2026-54089", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ] }, { "version": "2.63.17", "tag": "ghcr.io/quenchworks/images/filebrowser:2.63.17", "critical": 1, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 3, "fixable": 0, "grade": "F", "score": 72, "cves": [ { "id": "CVE-2026-54089", "severity": "CRITICAL", "pkg": "github.com/filebrowser/filebrowser/v2", "installed": "2.63.17", "fixed": null, "title": "File Browser: Authentication Bypass via Proxy Auth Header Forgery", "url": "https://avd.aquasec.com/nvd/cve-2026-54089", "targets": [ "usr/bin/filebrowser" ] }, { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/filebrowser" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/filebrowser" ] } ] } ] } }, { "slug": "floci", "name": "floci", "category": "Apps & productivity", "summary": "Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image runs all 55 of Floci's in-process AWS services nonroot with no Docker socket, covering S3, DynamoDB, SQS, SNS, SES, IAM, STS, KMS, Secrets Manager, API Gateway, Cognito, Kinesis, CloudFormation, Step Functions, EventBridge, CloudWatch, Route53, and more. The 10 Docker-backed services (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune) need the host Docker socket plus root and are out of scope for this image.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.2.10", "appVersion": "1.5.34", "description": "Floci, the self-hosted, LocalStack-compatible local AWS emulator (Quarkus). This chart ships ONLY the in-process services (S3, DynamoDB, SQS, SNS, IAM) that run nonroot without a Docker socket; the Docker-backed services (Lambda, RDS, ECS, EKS, ...) are out of scope. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/floci", "imageDigest": "sha256:176ab5fde8c4f515e7d1f6e1c88906d7bc0b37531e4c268ddca79c3819ad37e8", "repositoryID": "3abdd874-e669-4028-8d15-dc03ef8ff2e7", "port": 4566, "upstream": "https://floci.io", "chartRef": "oci://ghcr.io/quenchworks/charts/floci", "images": [ { "name": "floci", "image": "ghcr.io/quenchworks/images/floci@sha256:176ab5fde8c4f515e7d1f6e1c88906d7bc0b37531e4c268ddca79c3819ad37e8" }, { "name": "floci-full", "image": "ghcr.io/quenchworks/images/floci-full@sha256:de65e07d085d55a89b605c446f20de0076b187b712b644da5c69937f956f2ec4" } ], "security": { "image": "ghcr.io/quenchworks/images/floci", "version": "1.5.33", "tag": "ghcr.io/quenchworks/images/floci:1.5.33", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.5.33", "tag": "ghcr.io/quenchworks/images/floci:1.5.33", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "fluent-bit", "name": "Fluent Bit", "category": "Observability", "summary": "Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "5.0.9", "description": "Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/fluent-bit", "imageDigest": "sha256:29822acfe2feb6d14a36aab8bf43bea8b6cb7191645640dcc012d30f6561345d", "repositoryID": "fc2e7de0-7393-4032-b7da-fe1c9600efec", "upstream": "https://github.com/fluent/fluent-bit", "chartRef": "oci://ghcr.io/quenchworks/charts/fluent-bit", "images": [ { "name": "fluent-bit", "image": "ghcr.io/quenchworks/images/fluent-bit@sha256:29822acfe2feb6d14a36aab8bf43bea8b6cb7191645640dcc012d30f6561345d" } ], "security": { "image": "ghcr.io/quenchworks/images/fluent-bit", "version": "5.0.9", "tag": "ghcr.io/quenchworks/images/fluent-bit:5.0.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "5.0.9", "tag": "ghcr.io/quenchworks/images/fluent-bit:5.0.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "forgejo", "name": "forgejo", "category": "Git", "summary": "Self-hosted lightweight Git forge (a community Gitea fork) with issues, PRs, CI, and packages. From source with the web UI embedded (no Node at runtime), CGO+static-musl SQLite, on a hardened nonroot Wolfi base; data lives on a writable volume.", "tier": "standard", "license": "GPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.5", "appVersion": "15.0.3", "description": "Self-hosted Git forge (Forgejo, a community Gitea fork; Go + embedded web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/forgejo", "imageDigest": "sha256:9a899439937c7c6827d2f9d98ddb8c11868a12aa23019fb7b526cc70ebeb37b8", "repositoryID": "b2a58170-c268-4196-bd76-98d277a71b2b", "port": 80, "upstream": "https://forgejo.org", "chartRef": "oci://ghcr.io/quenchworks/charts/forgejo", "images": [ { "name": "forgejo", "image": "ghcr.io/quenchworks/images/forgejo@sha256:9a899439937c7c6827d2f9d98ddb8c11868a12aa23019fb7b526cc70ebeb37b8" } ], "security": { "image": "ghcr.io/quenchworks/images/forgejo", "version": "15.0.3", "tag": "ghcr.io/quenchworks/images/forgejo:15.0.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ], "versions": [ { "version": "15.0.3", "tag": "ghcr.io/quenchworks/images/forgejo:15.0.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/forgejo" ] } ] } ] } }, { "slug": "garage", "name": "Garage", "category": "Object storage", "summary": "Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Licensed AGPL; runs well on modest hardware.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.9", "appVersion": "2.3.0", "description": "Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/garage", "imageDigest": "sha256:feb4e12d18725972ed9eb8a742367af18ecee8b2eaa6127f8294d9bf4a4ff55f", "repositoryID": "af8b9a72-f944-4df7-91fb-9fe3789113be", "port": 3900, "upstream": "https://github.com/deuxfleurs-org/garage", "chartRef": "oci://ghcr.io/quenchworks/charts/garage", "images": [ { "name": "garage", "image": "ghcr.io/quenchworks/images/garage@sha256:feb4e12d18725972ed9eb8a742367af18ecee8b2eaa6127f8294d9bf4a4ff55f" } ], "security": { "image": "ghcr.io/quenchworks/images/garage", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/garage:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/garage:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.2.0", "tag": "ghcr.io/quenchworks/images/garage:2.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/garage:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "ghost", "name": "ghost", "category": "Apps & productivity", "summary": "Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "6.54.1", "description": "Hardened Ghost publishing platform (Node.js CMS + membership/newsletter engine) on a 0-CVE nonroot image, with a bundled MariaDB backend.", "imageRepository": "ghcr.io/quenchworks/images/ghost", "imageDigest": "sha256:7f589269c38500a138264a5c0f73bc04588f186d9e461a022db6954fa84a78b3", "repositoryID": "5f3aa248-601d-446c-9838-0dd270fd9b4e", "port": 2368, "upstream": "https://ghost.org", "chartRef": "oci://ghcr.io/quenchworks/charts/ghost", "images": [ { "name": "ghost", "image": "ghcr.io/quenchworks/images/ghost@sha256:7f589269c38500a138264a5c0f73bc04588f186d9e461a022db6954fa84a78b3" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:abf1c0823dcc7f2c1b77252defaa0202a386907d131e3ea62feb0bb07304a0f5" } ], "security": { "image": "ghcr.io/quenchworks/images/ghost", "version": "6.54.1", "tag": "ghcr.io/quenchworks/images/ghost:6.54.1", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 0, "grade": "D", "score": 76, "cves": [ { "id": "CVE-2020-8203", "severity": "HIGH", "pkg": "lodash.pick", "installed": "4.4.0", "fixed": null, "title": "nodejs-lodash: prototype pollution in zipObjectDeep function", "url": "https://avd.aquasec.com/nvd/cve-2020-8203", "targets": [ "Node.js" ] }, { "id": "CVE-2022-37620", "severity": "HIGH", "pkg": "html-minifier", "installed": "4.0.0", "fixed": null, "title": "kangax html-minifier REDoS vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2022-37620", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] } ], "versions": [ { "version": "6.54.1", "tag": "ghcr.io/quenchworks/images/ghost:6.54.1", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 0, "total": 3, "fixable": 0, "grade": "D", "score": 76, "cves": [ { "id": "CVE-2020-8203", "severity": "HIGH", "pkg": "lodash.pick", "installed": "4.4.0", "fixed": null, "title": "nodejs-lodash: prototype pollution in zipObjectDeep function", "url": "https://avd.aquasec.com/nvd/cve-2020-8203", "targets": [ "Node.js" ] }, { "id": "CVE-2022-37620", "severity": "HIGH", "pkg": "html-minifier", "installed": "4.0.0", "fixed": null, "title": "kangax html-minifier REDoS vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2022-37620", "targets": [ "Node.js" ] }, { "id": "GHSA-984p-xq9m-4rjw", "severity": "MEDIUM", "pkg": "express-brute", "installed": "1.0.1", "fixed": null, "title": "Rate Limiting Bypass in express-brute", "url": "https://github.com/advisories/GHSA-984p-xq9m-4rjw", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "gitea", "name": "Gitea", "category": "Git", "summary": "Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). A low-footprint GitHub alternative.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "1.27.1", "description": "Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/gitea", "imageDigest": "sha256:affb9f2aabdce981a175f8b3f48bf1bc0ee71f3e94a7e808b33aca07c3e6dad0", "repositoryID": "7fc07dfc-0e91-4ef3-ba34-5cc905c8195e", "port": 3000, "upstream": "https://github.com/go-gitea/gitea", "chartRef": "oci://ghcr.io/quenchworks/charts/gitea", "images": [ { "name": "gitea", "image": "ghcr.io/quenchworks/images/gitea@sha256:affb9f2aabdce981a175f8b3f48bf1bc0ee71f3e94a7e808b33aca07c3e6dad0" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" } ], "security": { "image": "ghcr.io/quenchworks/images/gitea", "version": "1.27.1", "tag": "ghcr.io/quenchworks/images/gitea:1.27.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ], "versions": [ { "version": "1.27.1", "tag": "ghcr.io/quenchworks/images/gitea:1.27.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gitea" ] } ] } ] } }, { "slug": "gotify", "name": "gotify", "category": "Messaging", "summary": "Self-hosted server for sending and receiving real-time push messages over WebSocket, with a web UI and app tokens. From source (UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; data on a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "2.9.1", "description": "Self-hosted push-notification server (Go + embedded web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/gotify", "imageDigest": "sha256:af3f894c8baa2f15b95d7fafe687f55960e894cfb9bc7283c0676e5ada858eb5", "repositoryID": "b4e0d38e-b686-45f6-bf7c-1d81ed56cd84", "port": 80, "upstream": "https://gotify.net", "chartRef": "oci://ghcr.io/quenchworks/charts/gotify", "images": [ { "name": "gotify", "image": "ghcr.io/quenchworks/images/gotify@sha256:af3f894c8baa2f15b95d7fafe687f55960e894cfb9bc7283c0676e5ada858eb5" } ], "security": { "image": "ghcr.io/quenchworks/images/gotify", "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/gotify:2.9.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gotify" ] } ], "versions": [ { "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/gotify:2.9.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/gotify" ] } ] } ] } }, { "slug": "grafana", "name": "Grafana", "category": "Datastore", "summary": "Hardened grafana image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "13.1.0", "description": "Dashboards and visualization for metrics, logs, and traces across many data sources. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/grafana", "imageDigest": "sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995", "repositoryID": "cb635e07-c5aa-4bb7-b199-892dabe82aca", "port": 3000, "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/grafana", "images": [ { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995" } ], "security": null }, { "slug": "graylog", "name": "graylog", "category": "Observability", "summary": "Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs). Built clean-room on a hardened Wolfi JRE (nonroot, read-only rootfs); the chart provides MongoDB (metadata) and OpenSearch (log storage) backends. Graylog Server is SSPL-1.0 (source-available, not OSI-approved).", "tier": "standard", "license": "SSPL-1.0", "licenseClean": "caution", "chartVersion": "0.0.5", "appVersion": "7.1.6", "description": "Hardened Graylog log management server on a 0-CVE nonroot image, with bundled MongoDB (config/metadata) and OpenSearch (log storage) backends. NOTE the SSPL-1.0 license (source-available, not OSI-approved).", "imageRepository": "ghcr.io/quenchworks/images/graylog", "imageDigest": "sha256:c151b6b951b1b15a232ad74c839f4cb0603b0020c2721e25baefeffba6053904", "repositoryID": "85097b02-99d9-46a5-bc88-e9b36f3e4f89", "port": 9000, "upstream": "https://www.graylog.org", "chartRef": "oci://ghcr.io/quenchworks/charts/graylog", "images": [ { "name": "graylog", "image": "ghcr.io/quenchworks/images/graylog@sha256:c151b6b951b1b15a232ad74c839f4cb0603b0020c2721e25baefeffba6053904" }, { "name": "mongodb", "image": "ghcr.io/quenchworks/images/mongodb@sha256:04f1aa4d1229531ec267e8ca59253500079d04e79933755f725ad7ae65bc2e83" }, { "name": "opensearch", "image": "ghcr.io/quenchworks/images/opensearch@sha256:35048e73302f817d1bed340a317b41ec8a7d709a3cd55c75b90d8a61faf75d3b" } ], "caution": true, "security": { "image": "ghcr.io/quenchworks/images/graylog", "version": "7.1.6", "tag": "ghcr.io/quenchworks/images/graylog:7.1.6", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "C", "score": 96, "cves": [ { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ], "versions": [ { "version": "7.1.6", "tag": "ghcr.io/quenchworks/images/graylog:7.1.6", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "C", "score": 96, "cves": [ { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] } ] } }, { "slug": "haproxy", "name": "HAProxy", "category": "Gateway", "summary": "High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "3.4.0", "description": "High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/haproxy", "imageDigest": "sha256:e5778500d8bd53a08f37f5471b9672dc9f3c5252e08047a80626ac81669a9d65", "repositoryID": "528a20e1-beb3-49e9-8013-fa0478dd0f84", "port": 8080, "upstream": "https://github.com/haproxy/haproxy", "chartRef": "oci://ghcr.io/quenchworks/charts/haproxy", "images": [ { "name": "haproxy", "image": "ghcr.io/quenchworks/images/haproxy@sha256:e5778500d8bd53a08f37f5471b9672dc9f3c5252e08047a80626ac81669a9d65" } ], "security": { "image": "ghcr.io/quenchworks/images/haproxy", "version": "3.4.0", "tag": "ghcr.io/quenchworks/images/haproxy:3.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.4.0", "tag": "ghcr.io/quenchworks/images/haproxy:3.4.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.3.10", "tag": "ghcr.io/quenchworks/images/haproxy:3.3.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.2.19", "tag": "ghcr.io/quenchworks/images/haproxy:3.2.19", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "harbor", "name": "harbor", "category": "Datastore", "summary": "Hardened harbor image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "2.15.2", "description": "Cloud-native OCI registry with role-based access control, replication, vulnerability scanning, and image signing. This umbrella chart wires seven QuenchWorks Harbor component images (core, jobservice, registry, registryctl, portal, the optional Trivy scan adapter, and the metrics exporter) over the QuenchWorks PostgreSQL and Valkey charts, each a minimal, nonroot, 0-CVE image pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/harbor", "repositoryID": "2f885f06-90d5-4097-9614-6d668187e5a7", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/harbor", "images": [ { "name": "harbor-core", "image": "ghcr.io/quenchworks/images/harbor-core@sha256:c806fab759c58469ea44f24ee54e422d35f1bd4f780dab49d16586c5a2063040" }, { "name": "harbor-jobservice", "image": "ghcr.io/quenchworks/images/harbor-jobservice@sha256:b5e6a85c526d410d6ae18e0024e74b132844ecbbd7447f6df8888ae4004cac5d" }, { "name": "harbor-registry", "image": "ghcr.io/quenchworks/images/harbor-registry@sha256:53db54b5aa2e74cef404f389c79895ba11ae81733df875783198de47d3a50f21" }, { "name": "harbor-registryctl", "image": "ghcr.io/quenchworks/images/harbor-registryctl@sha256:05a93b6837f9d66c9e60ab953bf8f7785602114db8c1fe9dbad29c944416b2d9" }, { "name": "harbor-portal", "image": "ghcr.io/quenchworks/images/harbor-portal@sha256:85809ac40b4f954149daa33a5abde6c62109e199dbe99afbf07a48d7e4bb41ba" }, { "name": "harbor-trivy-adapter", "image": "ghcr.io/quenchworks/images/harbor-trivy-adapter@sha256:c60421a4a95a097c4dce82e36dd6978e56f82b065ee22e834277ac864816c6c8" }, { "name": "harbor-exporter", "image": "ghcr.io/quenchworks/images/harbor-exporter@sha256:d7467b826dd8190c346c81542d0e6dd19559abe0615b6ca25819b9f0c51a8972" }, { "name": "nginx", "image": "ghcr.io/quenchworks/images/nginx@sha256:b2c2dda9d5762212b53079e2223e6055ea689bebdd0b3926220c86d772add903" }, { "name": "busybox", "image": "ghcr.io/quenchworks/images/busybox@sha256:379b162cd4794ee14c63fec0cc501b855b804f33f824c4e46ced6183f644adfe" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" }, { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:4482926665b4e9fbe73b6ab15e403e1f4d9285112aca313ce4994095346c6565" } ], "security": null }, { "slug": "harbor-observability", "name": "Harbor observability", "category": "Datastore", "summary": "Hardened harbor-observability image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "2.14.4", "description": "Monitoring stack for a QuenchWorks Harbor registry. This meta-chart deploys the QuenchWorks Prometheus and Grafana charts preconfigured for Harbor, with Prometheus scraping the harbor-exporter and the core, registry, and jobservice metrics endpoints, and Grafana provisioned with a Prometheus datasource and a Harbor dashboard covering request rate, component health, garbage collection, quota, and the task queue. All images are nonroot, 0-CVE, and pinned by digest through the sub-charts.", "imageRepository": "ghcr.io/quenchworks/images/harbor-observability", "repositoryID": "f5b2571f-37a6-47f2-bf0a-3017fe76e65c", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/harbor-observability", "images": [ { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:d5708594a12a4178014daaee6110348b6186f8812abd9241f6691d62e3663214" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995" } ], "security": null }, { "slug": "headscale", "name": "headscale", "category": "Coordination & mesh", "summary": "Open-source, self-hosted implementation of the Tailscale control server for coordinating a WireGuard mesh. Single static Go binary on a hardened nonroot Wolfi base; config and state on writable volumes.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.29.2", "description": "Self-hosted, open-source implementation of the Tailscale control server (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/headscale", "imageDigest": "sha256:84fdca10e8e309e0ccae939a07a961fc9e18a63925d4cc8b6aeed9bbdb81afe0", "repositoryID": "a9a7bfd6-1030-4fb3-bee6-19b08814bf44", "port": 8080, "upstream": "https://github.com/juanfont/headscale", "chartRef": "oci://ghcr.io/quenchworks/charts/headscale", "images": [ { "name": "headscale", "image": "ghcr.io/quenchworks/images/headscale@sha256:84fdca10e8e309e0ccae939a07a961fc9e18a63925d4cc8b6aeed9bbdb81afe0" } ], "security": { "image": "ghcr.io/quenchworks/images/headscale", "version": "0.29.2", "tag": "ghcr.io/quenchworks/images/headscale:0.29.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/headscale" ] } ], "versions": [ { "version": "0.29.2", "tag": "ghcr.io/quenchworks/images/headscale:0.29.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/headscale" ] } ] } ] } }, { "slug": "httpd", "name": "httpd", "category": "Gateway", "summary": "Apache HTTP Server, the long-standing open-source web server and reverse proxy for serving static content and fronting application backends (mod_proxy).", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "2.4.68", "description": "Apache HTTP Server for serving static content and fronting application backends as a reverse proxy. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image built from source, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/httpd", "imageDigest": "sha256:9e886be8fb82062f440fbd46e92ade34b465a4c5103dbc91041efd7a43be1efc", "repositoryID": "e585d62d-d42a-4ad8-af1c-c8680cc45ee2", "port": 8080, "upstream": "https://github.com/apache/httpd", "chartRef": "oci://ghcr.io/quenchworks/charts/httpd", "images": [ { "name": "httpd", "image": "ghcr.io/quenchworks/images/httpd@sha256:9e886be8fb82062f440fbd46e92ade34b465a4c5103dbc91041efd7a43be1efc" } ], "security": { "image": "ghcr.io/quenchworks/images/httpd", "version": "2.4.68", "tag": "ghcr.io/quenchworks/images/httpd:2.4.68", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.4.68", "tag": "ghcr.io/quenchworks/images/httpd:2.4.68", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "identity-stack", "name": "identity-stack", "category": "Stacks", "summary": "Hardened, operator-free self-hosted SSO/identity stack: Keycloak (OIDC/SAML identity provider) + PostgreSQL (Keycloak's database) + oauth2-proxy (an auth proxy you place in front of any upstream app to authenticate users against Keycloak), wired together so you get single sign-on in front of your apps out of the box.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "1.0.0", "description": "Hardened, operator-free self-hosted SSO/identity stack: Keycloak (OIDC/SAML identity provider) + PostgreSQL (Keycloak's database) + oauth2-proxy (an auth proxy you place in front of any upstream app to authenticate users against Keycloak), wired together so you get single sign-on in front of your apps out of the box. No operator, no CRDs. All components are QuenchWorks-hardened, nonroot, 0-CVE images pinned by digest and cosign-signed.", "repositoryID": "9a0c364f-4e7b-4fac-adc3-559b1865e28b", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/identity-stack", "stack": true, "components": [ "keycloak", "oauth2-proxy" ], "images": [ { "name": "keycloak", "image": "ghcr.io/quenchworks/images/keycloak@sha256:2c33374f5bd1ac44a52016ee8af0d4f3a0a7ed181bddbb7a4224b58c176af5c5" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" }, { "name": "oauth2-proxy", "image": "ghcr.io/quenchworks/images/oauth2-proxy@sha256:73496afee746deab63d06f404ba8e4057835a2f8b007365129c3c02840a360ac" } ], "upstreams": [ "https://github.com/keycloak/keycloak", "https://github.com/oauth2-proxy/oauth2-proxy", "https://github.com/postgres/postgres" ], "security": null }, { "slug": "influxdb", "name": "InfluxDB", "category": "Time series", "summary": "Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.9.1", "description": "Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/influxdb", "imageDigest": "sha256:fc6dc0f07e9f900fb698b24a8a1cc751aa971fb4c473f41f0f2c7c8bfa25c2aa", "repositoryID": "d50fd427-8fa1-4a5f-8d23-71f1c7d61a06", "port": 8086, "upstream": "https://github.com/influxdata/influxdb", "chartRef": "oci://ghcr.io/quenchworks/charts/influxdb", "images": [ { "name": "influxdb", "image": "ghcr.io/quenchworks/images/influxdb@sha256:fc6dc0f07e9f900fb698b24a8a1cc751aa971fb4c473f41f0f2c7c8bfa25c2aa" } ], "security": { "image": "ghcr.io/quenchworks/images/influxdb", "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/influxdb:2.9.1", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 1, "total": 2, "fixable": 0, "grade": "C", "score": 94, "cves": [ { "id": "CVE-2024-28180", "severity": "MEDIUM", "pkg": "gopkg.in/square/go-jose.v2", "installed": "v2.5.1", "fixed": null, "title": "jose-go: improper handling of highly compressed data", "url": "https://avd.aquasec.com/nvd/cve-2024-28180", "targets": [ "usr/bin/influxd" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/influxd" ] } ], "versions": [ { "version": "2.9.1", "tag": "ghcr.io/quenchworks/images/influxdb:2.9.1", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 1, "total": 2, "fixable": 0, "grade": "C", "score": 94, "cves": [ { "id": "CVE-2024-28180", "severity": "MEDIUM", "pkg": "gopkg.in/square/go-jose.v2", "installed": "v2.5.1", "fixed": null, "title": "jose-go: improper handling of highly compressed data", "url": "https://avd.aquasec.com/nvd/cve-2024-28180", "targets": [ "usr/bin/influxd" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/influxd" ] } ] } ] } }, { "slug": "ingress-nginx", "name": "ingress-nginx", "category": "Gateway", "summary": "The Kubernetes NGINX Ingress Controller. Routes external HTTP/HTTPS traffic to in-cluster Services via Ingress resources, with TLS termination, path/host routing, and an admission webhook. The chart wires its RBAC, IngressClass, and webhook.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "1.15.8", "description": "Ingress NGINX Controller: the Kubernetes-maintained Ingress controller built on NGINX. Watches Ingress resources of the nginx IngressClass and configures NGINX to load-balance and route HTTP/HTTPS traffic to backend Services, with a validating admission webhook that rejects malformed Ingress objects before they are persisted. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. The controller runs as a single Deployment; the admission webhook's serving certificate is bootstrapped by a self-contained pre/post-install Job pair (no external cert-manager dependency).", "imageRepository": "ghcr.io/quenchworks/images/ingress-nginx", "imageDigest": "sha256:3f88b7c56cf30d630f367c0175477af5ac406a1145a7d3d0225a8c53f23e99b8", "repositoryID": "1f5e0727-cf7e-4b35-8cd1-e58c15da8d10", "upstream": "https://kubernetes.github.io/ingress-nginx", "chartRef": "oci://ghcr.io/quenchworks/charts/ingress-nginx", "images": [ { "name": "ingress-nginx-controller", "image": "ghcr.io/quenchworks/images/ingress-nginx@sha256:3f88b7c56cf30d630f367c0175477af5ac406a1145a7d3d0225a8c53f23e99b8" } ], "security": { "image": "ghcr.io/quenchworks/images/ingress-nginx", "version": "1.15.8", "tag": "ghcr.io/quenchworks/images/ingress-nginx:1.15.8", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 2, "total": 4, "fixable": 4, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.37.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.8-r8.spdx.json" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.8-r8.spdx.json" ] } ], "versions": [ { "version": "1.15.8", "tag": "ghcr.io/quenchworks/images/ingress-nginx:1.15.8", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 2, "total": 4, "fixable": 4, "grade": "D", "score": 56, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.37.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.8-r8.spdx.json" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/nginx-ingress-controller", "var/lib/db/sbom/ingress-nginx-controller-1.15-1.15.8-r8.spdx.json" ] } ] } ] } }, { "slug": "jaeger", "name": "jaeger", "category": "Observability", "summary": "Distributed tracing platform (Jaeger v2, OpenTelemetry-collector based) with an embedded query UI. From source on a hardened nonroot Wolfi base; in-memory storage by default, badger under a volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "2.19.0", "description": "Jaeger v2 all-in-one distributed tracing (OpenTelemetry-collector based): OTLP ingestion plus the Jaeger query UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/jaeger", "imageDigest": "sha256:c7584ec45b12de93b944adc4b5d436019751ff99bab346a36e3fac786fecd274", "repositoryID": "e203b6b0-71c6-4cf1-a66e-7c72e685e90c", "upstream": "https://www.jaegertracing.io", "chartRef": "oci://ghcr.io/quenchworks/charts/jaeger", "images": [ { "name": "jaeger", "image": "ghcr.io/quenchworks/images/jaeger@sha256:c7584ec45b12de93b944adc4b5d436019751ff99bab346a36e3fac786fecd274" } ], "security": { "image": "ghcr.io/quenchworks/images/jaeger", "version": "2.19.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ], "versions": [ { "version": "2.19.0", "tag": "ghcr.io/quenchworks/images/jaeger:2.19.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/jaeger" ] } ] } ] } }, { "slug": "jenkins", "name": "jenkins", "category": "CI/CD & registry", "summary": "The leading open-source automation server for building, testing, and deploying software, with thousands of plugins. Ships the architecture-independent jenkins.war LTS line on a hardened Wolfi JRE.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "2.572", "description": "Jenkins, the leading open-source automation server for building, testing, and deploying software (CI/CD pipelines, Pipeline-as-Code, and a vast plugin ecosystem). Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. Runs as a single-replica StatefulSet with a persistent JENKINS_HOME volume.", "imageRepository": "ghcr.io/quenchworks/images/jenkins", "imageDigest": "sha256:ba641c1981ee3c70c53ae0e1fd2dc84a8f0794a3a6da0f425b5605ac4708cd25", "repositoryID": "c0cb7878-34a9-4d7f-9740-f5f1e208aa0a", "upstream": "https://www.jenkins.io", "chartRef": "oci://ghcr.io/quenchworks/charts/jenkins", "images": [ { "name": "jenkins", "image": "ghcr.io/quenchworks/images/jenkins@sha256:ba641c1981ee3c70c53ae0e1fd2dc84a8f0794a3a6da0f425b5605ac4708cd25" } ], "security": { "image": "ghcr.io/quenchworks/images/jenkins", "version": "2.572", "tag": "ghcr.io/quenchworks/images/jenkins:2.572", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "C", "score": 96, "cves": [ { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ], "versions": [ { "version": "2.572", "tag": "ghcr.io/quenchworks/images/jenkins:2.572", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "C", "score": 96, "cves": [ { "id": "CVE-2025-48924", "severity": "MEDIUM", "pkg": "commons-lang:commons-lang", "installed": "2.6", "fixed": null, "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "url": "https://avd.aquasec.com/nvd/cve-2025-48924", "targets": [ "Java" ] } ] } ] } }, { "slug": "kafka", "name": "Kafka", "category": "Messaging", "summary": "Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "4.3.1", "description": "Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/kafka", "imageDigest": "sha256:494e320e90e532f34b5ae0135c60d3567e55e031fb023a4f4085beb6b1772039", "repositoryID": "b21be4d8-c990-4c5c-bab3-1a45e95740e0", "port": 9092, "upstream": "https://github.com/apache/kafka", "chartRef": "oci://ghcr.io/quenchworks/charts/kafka", "images": [ { "name": "kafka", "image": "ghcr.io/quenchworks/images/kafka@sha256:494e320e90e532f34b5ae0135c60d3567e55e031fb023a4f4085beb6b1772039" } ], "security": { "image": "ghcr.io/quenchworks/images/kafka", "version": "4.3.1", "tag": "ghcr.io/quenchworks/images/kafka:4.3.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.3.1", "tag": "ghcr.io/quenchworks/images/kafka:4.3.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "keycloak", "name": "Keycloak", "category": "Identity", "summary": "Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "26.7.0", "description": "Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/keycloak", "imageDigest": "sha256:fbb91104b4da73ca9f3117874fb1c343dd208e9ea5a25e118c0d10f5f28a8db2", "repositoryID": "adb521a3-9e2e-43f7-b6d7-c4bd417df884", "port": 8080, "upstream": "https://github.com/keycloak/keycloak", "chartRef": "oci://ghcr.io/quenchworks/charts/keycloak", "images": [ { "name": "keycloak", "image": "ghcr.io/quenchworks/images/keycloak@sha256:fbb91104b4da73ca9f3117874fb1c343dd208e9ea5a25e118c0d10f5f28a8db2" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" } ], "security": { "image": "ghcr.io/quenchworks/images/keycloak", "version": "26.7.0", "tag": "ghcr.io/quenchworks/images/keycloak:26.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "26.7.0", "tag": "ghcr.io/quenchworks/images/keycloak:26.7.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "kuma", "name": "kuma", "category": "Coordination & mesh", "summary": "CNCF service mesh control plane (Envoy-based) for multi-zone and multi-cluster meshes. Ships kuma-cp and kumactl with an embedded GUI, built from source on a hardened nonroot Wolfi base; default in-memory store runs standalone.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "2.14.0", "description": "Kuma service mesh control plane (kuma-cp). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. This chart runs a single standalone control plane with the in-memory store (no external DB, no CRDs) for demos and small universal-mode setups.", "imageRepository": "ghcr.io/quenchworks/images/kuma", "imageDigest": "sha256:3ccbf3268792cd2500ff68851c008c995ba4e881679524bc63280130f0480cb4", "repositoryID": "dcdb4012-6d7d-4688-a196-c6b78ae637a6", "upstream": "https://kuma.io", "chartRef": "oci://ghcr.io/quenchworks/charts/kuma", "images": [ { "name": "kuma", "image": "ghcr.io/quenchworks/images/kuma@sha256:3ccbf3268792cd2500ff68851c008c995ba4e881679524bc63280130f0480cb4" } ], "security": { "image": "ghcr.io/quenchworks/images/kuma", "version": "2.14.0", "tag": "ghcr.io/quenchworks/images/kuma:2.14.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ], "versions": [ { "version": "2.14.0", "tag": "ghcr.io/quenchworks/images/kuma:2.14.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/kuma-cp", "usr/bin/kumactl" ] } ] } ] } }, { "slug": "lgtm-stack", "name": "lgtm-stack", "category": "Stacks", "summary": "Hardened, operator-free LGTM observability superset in one install: Loki (logs) + Grafana (the single pane) + Tempo (traces) + VictoriaMetrics (Prometheus-compatible metrics) + an OpenTelemetry Collector (OTLP ingest) + Alertmanager.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.0.0", "description": "Hardened, operator-free LGTM observability superset in one install: Loki (logs) + Grafana (the single pane) + Tempo (traces) + VictoriaMetrics (Prometheus-compatible metrics) + an OpenTelemetry Collector (OTLP ingest) + Alertmanager. Grafana gets three pre-provisioned datasources — VictoriaMetrics (default), Loki, Tempo — so metrics, logs and traces are explorable side by side out of the box. VictoriaMetrics scrapes pods via annotation-based service discovery; Vector ships every pod's logs to Loki; apps send OTLP traces to the collector, which forwards to Tempo. No operator, no CRDs. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed. node-exporter and Vector take host access by design (cluster metrics + logs); both are toggleable.", "repositoryID": "69ed1b3c-ab58-474a-828b-f64cf9dff72e", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/lgtm-stack", "stack": true, "components": [ "victoriametrics", "loki", "grafana", "tempo", "alertmanager" ], "images": [ { "name": "victoriametrics", "image": "ghcr.io/quenchworks/images/victoriametrics@sha256:7fab85e512dd34a3dab5c760f1bbae1acfc01d85053cdbf26d7599985ee75820" }, { "name": "loki", "image": "ghcr.io/quenchworks/images/loki@sha256:3409d6b1fa72af5034327920ae24a20d2d6693f90de3a098c5683f228115191d" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995" }, { "name": "tempo", "image": "ghcr.io/quenchworks/images/tempo@sha256:2da185a3d2d088a20a975e8bb8a1c1e6522213bda5975380ea0bc01b4779b775" }, { "name": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager@sha256:862b251add3271174a224ebdad736056162ebfe4eb55318a013aa89c50304f33" }, { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:ed19a525ab80c31f8997e417fbc669fca4bed5c8748264d5f24a99d5d1dcec83" }, { "name": "vector", "image": "ghcr.io/quenchworks/images/vector@sha256:4d67202d12a453b1347b271982b54dde292563235b6bc3500f2cf23579ba2df2" }, { "name": "kube-state-metrics", "image": "ghcr.io/quenchworks/images/kube-state-metrics@sha256:210a2dcb84a2589f3629dad3be847421dde941fc3181ceede61996289cd76fe3" }, { "name": "node-exporter", "image": "ghcr.io/quenchworks/images/node-exporter@sha256:4c3735371055cea29cf1ed3250a2b2a7cb4a4ddcdd26ae378619ceddb2966a16" } ], "upstreams": [ "https://github.com/VictoriaMetrics/VictoriaMetrics", "https://github.com/grafana/loki", "https://github.com/grafana/grafana", "https://github.com/grafana/tempo", "https://github.com/prometheus/alertmanager", "https://github.com/open-telemetry/opentelemetry-collector", "https://github.com/vectordotdev/vector", "https://github.com/kubernetes/kube-state-metrics", "https://github.com/prometheus/node_exporter" ], "security": null }, { "slug": "livekit", "name": "livekit", "category": "Media & streaming", "summary": "WebRTC SFU server for scalable real-time audio, video, and data. Single static Go binary on a hardened nonroot Wolfi base; config via mounted YAML or LIVEKIT_ env.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.13.4", "description": "LiveKit, the open-source WebRTC SFU for scalable real-time audio, video, and data. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. This chart runs a single-node (no-Redis) server for dev and small deployments.", "imageRepository": "ghcr.io/quenchworks/images/livekit", "imageDigest": "sha256:6fd6e07ed2927bdae925ad694f5c557beebc28f27cd533c50ca14d164de2c316", "repositoryID": "db675eb1-b78b-4077-a204-684a0ee25435", "port": 7880, "upstream": "https://livekit.io", "chartRef": "oci://ghcr.io/quenchworks/charts/livekit", "images": [ { "name": "livekit", "image": "ghcr.io/quenchworks/images/livekit@sha256:6fd6e07ed2927bdae925ad694f5c557beebc28f27cd533c50ca14d164de2c316" } ], "security": { "image": "ghcr.io/quenchworks/images/livekit", "version": "1.13.4", "tag": "ghcr.io/quenchworks/images/livekit:1.13.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/livekit-server" ] } ], "versions": [ { "version": "1.13.4", "tag": "ghcr.io/quenchworks/images/livekit:1.13.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/livekit-server" ] } ] } ] } }, { "slug": "logging-stack", "name": "logging-stack", "category": "Stacks", "summary": "Hardened, operator-free logging stack: Loki + Grafana + Vector, wired together for cluster log aggregation and browsing.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.0.0", "description": "Hardened, operator-free logging stack: Loki + Grafana + Vector, wired together for cluster log aggregation and browsing. Vector ships every pod's logs to Loki; Grafana queries Loki through a pre-provisioned datasource with a ready-made logs dashboard. No CRDs, no logging operator. All components are QuenchWorks-hardened, nonroot, 0-CVE images pinned by digest and cosign-signed. Vector runs as a host DaemonSet (read-only node log dirs) by design — that is the deliberate, toggleable trade-off for a log shipper.", "repositoryID": "09e18838-4b6d-4c27-ad7c-708b3aff8bc2", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/logging-stack", "stack": true, "components": [ "loki", "grafana" ], "images": [ { "name": "loki", "image": "ghcr.io/quenchworks/images/loki@sha256:3409d6b1fa72af5034327920ae24a20d2d6693f90de3a098c5683f228115191d" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995" }, { "name": "vector", "image": "ghcr.io/quenchworks/images/vector@sha256:4d67202d12a453b1347b271982b54dde292563235b6bc3500f2cf23579ba2df2" } ], "upstreams": [ "https://github.com/grafana/loki", "https://github.com/grafana/grafana", "https://github.com/vectordotdev/vector" ], "security": null }, { "slug": "loki", "name": "Loki", "category": "Observability", "summary": "Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Like Prometheus, but for logs. Licensed AGPL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.14", "appVersion": "3.7.4", "description": "Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/loki", "imageDigest": "sha256:8ad6b4a777ce3b35eec4b51cb61fe2e703a4404134391d723aee1a0c6a73431f", "repositoryID": "c8319a5d-340f-4475-a05f-886c884c8b7d", "port": 3100, "upstream": "https://github.com/grafana/loki", "chartRef": "oci://ghcr.io/quenchworks/charts/loki", "images": [ { "name": "loki", "image": "ghcr.io/quenchworks/images/loki@sha256:8ad6b4a777ce3b35eec4b51cb61fe2e703a4404134391d723aee1a0c6a73431f" } ], "security": { "image": "ghcr.io/quenchworks/images/loki", "version": "3.7.4", "tag": "ghcr.io/quenchworks/images/loki:3.7.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] } ], "versions": [ { "version": "3.7.4", "tag": "ghcr.io/quenchworks/images/loki:3.7.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/logcli", "usr/bin/loki" ] } ] } ] } }, { "slug": "mariadb", "name": "MariaDB", "category": "Relational", "summary": "Community-developed relational database and drop-in MySQL successor, GPL-licensed and fully open. Default MySQL-compatible engine for the catalog.", "tier": "critical", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "12.3.2", "description": "Community-developed relational database and drop-in MySQL successor, GPL-licensed and fully open. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mariadb", "imageDigest": "sha256:de7f6d2143a534b7882d292a494f359bf4c7003b8f12598a97a424a1d5da354d", "repositoryID": "2c24b359-787b-44bc-9261-d43eb1f03ffe", "port": 3306, "upstream": "https://github.com/MariaDB/server", "chartRef": "oci://ghcr.io/quenchworks/charts/mariadb", "images": [ { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:de7f6d2143a534b7882d292a494f359bf4c7003b8f12598a97a424a1d5da354d" } ], "security": { "image": "ghcr.io/quenchworks/images/mariadb", "version": "12.3.2", "tag": "ghcr.io/quenchworks/images/mariadb:12.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "12.3.2", "tag": "ghcr.io/quenchworks/images/mariadb:12.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "11.8.8", "tag": "ghcr.io/quenchworks/images/mariadb:11.8.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "11.4.12", "tag": "ghcr.io/quenchworks/images/mariadb:11.4.12", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mattermost", "name": "mattermost", "category": "Messaging", "summary": "Open-source, self-hosted team messaging and collaboration platform (a Slack alternative) with channels, direct messages, file sharing, and integrations. Packaged from Mattermost's official Team Edition server release; requires an external PostgreSQL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.11", "appVersion": "11.9.0", "description": "Open-source, self-hosted team collaboration and messaging platform (Team Edition) — channels, direct messages, and file sharing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Bundles PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/mattermost", "imageDigest": "sha256:fbd623821cab4daadfbedfdebad2235e20d6f646824c2c3bcafaf9a54aa2d3a6", "repositoryID": "07d405ed-b843-469d-be0b-6a11a9ff963e", "port": 8065, "upstream": "https://mattermost.com", "chartRef": "oci://ghcr.io/quenchworks/charts/mattermost", "images": [ { "name": "mattermost", "image": "ghcr.io/quenchworks/images/mattermost@sha256:fbd623821cab4daadfbedfdebad2235e20d6f646824c2c3bcafaf9a54aa2d3a6" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" } ], "security": { "image": "ghcr.io/quenchworks/images/mattermost", "version": "11.9.0", "tag": "ghcr.io/quenchworks/images/mattermost:11.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ], "versions": [ { "version": "11.9.0", "tag": "ghcr.io/quenchworks/images/mattermost:11.9.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "opt/mattermost/bin/mattermost", "opt/mattermost/bin/mmctl" ] } ] } ] } }, { "slug": "mediamtx", "name": "mediamtx", "category": "Media & streaming", "summary": "Real-time media server and proxy for RTSP, RTMP, HLS, WebRTC, and SRT. Single static Go binary on a hardened nonroot Wolfi base; config via a mounted mediamtx.yml.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.19.3", "description": "MediaMTX, the zero-dependency real-time media server and proxy that ingests and republishes video/audio over RTSP, RTMP, HLS, WebRTC and SRT. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mediamtx", "imageDigest": "sha256:a35e28d544b8fe20c804b51645af9b0646c6d58d4bff399c28d5edac5476b56b", "repositoryID": "f7dc00fa-877c-487a-b9d6-7343d082ffd7", "upstream": "https://github.com/bluenviron/mediamtx", "chartRef": "oci://ghcr.io/quenchworks/charts/mediamtx", "images": [ { "name": "mediamtx", "image": "ghcr.io/quenchworks/images/mediamtx@sha256:a35e28d544b8fe20c804b51645af9b0646c6d58d4bff399c28d5edac5476b56b" } ], "security": { "image": "ghcr.io/quenchworks/images/mediamtx", "version": "1.19.3", "tag": "ghcr.io/quenchworks/images/mediamtx:1.19.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mediamtx" ] } ], "versions": [ { "version": "1.19.3", "tag": "ghcr.io/quenchworks/images/mediamtx:1.19.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mediamtx" ] } ] } ] } }, { "slug": "meilisearch", "name": "Meilisearch", "category": "Search", "summary": "Fast, typo-tolerant full-text search engine with an instant-search API, easy to embed for site and in-app search with relevant results out of the box.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "1.51.0", "description": "Fast, typo-tolerant full-text search engine with an instant-search API, easy to embed for site and in-app search with relevant results out of the box. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/meilisearch", "imageDigest": "sha256:04bcb20754c136541f9eaab771b8eb9a07c9f5ac8c30a2f3910f60f6d69508ba", "repositoryID": "280e461c-2cdb-42e6-9600-705b68755883", "port": 7700, "upstream": "https://github.com/meilisearch/meilisearch", "chartRef": "oci://ghcr.io/quenchworks/charts/meilisearch", "images": [ { "name": "meilisearch", "image": "ghcr.io/quenchworks/images/meilisearch@sha256:04bcb20754c136541f9eaab771b8eb9a07c9f5ac8c30a2f3910f60f6d69508ba" } ], "security": { "image": "ghcr.io/quenchworks/images/meilisearch", "version": "1.51.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.51.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.51.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.51.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.50.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.50.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.49.0", "tag": "ghcr.io/quenchworks/images/meilisearch:1.49.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "memcached", "name": "Memcached", "category": "Cache", "summary": "Simple, high-performance distributed in-memory cache for storing small objects and database query results to reduce backend load.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.6.45", "description": "Simple, high-performance distributed in-memory cache for storing small objects and database query results to reduce backend load. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/memcached", "imageDigest": "sha256:d078d5186da4a439b22a7ac65968d553ff8a57f6304817fb6f633855c6f34546", "repositoryID": "4f83ee0f-4f34-4dd1-bdce-f3c94a9cde23", "port": 11211, "upstream": "https://github.com/memcached/memcached", "chartRef": "oci://ghcr.io/quenchworks/charts/memcached", "images": [ { "name": "memcached", "image": "ghcr.io/quenchworks/images/memcached@sha256:d078d5186da4a439b22a7ac65968d553ff8a57f6304817fb6f633855c6f34546" } ], "security": { "image": "ghcr.io/quenchworks/images/memcached", "version": "1.6.45", "tag": "ghcr.io/quenchworks/images/memcached:1.6.45", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.6.45", "tag": "ghcr.io/quenchworks/images/memcached:1.6.45", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mimir", "name": "mimir", "category": "Observability", "summary": "Horizontally scalable, highly available long-term storage for Prometheus metrics. Single static Go binary (all-in-one or microservices target) on a hardened nonroot Wolfi base; object storage is the operator's choice.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.5", "appVersion": "3.1.2", "description": "Horizontally scalable, highly available, long-term storage for Prometheus metrics from Grafana. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mimir", "imageDigest": "sha256:2ca8589ad58fca650b777a0807a3df829bab92b5a5f5c542b7f55b063f36828d", "repositoryID": "5b29112e-7258-42d6-b604-c5ce31ee0401", "port": 8080, "upstream": "https://grafana.com/oss/mimir", "chartRef": "oci://ghcr.io/quenchworks/charts/mimir", "images": [ { "name": "mimir", "image": "ghcr.io/quenchworks/images/mimir@sha256:2ca8589ad58fca650b777a0807a3df829bab92b5a5f5c542b7f55b063f36828d" } ], "security": { "image": "ghcr.io/quenchworks/images/mimir", "version": "3.1.2", "tag": "ghcr.io/quenchworks/images/mimir:3.1.2", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 2, "total": 4, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.37.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/mimir" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.80.0", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/mimir" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.52.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mimir" ] } ], "versions": [ { "version": "3.1.2", "tag": "ghcr.io/quenchworks/images/mimir:3.1.2", "critical": 0, "high": 2, "medium": 0, "low": 0, "unknown": 2, "total": 4, "fixable": 3, "grade": "D", "score": 61, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.37.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/mimir" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.80.0", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/mimir" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/mimir" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.52.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/mimir" ] } ] } ] } }, { "slug": "miniflux", "name": "miniflux", "category": "Apps & productivity", "summary": "Minimalist, opinionated RSS and Atom feed reader with a clean web UI and a REST API. Single pure-Go static binary on a hardened nonroot Wolfi base; needs PostgreSQL at runtime (operator-provided).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "2.3.2", "description": "Minimalist, opinionated feed reader (Go, single binary) backed by PostgreSQL. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled PostgreSQL by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/miniflux", "imageDigest": "sha256:f4b847570d250f8e72f73acbe0d07d67feeeb0d624ef935305ab8950819e51da", "repositoryID": "ec937af5-fce6-4483-a6e5-000ae71b65d9", "port": 80, "upstream": "https://miniflux.app", "chartRef": "oci://ghcr.io/quenchworks/charts/miniflux", "images": [ { "name": "miniflux", "image": "ghcr.io/quenchworks/images/miniflux@sha256:f4b847570d250f8e72f73acbe0d07d67feeeb0d624ef935305ab8950819e51da" } ], "security": { "image": "ghcr.io/quenchworks/images/miniflux", "version": "2.3.2", "tag": "ghcr.io/quenchworks/images/miniflux:2.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/miniflux" ] } ], "versions": [ { "version": "2.3.2", "tag": "ghcr.io/quenchworks/images/miniflux:2.3.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/miniflux" ] } ] } ] } }, { "slug": "mlflow", "name": "mlflow", "category": "Machine learning & AI", "summary": "MLflow Tracking Server for the ML lifecycle — experiment tracking, model registry, and run metadata over a REST/UI on port 5000. Packaged as the lightweight mlflow-skinny stack (gunicorn + psycopg2 + boto3) on a hardened Wolfi python base; needs an external PostgreSQL backend store and an artifact store (S3 or PVC).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "3.14.0", "description": "Hardened MLflow Tracking Server (experiment tracking + model registry) on a 0-CVE nonroot image, with a bundled PostgreSQL backend store.", "imageRepository": "ghcr.io/quenchworks/images/mlflow", "imageDigest": "sha256:e5a1e2d7d848f26e942648b50055f3f5de5a6aca091b6b6b2e663b6922ba8fb7", "repositoryID": "bcb02e82-89ea-4710-aec5-ff9942283d2b", "port": 5000, "upstream": "https://mlflow.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mlflow", "images": [ { "name": "mlflow", "image": "ghcr.io/quenchworks/images/mlflow@sha256:e5a1e2d7d848f26e942648b50055f3f5de5a6aca091b6b6b2e663b6922ba8fb7" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" } ], "security": { "image": "ghcr.io/quenchworks/images/mlflow", "version": "3.14.0", "tag": "ghcr.io/quenchworks/images/mlflow:3.14.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.14.0", "tag": "ghcr.io/quenchworks/images/mlflow:3.14.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "3.13.0", "tag": "ghcr.io/quenchworks/images/mlflow:3.13.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mongodb", "name": "MongoDB", "category": "Document", "summary": "Document (NoSQL) database for JSON-like data. SSPL is not OSI-approved / source-available, not open source; prefer the clean alternative FerretDB or DocumentDB.", "tier": "standard", "license": "SSPL-1.0", "licenseClean": "caution", "chartVersion": "0.0.10", "appVersion": "8.0.26", "description": "Document (NoSQL) database for JSON-like data. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mongodb", "imageDigest": "sha256:86da138b90eb830a38b3110e00b9b19191bb71d413a2c898134c36631bfe4584", "repositoryID": "122e9823-1401-4ba1-9f9a-2b2ceacab662", "port": 27017, "upstream": "https://github.com/mongodb/mongo", "chartRef": "oci://ghcr.io/quenchworks/charts/mongodb", "images": [ { "name": "mongodb", "image": "ghcr.io/quenchworks/images/mongodb@sha256:86da138b90eb830a38b3110e00b9b19191bb71d413a2c898134c36631bfe4584" } ], "caution": true, "cleanAlternative": "FerretDB + DocumentDB — MongoDB-wire-compatible and truly open (Apache-2.0 / PostgreSQL).", "security": { "image": "ghcr.io/quenchworks/images/mongodb", "version": "8.0.26", "tag": "ghcr.io/quenchworks/images/mongodb:8.0.26", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "8.0.26", "tag": "ghcr.io/quenchworks/images/mongodb:8.0.26", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "7.0.37", "tag": "ghcr.io/quenchworks/images/mongodb:7.0.37", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.0.29", "tag": "ghcr.io/quenchworks/images/mongodb:6.0.29", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mosquitto", "name": "mosquitto", "category": "Messaging", "summary": "Lightweight Eclipse MQTT broker for IoT and pub/sub messaging. Speaks MQTT 3.1/3.1.1/5.0 over TCP, TLS, and websockets; built from source with OpenSSL and a hardened nonroot, read-only-rootfs runtime.", "tier": "standard", "license": "EPL-2.0 OR BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "2.1.2", "description": "Eclipse Mosquitto, the lightweight open-source MQTT broker for IoT and pub/sub messaging (MQTT 3.1/3.1.1/5.0 over TCP, TLS, and websockets). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mosquitto", "imageDigest": "sha256:bd01aa290b0d387335e6faa2ba578bc81cf8c4178c694db257b0817d4a02cc5e", "repositoryID": "36ad39e2-1dd2-452c-9142-1d8c472094de", "upstream": "https://mosquitto.org", "chartRef": "oci://ghcr.io/quenchworks/charts/mosquitto", "images": [ { "name": "mosquitto", "image": "ghcr.io/quenchworks/images/mosquitto@sha256:bd01aa290b0d387335e6faa2ba578bc81cf8c4178c694db257b0817d4a02cc5e" } ], "security": { "image": "ghcr.io/quenchworks/images/mosquitto", "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.1.2", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.1.1", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/mosquitto:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "mysql", "name": "MySQL", "category": "Relational", "summary": "Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support.", "tier": "critical", "license": "GPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "9.7.2", "description": "Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/mysql", "imageDigest": "sha256:01e08bae9a563f645e776a868274c3a9bf0a405891d3615cd59ef6aab0f2a9e7", "repositoryID": "76f428fc-ee39-4158-b2ee-12f0922309fa", "port": 3306, "upstream": "https://github.com/mysql/mysql-server", "chartRef": "oci://ghcr.io/quenchworks/charts/mysql", "images": [ { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:01e08bae9a563f645e776a868274c3a9bf0a405891d3615cd59ef6aab0f2a9e7" } ], "security": { "image": "ghcr.io/quenchworks/images/mysql", "version": "9.7.1", "tag": "ghcr.io/quenchworks/images/mysql:9.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.7.1", "tag": "ghcr.io/quenchworks/images/mysql:9.7.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.4.10", "tag": "ghcr.io/quenchworks/images/mysql:8.4.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.0.46", "tag": "ghcr.io/quenchworks/images/mysql:8.0.46", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "n8n", "name": "n8n", "category": "Workflow", "summary": "Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.", "tier": "standard", "license": "LicenseRef-n8n-Sustainable-Use-License-1.0", "licenseClean": "clean", "chartVersion": "0.1.5", "appVersion": "2.32.6", "description": "Fair-code workflow automation platform — a visual node editor for building integrations and automations across 400+ apps, with native AI/LLM agent nodes (Node.js). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/n8n", "imageDigest": "sha256:942a5d312eb804a843e2fa1a06b03c6318a827124c5a20a9fb70bee55f07c39c", "repositoryID": "7329d01d-e6f6-4410-a265-bde59581da96", "port": 5678, "upstream": "https://n8n.io", "chartRef": "oci://ghcr.io/quenchworks/charts/n8n", "images": [ { "name": "n8n", "image": "ghcr.io/quenchworks/images/n8n@sha256:942a5d312eb804a843e2fa1a06b03c6318a827124c5a20a9fb70bee55f07c39c" }, { "name": "n8n-runners", "image": "ghcr.io/quenchworks/images/n8n-runners@sha256:e2aa10949dd811520f6eb7eb6417c490dcca903801f04a351babc2f5bfc7ce07" } ], "security": { "image": "ghcr.io/quenchworks/images/n8n", "version": "2.32.1", "tag": "ghcr.io/quenchworks/images/n8n:2.32.1", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "C", "score": 96, "cves": [ { "id": "CVE-2024-1899", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing", "url": "https://avd.aquasec.com/nvd/cve-2024-1899", "targets": [ "Node.js" ] } ], "versions": [ { "version": "2.32.1", "tag": "ghcr.io/quenchworks/images/n8n:2.32.1", "critical": 0, "high": 0, "medium": 1, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "C", "score": 96, "cves": [ { "id": "CVE-2024-1899", "severity": "MEDIUM", "pkg": "showdown", "installed": "2.1.0", "fixed": null, "title": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing", "url": "https://avd.aquasec.com/nvd/cve-2024-1899", "targets": [ "Node.js" ] } ] } ] } }, { "slug": "nats", "name": "NATS", "category": "Messaging", "summary": "Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.14.3", "description": "Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/nats", "imageDigest": "sha256:c06b8b41bed663fd6e59c05696d4b1fb1a568662b139b080bb91842e53e87ab5", "repositoryID": "1f27509e-072c-46c9-832a-6221159961e0", "upstream": "https://github.com/nats-io/nats-server", "chartRef": "oci://ghcr.io/quenchworks/charts/nats", "images": [ { "name": "nats", "image": "ghcr.io/quenchworks/images/nats@sha256:c06b8b41bed663fd6e59c05696d4b1fb1a568662b139b080bb91842e53e87ab5" } ], "security": { "image": "ghcr.io/quenchworks/images/nats", "version": "2.14.3", "tag": "ghcr.io/quenchworks/images/nats:2.14.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ], "versions": [ { "version": "2.14.3", "tag": "ghcr.io/quenchworks/images/nats:2.14.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] }, { "version": "2.14.2", "tag": "ghcr.io/quenchworks/images/nats:2.14.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] }, { "version": "2.14.1", "tag": "ghcr.io/quenchworks/images/nats:2.14.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/nats-server" ] } ] } ] } }, { "slug": "navidrome", "name": "navidrome", "category": "Media & streaming", "summary": "Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.", "tier": "standard", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.6", "appVersion": "0.62.0", "description": "Self-hosted music server and streamer (Go, Subsonic/OpenSubsonic API + web UI). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/navidrome", "imageDigest": "sha256:898cde2401631e113731e4232b5451643bdb3167f27b2b47b37df400ffa8bfe5", "repositoryID": "dc8f79af-e18a-46e1-ae2b-073366674dda", "port": 80, "upstream": "https://www.navidrome.org", "chartRef": "oci://ghcr.io/quenchworks/charts/navidrome", "images": [ { "name": "navidrome", "image": "ghcr.io/quenchworks/images/navidrome@sha256:898cde2401631e113731e4232b5451643bdb3167f27b2b47b37df400ffa8bfe5" } ], "security": { "image": "ghcr.io/quenchworks/images/navidrome", "version": "0.62.0", "tag": "ghcr.io/quenchworks/images/navidrome:0.62.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/navidrome" ] } ], "versions": [ { "version": "0.62.0", "tag": "ghcr.io/quenchworks/images/navidrome:0.62.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/navidrome" ] } ] } ] } }, { "slug": "neo4j", "name": "Neo4j", "category": "Graph", "summary": "Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.", "tier": "low", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.13", "appVersion": "2026.05.0", "description": "Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/neo4j", "imageDigest": "sha256:4e1102d63efa02dd161f2405a669ea859753699c97a3fb4bb3cd622f8bd6e54a", "repositoryID": "68ee4e50-989c-48b8-976d-1891cadafd8a", "upstream": "https://github.com/neo4j/neo4j", "chartRef": "oci://ghcr.io/quenchworks/charts/neo4j", "images": [ { "name": "neo4j", "image": "ghcr.io/quenchworks/images/neo4j@sha256:4e1102d63efa02dd161f2405a669ea859753699c97a3fb4bb3cd622f8bd6e54a" } ], "security": { "image": "ghcr.io/quenchworks/images/neo4j", "version": "2026.05.0", "tag": "ghcr.io/quenchworks/images/neo4j:2026.05.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2026.05.0", "tag": "ghcr.io/quenchworks/images/neo4j:2026.05.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "nextcloud", "name": "nextcloud", "category": "Apps & productivity", "summary": "Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.6", "appVersion": "34.0.2", "description": "Hardened Nextcloud (self-hosted content collaboration / file-sync platform) on a 0-CVE nonroot php-fpm + nginx image, with a bundled MariaDB backend.", "imageRepository": "ghcr.io/quenchworks/images/nextcloud", "imageDigest": "sha256:e20d5f20e45e5c9c5405629738defe66b5f6997da3a55e1c262123051a0c3a54", "repositoryID": "33b3c589-42d5-4619-9f11-be2aa944d2a0", "port": 8080, "upstream": "https://nextcloud.com", "chartRef": "oci://ghcr.io/quenchworks/charts/nextcloud", "images": [ { "name": "nextcloud", "image": "ghcr.io/quenchworks/images/nextcloud@sha256:e20d5f20e45e5c9c5405629738defe66b5f6997da3a55e1c262123051a0c3a54" }, { "name": "mariadb", "image": "ghcr.io/quenchworks/images/mariadb@sha256:abf1c0823dcc7f2c1b77252defaa0202a386907d131e3ea62feb0bb07304a0f5" } ], "security": { "image": "ghcr.io/quenchworks/images/nextcloud", "version": "34.0.2", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "34.0.2", "tag": "ghcr.io/quenchworks/images/nextcloud:34.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "nginx", "name": "nginx", "category": "Gateway", "summary": "High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.", "tier": "critical", "license": "BSD-2-Clause", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.30.4", "description": "High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/nginx", "imageDigest": "sha256:ba15d418a862217869a6f90e2912b9acdfb54864d26395e8a8e753ea5823e30f", "repositoryID": "75aa85b5-cca1-4b4a-a88b-46f68521ae58", "port": 8080, "upstream": "https://github.com/nginx/nginx", "chartRef": "oci://ghcr.io/quenchworks/charts/nginx", "images": [ { "name": "nginx", "image": "ghcr.io/quenchworks/images/nginx@sha256:ba15d418a862217869a6f90e2912b9acdfb54864d26395e8a8e753ea5823e30f" } ], "security": { "image": "ghcr.io/quenchworks/images/nginx", "version": "1.30.4", "tag": "ghcr.io/quenchworks/images/nginx:1.30.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.30.4", "tag": "ghcr.io/quenchworks/images/nginx:1.30.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.28.3", "tag": "ghcr.io/quenchworks/images/nginx:1.28.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.26.3", "tag": "ghcr.io/quenchworks/images/nginx:1.26.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "nsq", "name": "nsq", "category": "Messaging", "summary": "Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "1.3.0", "description": "NSQ realtime distributed messaging (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a single nsqd node with a persistent disk-queue.", "imageRepository": "ghcr.io/quenchworks/images/nsq", "imageDigest": "sha256:6605a00792074485207398ebba6178ef11d4037aa1fbcc734b6dc0e1b4254cc5", "repositoryID": "b39f39cd-d58b-4157-9efd-6bae5f8fdf03", "upstream": "https://nsq.io", "chartRef": "oci://ghcr.io/quenchworks/charts/nsq", "images": [ { "name": "nsq", "image": "ghcr.io/quenchworks/images/nsq@sha256:6605a00792074485207398ebba6178ef11d4037aa1fbcc734b6dc0e1b4254cc5" } ], "security": { "image": "ghcr.io/quenchworks/images/nsq", "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/nsq:1.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.3.0", "tag": "ghcr.io/quenchworks/images/nsq:1.3.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.2.1", "tag": "ghcr.io/quenchworks/images/nsq:1.2.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.2.0", "tag": "ghcr.io/quenchworks/images/nsq:1.2.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "ntfy", "name": "ntfy", "category": "Messaging", "summary": "Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "2.25.0", "description": "ntfy, the simple pub/sub HTTP notification server for sending push notifications to your phone or desktop from any script. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/ntfy", "imageDigest": "sha256:8e8b81c670e8b45851d76e84f64fb896440948dc755014b4462443037be18f85", "repositoryID": "2a61f84a-eeb6-41a9-8b34-d730105b7701", "port": 8080, "upstream": "https://ntfy.sh", "chartRef": "oci://ghcr.io/quenchworks/charts/ntfy", "images": [ { "name": "ntfy", "image": "ghcr.io/quenchworks/images/ntfy@sha256:8e8b81c670e8b45851d76e84f64fb896440948dc755014b4462443037be18f85" } ], "security": { "image": "ghcr.io/quenchworks/images/ntfy", "version": "2.25.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ], "versions": [ { "version": "2.25.0", "tag": "ghcr.io/quenchworks/images/ntfy:2.25.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ntfy" ] } ] } ] } }, { "slug": "oauth2-proxy", "name": "oauth2-proxy", "category": "Secrets & identity", "summary": "Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "7.15.3", "description": "oauth2-proxy, the reverse proxy and static file server that provides OAuth2/OIDC authentication in front of upstream services. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/oauth2-proxy", "imageDigest": "sha256:3a469bcaacf5f3d63b941e8e14f5e6d9a596632e31d7f2782a84709b44acb980", "repositoryID": "463f3b8c-beae-4296-b0fb-55d6f2b408d7", "port": 4180, "upstream": "https://oauth2-proxy.github.io/oauth2-proxy/", "chartRef": "oci://ghcr.io/quenchworks/charts/oauth2-proxy", "images": [ { "name": "oauth2-proxy", "image": "ghcr.io/quenchworks/images/oauth2-proxy@sha256:3a469bcaacf5f3d63b941e8e14f5e6d9a596632e31d7f2782a84709b44acb980" } ], "security": { "image": "ghcr.io/quenchworks/images/oauth2-proxy", "version": "7.15.3", "tag": "ghcr.io/quenchworks/images/oauth2-proxy:7.15.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oauth2-proxy" ] } ], "versions": [ { "version": "7.15.3", "tag": "ghcr.io/quenchworks/images/oauth2-proxy:7.15.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/oauth2-proxy" ] } ] } ] } }, { "slug": "observability-stack", "name": "observability-stack", "category": "Stacks", "summary": "Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for metrics, alerting, and populated Kubernetes dashboards.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.0.0", "description": "Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for metrics, alerting, and populated Kubernetes dashboards. No Prometheus Operator, no CRDs. All components are QuenchWorks-hardened, nonroot, 0-CVE images pinned by digest and cosign-signed. node-exporter and cAdvisor take host access by design (the stack's purpose is node + container observability); both are toggleable.", "repositoryID": "b35aa9cc-1558-4053-b967-ae9f74250035", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/observability-stack", "stack": true, "components": [ "prometheus", "grafana", "alertmanager" ], "images": [ { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:d5708594a12a4178014daaee6110348b6186f8812abd9241f6691d62e3663214" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995" }, { "name": "alertmanager", "image": "ghcr.io/quenchworks/images/alertmanager@sha256:862b251add3271174a224ebdad736056162ebfe4eb55318a013aa89c50304f33" }, { "name": "kube-state-metrics", "image": "ghcr.io/quenchworks/images/kube-state-metrics@sha256:210a2dcb84a2589f3629dad3be847421dde941fc3181ceede61996289cd76fe3" }, { "name": "node-exporter", "image": "ghcr.io/quenchworks/images/node-exporter@sha256:4c3735371055cea29cf1ed3250a2b2a7cb4a4ddcdd26ae378619ceddb2966a16" }, { "name": "cadvisor", "image": "ghcr.io/quenchworks/images/cadvisor@sha256:836078216185abf81bf11a8d07a1fe038346749a37ef87d78acff6d2961be57b" } ], "upstreams": [ "https://github.com/prometheus/prometheus", "https://github.com/grafana/grafana", "https://github.com/prometheus/alertmanager", "https://github.com/kubernetes/kube-state-metrics", "https://github.com/prometheus/node_exporter", "https://github.com/google/cadvisor" ], "security": null }, { "slug": "ollama", "name": "ollama", "category": "Machine learning & AI", "summary": "Local LLM runtime that pulls, runs, and serves open models (Llama, Gemma, Qwen, DeepSeek, and more) behind a simple REST API. CPU-only image; the chart mounts a writable volume for the model store.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "0.32.5", "description": "Ollama, the local large-language-model runtime that pulls and serves open models (Llama, Mistral, Gemma, Qwen, ...) over a simple REST API. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. CPU-only; runs as a StatefulSet with a persistent /models volume.", "imageRepository": "ghcr.io/quenchworks/images/ollama", "imageDigest": "sha256:3b2f7a4980d2e1f292a756e66e28d603b829b9e3740c3997b0800bc5e47ab190", "repositoryID": "519e0ec6-71ee-4015-9a03-73b8bf208cde", "port": 11434, "upstream": "https://ollama.com", "chartRef": "oci://ghcr.io/quenchworks/charts/ollama", "images": [ { "name": "ollama", "image": "ghcr.io/quenchworks/images/ollama@sha256:3b2f7a4980d2e1f292a756e66e28d603b829b9e3740c3997b0800bc5e47ab190" } ], "security": { "image": "ghcr.io/quenchworks/images/ollama", "version": "0.32.5", "tag": "ghcr.io/quenchworks/images/ollama:0.32.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ], "versions": [ { "version": "0.32.5", "tag": "ghcr.io/quenchworks/images/ollama:0.32.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/ollama" ] } ] } ] } }, { "slug": "opa", "name": "opa", "category": "Security & supply chain", "summary": "Open Policy Agent, the CNCF general-purpose policy engine. Evaluates Rego policies over JSON and YAML to enforce authorization, admission control, and configuration rules across the stack.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.18.2", "description": "Open Policy Agent, the CNCF general-purpose policy engine for authorization, admission control, and config validation over Rego. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opa", "imageDigest": "sha256:870921494dbe65c9efe9ec86d806f52708fe728437e1aa688446f491317a27db", "repositoryID": "25598768-f4b3-4167-9be9-79c6a804c303", "port": 8181, "upstream": "https://www.openpolicyagent.org", "chartRef": "oci://ghcr.io/quenchworks/charts/opa", "images": [ { "name": "opa", "image": "ghcr.io/quenchworks/images/opa@sha256:870921494dbe65c9efe9ec86d806f52708fe728437e1aa688446f491317a27db" } ], "security": { "image": "ghcr.io/quenchworks/images/opa", "version": "1.18.2", "tag": "ghcr.io/quenchworks/images/opa:1.18.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 1, "total": 2, "fixable": 0, "grade": "D", "score": 88, "cves": [ { "id": "CVE-2026-50163", "severity": "HIGH", "pkg": "oras.land/oras-go/v2", "installed": "v2.6.1", "fixed": null, "title": "oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks", "url": "https://avd.aquasec.com/nvd/cve-2026-50163", "targets": [ "usr/bin/opa" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opa" ] } ], "versions": [ { "version": "1.18.2", "tag": "ghcr.io/quenchworks/images/opa:1.18.2", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 1, "total": 2, "fixable": 0, "grade": "D", "score": 88, "cves": [ { "id": "CVE-2026-50163", "severity": "HIGH", "pkg": "oras.land/oras-go/v2", "installed": "v2.6.1", "fixed": null, "title": "oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks", "url": "https://avd.aquasec.com/nvd/cve-2026-50163", "targets": [ "usr/bin/opa" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/opa" ] } ] } ] } }, { "slug": "openbao", "name": "OpenBao", "category": "Secrets", "summary": "Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. The Linux Foundation MPL-2.0 community fork of HashiCorp Vault.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "2.6.1", "description": "Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openbao", "imageDigest": "sha256:a27e51c4ac384b57e5141aaf0435163c8c3d36cd185510a163eb5126e56d6394", "repositoryID": "8d6b6290-58a0-40c4-9b6d-3604faf59685", "upstream": "https://github.com/openbao/openbao", "chartRef": "oci://ghcr.io/quenchworks/charts/openbao", "images": [ { "name": "openbao", "image": "ghcr.io/quenchworks/images/openbao@sha256:a27e51c4ac384b57e5141aaf0435163c8c3d36cd185510a163eb5126e56d6394" } ], "security": { "image": "ghcr.io/quenchworks/images/openbao", "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/openbao:2.6.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 4, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.38.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.81.1", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-gcjh-h69q-9w9g", "severity": "MEDIUM", "pkg": "github.com/google/cel-go", "installed": "v0.28.1", "fixed": "0.29.0", "title": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag", "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ], "versions": [ { "version": "2.6.0", "tag": "ghcr.io/quenchworks/images/openbao:2.6.0", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 4, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.38.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.81.1", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-gcjh-h69q-9w9g", "severity": "MEDIUM", "pkg": "github.com/google/cel-go", "installed": "v0.28.1", "fixed": "0.29.0", "title": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag", "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] }, { "version": "2.5.5", "tag": "ghcr.io/quenchworks/images/openbao:2.5.5", "critical": 0, "high": 2, "medium": 1, "low": 0, "unknown": 2, "total": 5, "fixable": 4, "grade": "D", "score": 52, "cves": [ { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.37.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.80.0", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-gcjh-h69q-9w9g", "severity": "MEDIUM", "pkg": "github.com/google/cel-go", "installed": "v0.26.1", "fixed": "0.29.0", "title": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag", "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.55.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/bao" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.52.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] }, { "version": "2.5.4", "tag": "ghcr.io/quenchworks/images/openbao:2.5.4", "critical": 0, "high": 20, "medium": 14, "low": 3, "unknown": 7, "total": 44, "fixable": 43, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2024-8185", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.0.3", "title": "hashicorp/vault: Vault Vulnerable to Denial of Service When Processing Raft Join Requests", "url": "https://avd.aquasec.com/nvd/cve-2024-8185", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2024-9180", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.0.3", "title": "hashicorp/vault: Vault Operators in Root Namespace May Elevate Their Privileges", "url": "https://avd.aquasec.com/nvd/cve-2024-9180", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-59043", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.4.1", "title": "OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests", "url": "https://avd.aquasec.com/nvd/cve-2025-59043", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-64761", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.4.4", "title": "OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation", "url": "https://avd.aquasec.com/nvd/cve-2025-64761", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-25681", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "url": "https://avd.aquasec.com/nvd/cve-2026-25681", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-27136", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-27136", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39821", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.55.0", "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "url": "https://avd.aquasec.com/nvd/cve-2026-39821", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39822", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.26.4", "fixed": "1.25.12, 1.26.5, 1.27.0-rc.2", "title": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-39822", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39828", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "url": "https://avd.aquasec.com/nvd/cve-2026-39828", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39829", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "url": "https://avd.aquasec.com/nvd/cve-2026-39829", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39830", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "url": "https://avd.aquasec.com/nvd/cve-2026-39830", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39831", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "url": "https://avd.aquasec.com/nvd/cve-2026-39831", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39832", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "url": "https://avd.aquasec.com/nvd/cve-2026-39832", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39835", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-39835", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42508", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "url": "https://avd.aquasec.com/nvd/cve-2026-42508", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-45808", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.5.4", "title": "OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-45808", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46595", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "url": "https://avd.aquasec.com/nvd/cve-2026-46595", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46597", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "url": "https://avd.aquasec.com/nvd/cve-2026-46597", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.36.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.80.0", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-25680", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-25680", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-32952", "severity": "MEDIUM", "pkg": "github.com/Azure/go-ntlmssp", "installed": "v0.0.0-20221128193559-754e69321358", "fixed": "0.1.1", "title": "go-ntlmssp: go-ntlmssp: Denial of Service via malicious NTLM challenge", "url": "https://avd.aquasec.com/nvd/cve-2026-32952", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39827", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings", "url": "https://avd.aquasec.com/nvd/cve-2026-39827", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39833", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation", "url": "https://avd.aquasec.com/nvd/cve-2026-39833", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39834", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write", "url": "https://avd.aquasec.com/nvd/cve-2026-39834", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42502", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering", "url": "https://avd.aquasec.com/nvd/cve-2026-42502", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42505", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.26.4", "fixed": "1.25.12, 1.26.5, 1.27.0-rc.2", "title": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello", "url": "https://avd.aquasec.com/nvd/cve-2026-42505", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42506", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-42506", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46358", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.5.4", "title": "OpenBao's Inline Auth Incorrectly Redacted Headers", "url": "https://avd.aquasec.com/nvd/cve-2026-46358", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46405", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "2.5.4", "title": "OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-46405", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46598", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input", "url": "https://avd.aquasec.com/nvd/cve-2026-46598", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55770", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "0.0.0-20260617104213-10b7825c714c", "title": "OpenBao: LDAPi ldaputil (wrong escape func)", "url": "https://avd.aquasec.com/nvd/cve-2026-55770", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55776", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "0.0.0-20260617104123-db57c62602b2", "title": "OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types", "url": "https://avd.aquasec.com/nvd/cve-2026-55776", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-gcjh-h69q-9w9g", "severity": "MEDIUM", "pkg": "github.com/google/cel-go", "installed": "v0.26.1", "fixed": "0.29.0", "title": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag", "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41889", "severity": "LOW", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.9.1", "fixed": "5.9.2", "title": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions", "url": "https://avd.aquasec.com/nvd/cve-2026-41889", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55774", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "0.0.0-20260617103932-b20b999dd404", "title": "OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808", "url": "https://avd.aquasec.com/nvd/cve-2026-55774", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55775", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20260520155348-4f6d47246a05+dirty", "fixed": "0.0.0-20260617103935-d3c1cc64b1ae", "title": "OpenBao's System Backend allows Unauthorized Management of the containing Namespace", "url": "https://avd.aquasec.com/nvd/cve-2026-55775", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39824", "severity": "UNKNOWN", "pkg": "golang.org/x/sys", "installed": "v0.43.0", "fixed": "0.44.0", "title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "url": "https://avd.aquasec.com/nvd/cve-2026-39824", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.53.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "glibc", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:891ead55e81de29fb5d38a718c59a87f4269e00a7d461b263e403e4c3b5f53e5 (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "glibc-locale-posix", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:891ead55e81de29fb5d38a718c59a87f4269e00a7d461b263e403e4c3b5f53e5 (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "ld-linux", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:891ead55e81de29fb5d38a718c59a87f4269e00a7d461b263e403e4c3b5f53e5 (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "libcrypt1", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:891ead55e81de29fb5d38a718c59a87f4269e00a7d461b263e403e4c3b5f53e5 (wolfi 20230201)" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.50.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] }, { "version": "2.4.4", "tag": "ghcr.io/quenchworks/images/openbao:2.4.4", "critical": 5, "high": 29, "medium": 17, "low": 9, "unknown": 7, "total": 67, "fixable": 63, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-33186", "severity": "CRITICAL", "pkg": "google.golang.org/grpc", "installed": "v1.77.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "url": "https://avd.aquasec.com/nvd/cve-2026-33186", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33757", "severity": "CRITICAL", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260325142553-e32103951925", "title": "OpenBao: lack of user confirmation for OpenBao OIDC direct callback mode", "url": "https://avd.aquasec.com/nvd/cve-2026-33757", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33758", "severity": "CRITICAL", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260325133417-6e2b2dd84f0e", "title": "OpenBao: reflected XSS in OpenBao OIDC authentication error message", "url": "https://avd.aquasec.com/nvd/cve-2026-33758", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33815", "severity": "CRITICAL", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.7.6", "fixed": "5.9.0", "title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-33815", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33816", "severity": "CRITICAL", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.7.6", "fixed": "5.9.0", "title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-33816", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2024-8185", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.0.3", "title": "hashicorp/vault: Vault Vulnerable to Denial of Service When Processing Raft Join Requests", "url": "https://avd.aquasec.com/nvd/cve-2024-8185", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2024-9180", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.0.3", "title": "hashicorp/vault: Vault Operators in Root Namespace May Elevate Their Privileges", "url": "https://avd.aquasec.com/nvd/cve-2024-9180", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-59043", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.4.1", "title": "OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests", "url": "https://avd.aquasec.com/nvd/cve-2025-59043", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-64761", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.4.4", "title": "OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation", "url": "https://avd.aquasec.com/nvd/cve-2025-64761", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-24051", "severity": "HIGH", "pkg": "go.opentelemetry.io/otel/sdk", "installed": "v1.38.0", "fixed": "1.40.0", "title": "OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking", "url": "https://avd.aquasec.com/nvd/cve-2026-24051", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-25681", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "url": "https://avd.aquasec.com/nvd/cve-2026-25681", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-27136", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-27136", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-29181", "severity": "HIGH", "pkg": "go.opentelemetry.io/otel", "installed": "v1.38.0", "fixed": "1.41.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers", "url": "https://avd.aquasec.com/nvd/cve-2026-29181", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33814", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.53.0", "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "url": "https://avd.aquasec.com/nvd/cve-2026-33814", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-34040", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": "29.3.1", "title": "Moby: Moby: Authorization bypass vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-34040", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-34986", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.4", "fixed": "3.0.5", "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "url": "https://avd.aquasec.com/nvd/cve-2026-34986", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-34986", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.1.3", "fixed": "4.1.4", "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "url": "https://avd.aquasec.com/nvd/cve-2026-34986", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39821", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.55.0", "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "url": "https://avd.aquasec.com/nvd/cve-2026-39821", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39822", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.26.4", "fixed": "1.25.12, 1.26.5, 1.27.0-rc.2", "title": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-39822", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39828", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "url": "https://avd.aquasec.com/nvd/cve-2026-39828", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39829", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "url": "https://avd.aquasec.com/nvd/cve-2026-39829", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39830", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "url": "https://avd.aquasec.com/nvd/cve-2026-39830", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39831", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "url": "https://avd.aquasec.com/nvd/cve-2026-39831", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39832", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "url": "https://avd.aquasec.com/nvd/cve-2026-39832", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39835", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-39835", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39883", "severity": "HIGH", "pkg": "go.opentelemetry.io/otel/sdk", "installed": "v1.38.0", "fixed": "1.43.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris", "url": "https://avd.aquasec.com/nvd/cve-2026-39883", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42508", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "url": "https://avd.aquasec.com/nvd/cve-2026-42508", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-45808", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.5.4", "title": "OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-45808", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46595", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "url": "https://avd.aquasec.com/nvd/cve-2026-46595", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46597", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "url": "https://avd.aquasec.com/nvd/cve-2026-46597", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.31.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.77.0", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "Moby is an open source container framework. In Docker Engine prior to ...", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-25680", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-25680", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-32952", "severity": "MEDIUM", "pkg": "github.com/Azure/go-ntlmssp", "installed": "v0.0.0-20221128193559-754e69321358", "fixed": "0.1.1", "title": "go-ntlmssp: go-ntlmssp: Denial of Service via malicious NTLM challenge", "url": "https://avd.aquasec.com/nvd/cve-2026-32952", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33997", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": "29.3.1", "title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "url": "https://avd.aquasec.com/nvd/cve-2026-33997", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39827", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings", "url": "https://avd.aquasec.com/nvd/cve-2026-39827", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39833", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation", "url": "https://avd.aquasec.com/nvd/cve-2026-39833", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39834", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write", "url": "https://avd.aquasec.com/nvd/cve-2026-39834", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39946", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260420155735-b596b0882620", "title": "OpenBao: OpenBao: SQL injection via improper database quoting during PostgreSQL role revocation", "url": "https://avd.aquasec.com/nvd/cve-2026-39946", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42502", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering", "url": "https://avd.aquasec.com/nvd/cve-2026-42502", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42505", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.26.4", "fixed": "1.25.12, 1.26.5, 1.27.0-rc.2", "title": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello", "url": "https://avd.aquasec.com/nvd/cve-2026-42505", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42506", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-42506", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46358", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.5.4", "title": "OpenBao's Inline Auth Incorrectly Redacted Headers", "url": "https://avd.aquasec.com/nvd/cve-2026-46358", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46405", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "2.5.4", "title": "OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-46405", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46598", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input", "url": "https://avd.aquasec.com/nvd/cve-2026-46598", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55770", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260617104213-10b7825c714c", "title": "OpenBao: LDAPi ldaputil (wrong escape func)", "url": "https://avd.aquasec.com/nvd/cve-2026-55770", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55776", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260617104123-db57c62602b2", "title": "OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types", "url": "https://avd.aquasec.com/nvd/cve-2026-55776", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-gcjh-h69q-9w9g", "severity": "MEDIUM", "pkg": "github.com/google/cel-go", "installed": "v0.26.1", "fixed": "0.29.0", "title": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag", "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v28.3.3+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-1229", "severity": "LOW", "pkg": "github.com/cloudflare/circl", "installed": "v1.6.1", "fixed": "1.6.3", "title": "CIRCL has an incorrect calculation in secp384r1 CombinedMult", "url": "https://avd.aquasec.com/nvd/cve-2026-1229", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-26958", "severity": "LOW", "pkg": "filippo.io/edwards25519", "installed": "v1.1.0", "fixed": "1.1.1", "title": "filippo.io/edwards25519: filippo.io/edwards25519: Cryptographic integrity bypass due to incorrect MultiScalarMult results", "url": "https://avd.aquasec.com/nvd/cve-2026-26958", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39388", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260420160924-abe84e1af4c3", "title": "OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-39388", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39396", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260420180337-2b2a901aa9f7", "title": "OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-39396", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-40264", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260420162526-f58111d2ca54", "title": "OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation", "url": "https://avd.aquasec.com/nvd/cve-2026-40264", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41889", "severity": "LOW", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.7.6", "fixed": "5.9.2", "title": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions", "url": "https://avd.aquasec.com/nvd/cve-2026-41889", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42186", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260420173541-6d2e0506e2b4", "title": "OpenBao's Namespace Deletion May Not Delete Data Properly", "url": "https://avd.aquasec.com/nvd/cve-2026-42186", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55774", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260617103932-b20b999dd404", "title": "OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808", "url": "https://avd.aquasec.com/nvd/cve-2026-55774", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55775", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20251124193704-4bfd70723d4f+dirty", "fixed": "0.0.0-20260617103935-d3c1cc64b1ae", "title": "OpenBao's System Backend allows Unauthorized Management of the containing Namespace", "url": "https://avd.aquasec.com/nvd/cve-2026-55775", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39824", "severity": "UNKNOWN", "pkg": "golang.org/x/sys", "installed": "v0.38.0", "fixed": "0.44.0", "title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "url": "https://avd.aquasec.com/nvd/cve-2026-39824", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.47.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "glibc", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:3b2209b28cdd78f7477826db3bda79a8cf5815b71507f639bd9abe0d8b1387ca (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "glibc-locale-posix", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:3b2209b28cdd78f7477826db3bda79a8cf5815b71507f639bd9abe0d8b1387ca (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "ld-linux", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:3b2209b28cdd78f7477826db3bda79a8cf5815b71507f639bd9abe0d8b1387ca (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "libcrypt1", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:3b2209b28cdd78f7477826db3bda79a8cf5815b71507f639bd9abe0d8b1387ca (wolfi 20230201)" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.45.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] }, { "version": "2.3.2", "tag": "ghcr.io/quenchworks/images/openbao:2.3.2", "critical": 5, "high": 30, "medium": 24, "low": 10, "unknown": 7, "total": 76, "fixable": 72, "grade": "F", "score": 0, "cves": [ { "id": "CVE-2026-33186", "severity": "CRITICAL", "pkg": "google.golang.org/grpc", "installed": "v1.74.2", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "url": "https://avd.aquasec.com/nvd/cve-2026-33186", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33757", "severity": "CRITICAL", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260325142553-e32103951925", "title": "OpenBao: lack of user confirmation for OpenBao OIDC direct callback mode", "url": "https://avd.aquasec.com/nvd/cve-2026-33757", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33758", "severity": "CRITICAL", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260325133417-6e2b2dd84f0e", "title": "OpenBao: reflected XSS in OpenBao OIDC authentication error message", "url": "https://avd.aquasec.com/nvd/cve-2026-33758", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33815", "severity": "CRITICAL", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.7.5", "fixed": "5.9.0", "title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-33815", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33816", "severity": "CRITICAL", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.7.5", "fixed": "5.9.0", "title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-33816", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2024-8185", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.0.3", "title": "hashicorp/vault: Vault Vulnerable to Denial of Service When Processing Raft Join Requests", "url": "https://avd.aquasec.com/nvd/cve-2024-8185", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2024-9180", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.0.3", "title": "hashicorp/vault: Vault Operators in Root Namespace May Elevate Their Privileges", "url": "https://avd.aquasec.com/nvd/cve-2024-9180", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-47913", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.43.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS", "url": "https://avd.aquasec.com/nvd/cve-2025-47913", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-59043", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.4.1", "title": "OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests", "url": "https://avd.aquasec.com/nvd/cve-2025-59043", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-64761", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.4.4", "title": "OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation", "url": "https://avd.aquasec.com/nvd/cve-2025-64761", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-24051", "severity": "HIGH", "pkg": "go.opentelemetry.io/otel/sdk", "installed": "v1.36.0", "fixed": "1.40.0", "title": "OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking", "url": "https://avd.aquasec.com/nvd/cve-2026-24051", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-25681", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "url": "https://avd.aquasec.com/nvd/cve-2026-25681", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-27136", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "url": "https://avd.aquasec.com/nvd/cve-2026-27136", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-29181", "severity": "HIGH", "pkg": "go.opentelemetry.io/otel", "installed": "v1.36.0", "fixed": "1.41.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers", "url": "https://avd.aquasec.com/nvd/cve-2026-29181", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33814", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.53.0", "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "url": "https://avd.aquasec.com/nvd/cve-2026-33814", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-34040", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v27.4.1+incompatible", "fixed": "29.3.1", "title": "Moby: Moby: Authorization bypass vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-34040", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-34986", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v3", "installed": "v3.0.4", "fixed": "3.0.5", "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "url": "https://avd.aquasec.com/nvd/cve-2026-34986", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-34986", "severity": "HIGH", "pkg": "github.com/go-jose/go-jose/v4", "installed": "v4.0.5", "fixed": "4.1.4", "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "url": "https://avd.aquasec.com/nvd/cve-2026-34986", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39821", "severity": "HIGH", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.55.0", "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "url": "https://avd.aquasec.com/nvd/cve-2026-39821", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39822", "severity": "HIGH", "pkg": "stdlib", "installed": "v1.26.4", "fixed": "1.25.12, 1.26.5, 1.27.0-rc.2", "title": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal", "url": "https://avd.aquasec.com/nvd/cve-2026-39822", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39828", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "url": "https://avd.aquasec.com/nvd/cve-2026-39828", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39829", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "url": "https://avd.aquasec.com/nvd/cve-2026-39829", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39830", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "url": "https://avd.aquasec.com/nvd/cve-2026-39830", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39831", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "url": "https://avd.aquasec.com/nvd/cve-2026-39831", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39832", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "url": "https://avd.aquasec.com/nvd/cve-2026-39832", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39835", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-39835", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39883", "severity": "HIGH", "pkg": "go.opentelemetry.io/otel/sdk", "installed": "v1.36.0", "fixed": "1.43.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris", "url": "https://avd.aquasec.com/nvd/cve-2026-39883", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42508", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "url": "https://avd.aquasec.com/nvd/cve-2026-42508", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-45808", "severity": "HIGH", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.5.4", "title": "OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL", "url": "https://avd.aquasec.com/nvd/cve-2026-45808", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46595", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "url": "https://avd.aquasec.com/nvd/cve-2026-46595", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46597", "severity": "HIGH", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "url": "https://avd.aquasec.com/nvd/cve-2026-46597", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-56852", "severity": "HIGH", "pkg": "golang.org/x/text", "installed": "v0.27.0", "fixed": "0.39.0", "title": "A norm.Iter can enter an infinite loop when handling input containing ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56852", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-hrxh-6v49-42gf", "severity": "HIGH", "pkg": "google.golang.org/grpc", "installed": "v1.74.2", "fixed": "1.82.1", "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41567", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v27.4.1+incompatible", "fixed": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "url": "https://avd.aquasec.com/nvd/cve-2026-41567", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42306", "severity": "HIGH", "pkg": "github.com/docker/docker", "installed": "v27.4.1+incompatible", "fixed": null, "title": "Moby is an open source container framework. In Docker Engine prior to ...", "url": "https://avd.aquasec.com/nvd/cve-2026-42306", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-11065", "severity": "MEDIUM", "pkg": "github.com/go-viper/mapstructure/v2", "installed": "v2.3.0", "fixed": "2.4.0", "title": "github.com/go-viper/mapstructure/v2: Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure", "url": "https://avd.aquasec.com/nvd/cve-2025-11065", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-47911", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.45.0", "title": "golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html", "url": "https://avd.aquasec.com/nvd/cve-2025-47911", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-47914", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.45.0", "title": "golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages", "url": "https://avd.aquasec.com/nvd/cve-2025-47914", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-58181", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.45.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication", "url": "https://avd.aquasec.com/nvd/cve-2025-58181", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-58190", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.45.0", "title": "golang.org/x/net/html: Infinite parsing loop in golang.org/x/net", "url": "https://avd.aquasec.com/nvd/cve-2025-58190", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-62513", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20251022165510-cc2c476bac66", "title": "OpenBao leaks HTTPRawBody in Audit Logs", "url": "https://avd.aquasec.com/nvd/cve-2025-62513", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-62705", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20251022165510-cc2c476bac66", "title": "OpenBao and Vault Leak []byte Fields in Audit Logs ", "url": "https://avd.aquasec.com/nvd/cve-2025-62705", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-25680", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-25680", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-32952", "severity": "MEDIUM", "pkg": "github.com/Azure/go-ntlmssp", "installed": "v0.0.0-20221128193559-754e69321358", "fixed": "0.1.1", "title": "go-ntlmssp: go-ntlmssp: Denial of Service via malicious NTLM challenge", "url": "https://avd.aquasec.com/nvd/cve-2026-32952", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-33997", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v27.4.1+incompatible", "fixed": "29.3.1", "title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "url": "https://avd.aquasec.com/nvd/cve-2026-33997", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39827", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings", "url": "https://avd.aquasec.com/nvd/cve-2026-39827", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39833", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation", "url": "https://avd.aquasec.com/nvd/cve-2026-39833", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39834", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write", "url": "https://avd.aquasec.com/nvd/cve-2026-39834", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39946", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260420155735-b596b0882620", "title": "OpenBao: OpenBao: SQL injection via improper database quoting during PostgreSQL role revocation", "url": "https://avd.aquasec.com/nvd/cve-2026-39946", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42502", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering", "url": "https://avd.aquasec.com/nvd/cve-2026-42502", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42505", "severity": "MEDIUM", "pkg": "stdlib", "installed": "v1.26.4", "fixed": "1.25.12, 1.26.5, 1.27.0-rc.2", "title": "crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello", "url": "https://avd.aquasec.com/nvd/cve-2026-42505", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42506", "severity": "MEDIUM", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.55.0", "title": "golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing", "url": "https://avd.aquasec.com/nvd/cve-2026-42506", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46358", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.5.4", "title": "OpenBao's Inline Auth Incorrectly Redacted Headers", "url": "https://avd.aquasec.com/nvd/cve-2026-46358", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46405", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "2.5.4", "title": "OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens", "url": "https://avd.aquasec.com/nvd/cve-2026-46405", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46598", "severity": "MEDIUM", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": "0.52.0", "title": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input", "url": "https://avd.aquasec.com/nvd/cve-2026-46598", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55770", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260617104213-10b7825c714c", "title": "OpenBao: LDAPi ldaputil (wrong escape func)", "url": "https://avd.aquasec.com/nvd/cve-2026-55770", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55776", "severity": "MEDIUM", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260617104123-db57c62602b2", "title": "OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types", "url": "https://avd.aquasec.com/nvd/cve-2026-55776", "targets": [ "usr/bin/bao" ] }, { "id": "GHSA-gcjh-h69q-9w9g", "severity": "MEDIUM", "pkg": "github.com/google/cel-go", "installed": "v0.26.0", "fixed": "0.29.0", "title": "cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag", "url": "https://github.com/advisories/GHSA-gcjh-h69q-9w9g", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41568", "severity": "MEDIUM", "pkg": "github.com/docker/docker", "installed": "v27.4.1+incompatible", "fixed": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "url": "https://avd.aquasec.com/nvd/cve-2026-41568", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2025-54410", "severity": "LOW", "pkg": "github.com/docker/docker", "installed": "v27.4.1+incompatible", "fixed": "25.0.13, 28.0.0", "title": "github.com/moby/moby: Moby's Firewalld reload removes bridge network isolation", "url": "https://avd.aquasec.com/nvd/cve-2025-54410", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-1229", "severity": "LOW", "pkg": "github.com/cloudflare/circl", "installed": "v1.6.1", "fixed": "1.6.3", "title": "CIRCL has an incorrect calculation in secp384r1 CombinedMult", "url": "https://avd.aquasec.com/nvd/cve-2026-1229", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-26958", "severity": "LOW", "pkg": "filippo.io/edwards25519", "installed": "v1.1.0", "fixed": "1.1.1", "title": "filippo.io/edwards25519: filippo.io/edwards25519: Cryptographic integrity bypass due to incorrect MultiScalarMult results", "url": "https://avd.aquasec.com/nvd/cve-2026-26958", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39388", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260420160924-abe84e1af4c3", "title": "OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate", "url": "https://avd.aquasec.com/nvd/cve-2026-39388", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39396", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260420180337-2b2a901aa9f7", "title": "OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)", "url": "https://avd.aquasec.com/nvd/cve-2026-39396", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-40264", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260420162526-f58111d2ca54", "title": "OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation", "url": "https://avd.aquasec.com/nvd/cve-2026-40264", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-41889", "severity": "LOW", "pkg": "github.com/jackc/pgx/v5", "installed": "v5.7.5", "fixed": "5.9.2", "title": "github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions", "url": "https://avd.aquasec.com/nvd/cve-2026-41889", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-42186", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260420173541-6d2e0506e2b4", "title": "OpenBao's Namespace Deletion May Not Delete Data Properly", "url": "https://avd.aquasec.com/nvd/cve-2026-42186", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55774", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260617103932-b20b999dd404", "title": "OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808", "url": "https://avd.aquasec.com/nvd/cve-2026-55774", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-55775", "severity": "LOW", "pkg": "github.com/openbao/openbao", "installed": "v0.0.0-20250808034624-b1a68f558c89+dirty", "fixed": "0.0.0-20260617103935-d3c1cc64b1ae", "title": "OpenBao's System Backend allows Unauthorized Management of the containing Namespace", "url": "https://avd.aquasec.com/nvd/cve-2026-55775", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-39824", "severity": "UNKNOWN", "pkg": "golang.org/x/sys", "installed": "v0.34.0", "fixed": "0.44.0", "title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "url": "https://avd.aquasec.com/nvd/cve-2026-39824", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-46600", "severity": "UNKNOWN", "pkg": "golang.org/x/net", "installed": "v0.42.0", "fixed": "0.56.0", "title": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...", "url": "https://avd.aquasec.com/nvd/cve-2026-46600", "targets": [ "usr/bin/bao" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "glibc", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:65a1094c0ebd23cb2183cabac0ed47763bdc783c48268255843c8a51c812c8d7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "glibc-locale-posix", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:65a1094c0ebd23cb2183cabac0ed47763bdc783c48268255843c8a51c812c8d7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "ld-linux", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:65a1094c0ebd23cb2183cabac0ed47763bdc783c48268255843c8a51c812c8d7 (wolfi 20230201)" ] }, { "id": "CVE-2026-6791", "severity": "UNKNOWN", "pkg": "libcrypt1", "installed": "2.43-r8", "fixed": "2.43-r10", "title": null, "url": null, "targets": [ "ghcr.io/quenchworks/images/openbao@sha256:65a1094c0ebd23cb2183cabac0ed47763bdc783c48268255843c8a51c812c8d7 (wolfi 20230201)" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.40.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/bao" ] } ] } ] } }, { "slug": "openfga", "name": "openfga", "category": "Identity", "summary": "Fine-grained authorization engine (Zanzibar-style relationship-based access control) over HTTP and gRPC. From source on a hardened nonroot Wolfi base; datastore is the operator's choice.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "1.18.1", "description": "OpenFGA, the CNCF fine-grained authorization service (Zanzibar-style ReBAC) with HTTP and gRPC APIs. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openfga", "imageDigest": "sha256:74d0198bcd52281d335e1e9c120a4d78154191204f90a8f75e6db38fde482977", "repositoryID": "ebb121df-d83a-4d90-9f04-4e2cc016c66b", "upstream": "https://openfga.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/openfga", "images": [ { "name": "openfga", "image": "ghcr.io/quenchworks/images/openfga@sha256:74d0198bcd52281d335e1e9c120a4d78154191204f90a8f75e6db38fde482977" } ], "security": { "image": "ghcr.io/quenchworks/images/openfga", "version": "1.18.1", "tag": "ghcr.io/quenchworks/images/openfga:1.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.18.1", "tag": "ghcr.io/quenchworks/images/openfga:1.18.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "openldap", "name": "openldap", "category": "Identity", "summary": "OpenLDAP slapd, the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the client tools. Runs nonroot on unprivileged ports 1389/1636 and backs directory-driven auth for the identity stack.", "tier": "standard", "license": "OLDAP-2.8", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "2.6.13", "description": "OpenLDAP slapd — the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the standard client tools. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/openldap", "imageDigest": "sha256:b4c9a8113cf797fb24528d2557671edb9021ebe34540ca1d5e9e5cf899142d86", "repositoryID": "5df32536-7438-4a56-bf89-94a827295951", "port": 1389, "upstream": "https://www.openldap.org", "chartRef": "oci://ghcr.io/quenchworks/charts/openldap", "images": [ { "name": "openldap", "image": "ghcr.io/quenchworks/images/openldap@sha256:b4c9a8113cf797fb24528d2557671edb9021ebe34540ca1d5e9e5cf899142d86" } ], "security": { "image": "ghcr.io/quenchworks/images/openldap", "version": "2.6.13", "tag": "ghcr.io/quenchworks/images/openldap:2.6.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.6.13", "tag": "ghcr.io/quenchworks/images/openldap:2.6.13", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "opensearch", "name": "OpenSearch", "category": "Search", "summary": "Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.1", "appVersion": "3.7.0", "description": "Search and analytics suite with a Kibana-style dashboards UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/opensearch", "imageDigest": "sha256:b14f3ca466499405a7f2d0b375d8976eb7e1eec7c9a40aae2e37c83eb9b32e6b", "repositoryID": "19bdd691-33a2-4882-8662-4871a10038fe", "upstream": "https://github.com/opensearch-project/OpenSearch", "chartRef": "oci://ghcr.io/quenchworks/charts/opensearch", "images": [ { "name": "opensearch", "image": "ghcr.io/quenchworks/images/opensearch@sha256:b14f3ca466499405a7f2d0b375d8976eb7e1eec7c9a40aae2e37c83eb9b32e6b" } ], "security": { "image": "ghcr.io/quenchworks/images/opensearch", "version": "3.7.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.7.0", "critical": 0, "high": 19, "medium": 30, "low": 0, "unknown": 0, "total": 49, "fixable": 49, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-10050", "severity": "HIGH", "pkg": "org.eclipse.jetty:jetty-security", "installed": "9.4.58.v20250814", "fixed": "9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10", "title": "Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution", "url": "https://avd.aquasec.com/nvd/cve-2026-10050", "targets": [ "Java" ] }, { "id": "CVE-2026-55831", "severity": "HIGH", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "url": "https://avd.aquasec.com/nvd/cve-2026-55831", "targets": [ "Java" ] }, { "id": "CVE-2026-55833", "severity": "HIGH", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "url": "https://avd.aquasec.com/nvd/cve-2026-55833", "targets": [ "Java" ] }, { "id": "CVE-2026-56745", "severity": "HIGH", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "url": "https://avd.aquasec.com/nvd/cve-2026-56745", "targets": [ "Java" ] }, { "id": "CVE-2026-56816", "severity": "HIGH", "pkg": "io.netty:netty-codec-http3", "installed": "4.2.15.Final", "fixed": "4.2.16.Final", "title": "Netty is a network application framework for development of protocol s ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56816", "targets": [ "Java" ] }, { "id": "CVE-2026-59901", "severity": "HIGH", "pkg": "io.netty:netty-codec-compression", "installed": "4.2.15.Final", "fixed": "4.2.16.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "url": "https://avd.aquasec.com/nvd/cve-2026-59901", "targets": [ "Java" ] }, { "id": "GHSA-r7wm-3cxj-wff9", "severity": "HIGH", "pkg": "com.fasterxml.jackson.core:jackson-core", "installed": "2.21.3", "fixed": "2.18.8, 2.21.4, 2.22.1", "title": "jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)", "url": "https://github.com/advisories/GHSA-r7wm-3cxj-wff9", "targets": [ "Java" ] }, { "id": "GHSA-r7wm-3cxj-wff9", "severity": "HIGH", "pkg": "tools.jackson.core:jackson-core", "installed": "3.1.3", "fixed": "3.1.4, 3.2.1", "title": "jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)", "url": "https://github.com/advisories/GHSA-r7wm-3cxj-wff9", "targets": [ "Java" ] }, { "id": "CVE-2026-56746", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "url": "https://avd.aquasec.com/nvd/cve-2026-56746", "targets": [ "Java" ] }, { "id": "CVE-2026-59889", "severity": "MEDIUM", "pkg": "tools.jackson.core:jackson-databind", "installed": "3.1.4", "fixed": "3.1.5, 3.2.1", "title": "jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-59889", "targets": [ "Java" ] }, { "id": "CVE-2026-59898", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "url": "https://avd.aquasec.com/nvd/cve-2026-59898", "targets": [ "Java" ] }, { "id": "CVE-2026-59899", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "url": "https://avd.aquasec.com/nvd/cve-2026-59899", "targets": [ "Java" ] }, { "id": "CVE-2026-59900", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http2", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "url": "https://avd.aquasec.com/nvd/cve-2026-59900", "targets": [ "Java" ] }, { "id": "CVE-2026-59921", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "url": "https://avd.aquasec.com/nvd/cve-2026-59921", "targets": [ "Java" ] } ], "versions": [ { "version": "3.7.0", "tag": "ghcr.io/quenchworks/images/opensearch:3.7.0", "critical": 0, "high": 19, "medium": 30, "low": 0, "unknown": 0, "total": 49, "fixable": 49, "grade": "D", "score": 0, "cves": [ { "id": "CVE-2026-10050", "severity": "HIGH", "pkg": "org.eclipse.jetty:jetty-security", "installed": "9.4.58.v20250814", "fixed": "9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10", "title": "Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution", "url": "https://avd.aquasec.com/nvd/cve-2026-10050", "targets": [ "Java" ] }, { "id": "CVE-2026-55831", "severity": "HIGH", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "url": "https://avd.aquasec.com/nvd/cve-2026-55831", "targets": [ "Java" ] }, { "id": "CVE-2026-55833", "severity": "HIGH", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "url": "https://avd.aquasec.com/nvd/cve-2026-55833", "targets": [ "Java" ] }, { "id": "CVE-2026-56745", "severity": "HIGH", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "url": "https://avd.aquasec.com/nvd/cve-2026-56745", "targets": [ "Java" ] }, { "id": "CVE-2026-56816", "severity": "HIGH", "pkg": "io.netty:netty-codec-http3", "installed": "4.2.15.Final", "fixed": "4.2.16.Final", "title": "Netty is a network application framework for development of protocol s ...", "url": "https://avd.aquasec.com/nvd/cve-2026-56816", "targets": [ "Java" ] }, { "id": "CVE-2026-59901", "severity": "HIGH", "pkg": "io.netty:netty-codec-compression", "installed": "4.2.15.Final", "fixed": "4.2.16.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "url": "https://avd.aquasec.com/nvd/cve-2026-59901", "targets": [ "Java" ] }, { "id": "GHSA-r7wm-3cxj-wff9", "severity": "HIGH", "pkg": "com.fasterxml.jackson.core:jackson-core", "installed": "2.21.3", "fixed": "2.18.8, 2.21.4, 2.22.1", "title": "jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)", "url": "https://github.com/advisories/GHSA-r7wm-3cxj-wff9", "targets": [ "Java" ] }, { "id": "GHSA-r7wm-3cxj-wff9", "severity": "HIGH", "pkg": "tools.jackson.core:jackson-core", "installed": "3.1.3", "fixed": "3.1.4, 3.2.1", "title": "jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)", "url": "https://github.com/advisories/GHSA-r7wm-3cxj-wff9", "targets": [ "Java" ] }, { "id": "CVE-2026-56746", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "url": "https://avd.aquasec.com/nvd/cve-2026-56746", "targets": [ "Java" ] }, { "id": "CVE-2026-59889", "severity": "MEDIUM", "pkg": "tools.jackson.core:jackson-databind", "installed": "3.1.4", "fixed": "3.1.5, 3.2.1", "title": "jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization", "url": "https://avd.aquasec.com/nvd/cve-2026-59889", "targets": [ "Java" ] }, { "id": "CVE-2026-59898", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "url": "https://avd.aquasec.com/nvd/cve-2026-59898", "targets": [ "Java" ] }, { "id": "CVE-2026-59899", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "url": "https://avd.aquasec.com/nvd/cve-2026-59899", "targets": [ "Java" ] }, { "id": "CVE-2026-59900", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http2", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "url": "https://avd.aquasec.com/nvd/cve-2026-59900", "targets": [ "Java" ] }, { "id": "CVE-2026-59921", "severity": "MEDIUM", "pkg": "io.netty:netty-codec-http", "installed": "4.2.15.Final", "fixed": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "url": "https://avd.aquasec.com/nvd/cve-2026-59921", "targets": [ "Java" ] } ] } ] } }, { "slug": "otel-collector", "name": "OpenTelemetry Collector", "category": "Observability", "summary": "OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "0.156.0", "description": "OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/otel-collector", "imageDigest": "sha256:4e544e87eb18026b7e717bcb1249d38ba3d63b0653d829f7c21f0f159048c752", "repositoryID": "07621d0b-a78b-4d04-9db9-bd131e773814", "upstream": "https://github.com/open-telemetry/opentelemetry-collector", "chartRef": "oci://ghcr.io/quenchworks/charts/otel-collector", "images": [ { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:4e544e87eb18026b7e717bcb1249d38ba3d63b0653d829f7c21f0f159048c752" } ], "security": { "image": "ghcr.io/quenchworks/images/otel-collector", "version": "0.156.0", "tag": "ghcr.io/quenchworks/images/otel-collector:0.156.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ], "versions": [ { "version": "0.156.0", "tag": "ghcr.io/quenchworks/images/otel-collector:0.156.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/otelcol-contrib" ] } ] } ] } }, { "slug": "perses", "name": "perses", "category": "Observability", "summary": "CNCF dashboards and observability visualization tool with an embedded React UI and 24 default panel/datasource plugins. From source (Node UI build embedded in a static Go binary) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "0.53.1", "description": "Perses, the CNCF open dashboard and observability visualization tool. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/perses", "imageDigest": "sha256:10bad8982a39acfa681a6824fadb66d17bdc2d22c59406e69dbb6af11eea7147", "repositoryID": "7a12501c-9e30-4882-aad7-fba587e08572", "port": 8080, "upstream": "https://perses.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/perses", "images": [ { "name": "perses", "image": "ghcr.io/quenchworks/images/perses@sha256:10bad8982a39acfa681a6824fadb66d17bdc2d22c59406e69dbb6af11eea7147" } ], "security": { "image": "ghcr.io/quenchworks/images/perses", "version": "0.53.1", "tag": "ghcr.io/quenchworks/images/perses:0.53.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/percli", "usr/bin/perses" ] } ], "versions": [ { "version": "0.53.1", "tag": "ghcr.io/quenchworks/images/perses:0.53.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/percli", "usr/bin/perses" ] } ] } ] } }, { "slug": "pgbouncer", "name": "pgbouncer", "category": "Relational", "summary": "Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead.", "tier": "standard", "license": "ISC", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "1.25.2", "description": "Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pgbouncer", "imageDigest": "sha256:e1c0e92e4abb1259def3adb3766fece53f2c90c10aad1cfc867ab8f102a6efe6", "repositoryID": "464615b6-6f41-496a-a458-d27fea6e29e5", "port": 6432, "upstream": "https://github.com/pgbouncer/pgbouncer", "chartRef": "oci://ghcr.io/quenchworks/charts/pgbouncer", "images": [ { "name": "pgbouncer", "image": "ghcr.io/quenchworks/images/pgbouncer@sha256:e1c0e92e4abb1259def3adb3766fece53f2c90c10aad1cfc867ab8f102a6efe6" } ], "security": { "image": "ghcr.io/quenchworks/images/pgbouncer", "version": "1.25.2", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.25.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.25.2", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.25.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.24.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.24.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.23.1", "tag": "ghcr.io/quenchworks/images/pgbouncer:1.23.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pgpool", "name": "pgpool", "category": "Relational", "summary": "PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across streaming-replication standbys, and detaches a backend that fails its health check.", "tier": "standard", "license": "HPND", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "4.7.2", "description": "PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across replicas, and fails over to a new primary automatically. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pgpool", "imageDigest": "sha256:4dea6db1cc99a9821959378a89fb70625382e8c745eca055a19db8d7ab9385e9", "repositoryID": "a4b2c7da-4403-4221-82ca-561028a2e744", "port": 9999, "upstream": "https://git.postgresql.org/gitweb/?p=pgpool2.git", "chartRef": "oci://ghcr.io/quenchworks/charts/pgpool", "images": [ { "name": "pgpool", "image": "ghcr.io/quenchworks/images/pgpool@sha256:4dea6db1cc99a9821959378a89fb70625382e8c745eca055a19db8d7ab9385e9" } ], "security": { "image": "ghcr.io/quenchworks/images/pgpool", "version": "4.7.2", "tag": "ghcr.io/quenchworks/images/pgpool:4.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.7.2", "tag": "ghcr.io/quenchworks/images/pgpool:4.7.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.6.7", "tag": "ghcr.io/quenchworks/images/pgpool:4.6.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.5.12", "tag": "ghcr.io/quenchworks/images/pgpool:4.5.12", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pocketbase", "name": "pocketbase", "category": "Apps & productivity", "summary": "Open-source backend in a single file with an embedded SQLite database, auth, file storage, realtime subscriptions, and an admin dashboard over a REST API. Pure-Go static binary (UI embedded) on a hardened nonroot Wolfi base; state on a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.39.5", "description": "Open-source backend in one Go binary (SQLite DB + auth + file storage + admin UI + realtime REST API). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pocketbase", "imageDigest": "sha256:01c7db103bf8030aa55e3732a8c416bd9947d055b941546e860618cb4e8a9d32", "repositoryID": "c5f062bc-0349-4ca6-94ec-d9d5bfbccb78", "port": 80, "upstream": "https://pocketbase.io", "chartRef": "oci://ghcr.io/quenchworks/charts/pocketbase", "images": [ { "name": "pocketbase", "image": "ghcr.io/quenchworks/images/pocketbase@sha256:01c7db103bf8030aa55e3732a8c416bd9947d055b941546e860618cb4e8a9d32" } ], "security": { "image": "ghcr.io/quenchworks/images/pocketbase", "version": "0.39.5", "tag": "ghcr.io/quenchworks/images/pocketbase:0.39.5", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 2, "fixable": 0, "grade": "B", "score": 97, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/pocketbase" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pocketbase" ] } ], "versions": [ { "version": "0.39.5", "tag": "ghcr.io/quenchworks/images/pocketbase:0.39.5", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 2, "fixable": 0, "grade": "B", "score": 97, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/pocketbase" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pocketbase" ] } ] } ] } }, { "slug": "postgresql", "name": "PostgreSQL", "category": "Relational", "summary": "Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. The catalog's default SQL engine.", "tier": "critical", "license": "PostgreSQL", "licenseClean": "clean", "chartVersion": "0.0.16", "appVersion": "18.4", "description": "Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/postgresql", "imageDigest": "sha256:949125181299709eff3ede2d74a3d04dd982279a3510ffcc907eae51eb037fd3", "repositoryID": "f73f0b94-2c4e-4918-8720-8152e260e2b1", "port": 5432, "upstream": "https://github.com/postgres/postgres", "chartRef": "oci://ghcr.io/quenchworks/charts/postgresql", "images": [ { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:949125181299709eff3ede2d74a3d04dd982279a3510ffcc907eae51eb037fd3" }, { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:6d3fcf2163469d93bcd379b466599927ec66b84c864335534549f9cb00a635b8" } ], "security": { "image": "ghcr.io/quenchworks/images/postgresql", "version": "18.4", "tag": "ghcr.io/quenchworks/images/postgresql:18.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "18.4", "tag": "ghcr.io/quenchworks/images/postgresql:18.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "17.10", "tag": "ghcr.io/quenchworks/images/postgresql:17.10", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "16.14", "tag": "ghcr.io/quenchworks/images/postgresql:16.14", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "postgres-documentdb", "name": "PostgreSQL + DocumentDB", "category": "Document", "summary": "PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. The storage backend that powers FerretDB v2.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.10", "appVersion": "0.107.0", "description": "PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/postgres-documentdb", "imageDigest": "sha256:39c2571a1ec2c21922b082462198a1afa34abfb32fc54b23463ed1663a2cf73c", "repositoryID": "4d6304a8-b68f-41dd-8f4e-4d4faf64acb0", "port": 5432, "upstream": "https://github.com/FerretDB/documentdb", "chartRef": "oci://ghcr.io/quenchworks/charts/postgres-documentdb", "images": [ { "name": "postgres-documentdb", "image": "ghcr.io/quenchworks/images/postgres-documentdb@sha256:39c2571a1ec2c21922b082462198a1afa34abfb32fc54b23463ed1663a2cf73c" }, { "name": "postgres-exporter", "image": "ghcr.io/quenchworks/images/postgres-exporter@sha256:6d3fcf2163469d93bcd379b466599927ec66b84c864335534549f9cb00a635b8" } ], "security": { "image": "ghcr.io/quenchworks/images/postgres-documentdb", "version": "0.107.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.107.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.107.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.107.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.106.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.106.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.105.0", "tag": "ghcr.io/quenchworks/images/postgres-documentdb:0.105.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "prometheus", "name": "Prometheus", "category": "Observability", "summary": "Metrics collection, storage, and alerting system that scrapes targets and runs PromQL queries. The de-facto cloud-native monitoring TSDB.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "3.13.1", "description": "Metrics collection, storage, and alerting system that scrapes targets and runs PromQL queries. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/prometheus", "imageDigest": "sha256:75da3329773a48704c8337b1dc10b1d651ed0011261087a4feb8ebe40262e2de", "repositoryID": "a1ea88ca-6c90-4a7d-b020-53879714aecb", "port": 9090, "upstream": "https://github.com/prometheus/prometheus", "chartRef": "oci://ghcr.io/quenchworks/charts/prometheus", "images": [ { "name": "prometheus", "image": "ghcr.io/quenchworks/images/prometheus@sha256:75da3329773a48704c8337b1dc10b1d651ed0011261087a4feb8ebe40262e2de" } ], "security": { "image": "ghcr.io/quenchworks/images/prometheus", "version": "3.13.1", "tag": "ghcr.io/quenchworks/images/prometheus:3.13.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] } ], "versions": [ { "version": "3.13.1", "tag": "ghcr.io/quenchworks/images/prometheus:3.13.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/prometheus", "usr/bin/promtool" ] } ] } ] } }, { "slug": "pulsar", "name": "Pulsar", "category": "Messaging", "summary": "Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "4.2.3", "description": "Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pulsar", "imageDigest": "sha256:6a11b321dba3c75a7d88f4d2e9c7334a85b021e7184ca083a0d98331efa94f36", "repositoryID": "6820f31e-b254-41f1-bced-a801f69cca0b", "upstream": "https://github.com/apache/pulsar", "chartRef": "oci://ghcr.io/quenchworks/charts/pulsar", "images": [ { "name": "pulsar", "image": "ghcr.io/quenchworks/images/pulsar@sha256:6a11b321dba3c75a7d88f4d2e9c7334a85b021e7184ca083a0d98331efa94f36" } ], "security": { "image": "ghcr.io/quenchworks/images/pulsar", "version": "4.2.3", "tag": "ghcr.io/quenchworks/images/pulsar:4.2.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.2.3", "tag": "ghcr.io/quenchworks/images/pulsar:4.2.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "pyroscope", "name": "pyroscope", "category": "Observability", "summary": "Continuous profiling database for analyzing CPU, memory, and other resource usage over time. From source with the React UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.5", "appVersion": "2.1.0", "description": "Grafana Pyroscope continuous-profiling database (Go, single-binary -target=all). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/pyroscope", "imageDigest": "sha256:d1c3716254a3d83ac12a78d08b03a7bad82b5330eb4b6fb82be26c888a3af552", "repositoryID": "1d01e624-c16c-422b-8e4a-78744b117f13", "port": 4040, "upstream": "https://grafana.com/oss/pyroscope", "chartRef": "oci://ghcr.io/quenchworks/charts/pyroscope", "images": [ { "name": "pyroscope", "image": "ghcr.io/quenchworks/images/pyroscope@sha256:d1c3716254a3d83ac12a78d08b03a7bad82b5330eb4b6fb82be26c888a3af552" } ], "security": { "image": "ghcr.io/quenchworks/images/pyroscope", "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/pyroscope:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ], "versions": [ { "version": "2.1.0", "tag": "ghcr.io/quenchworks/images/pyroscope:2.1.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/pyroscope" ] } ] } ] } }, { "slug": "qdrant", "name": "Qdrant", "category": "Vector", "summary": "Vector database and similarity-search engine for AI embeddings, powering semantic search, recommendations, and RAG with filtered nearest-neighbor queries.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.18.3", "description": "Vector database and similarity-search engine for AI embeddings, powering semantic search, recommendations, and RAG with filtered nearest-neighbor queries. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/qdrant", "imageDigest": "sha256:981a6f4dd9924a6b6630ccb29419ecb5b4b1963db830b0b2d1793041281f4ff2", "repositoryID": "a2deb908-d256-44ff-a71b-fe4c316619d0", "port": 6333, "upstream": "https://github.com/qdrant/qdrant", "chartRef": "oci://ghcr.io/quenchworks/charts/qdrant", "images": [ { "name": "qdrant", "image": "ghcr.io/quenchworks/images/qdrant@sha256:981a6f4dd9924a6b6630ccb29419ecb5b4b1963db830b0b2d1793041281f4ff2" } ], "security": { "image": "ghcr.io/quenchworks/images/qdrant", "version": "1.18.3", "tag": "ghcr.io/quenchworks/images/qdrant:1.18.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.18.3", "tag": "ghcr.io/quenchworks/images/qdrant:1.18.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "questdb", "name": "questdb", "category": "Time series", "summary": "High-performance time-series SQL database for fast ingestion and queries over metrics, financial ticks, and IoT data, with PostgreSQL-wire and InfluxDB line-protocol ingestion.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "9.4.3", "description": "High-performance time-series SQL database for fast ingestion and queries over metrics, financial ticks, and IoT data. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/questdb", "imageDigest": "sha256:dcb5f489ccf8419df8baaf29f81d12d197a148edbfa89a96e37ac0b5cbf1b582", "repositoryID": "c8f1bd93-57f9-41dc-91ed-deef1bd43608", "upstream": "https://github.com/questdb/questdb", "chartRef": "oci://ghcr.io/quenchworks/charts/questdb", "images": [ { "name": "questdb", "image": "ghcr.io/quenchworks/images/questdb@sha256:dcb5f489ccf8419df8baaf29f81d12d197a148edbfa89a96e37ac0b5cbf1b582" } ], "security": { "image": "ghcr.io/quenchworks/images/questdb", "version": "9.4.3", "tag": "ghcr.io/quenchworks/images/questdb:9.4.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.4.3", "tag": "ghcr.io/quenchworks/images/questdb:9.4.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.4.2", "tag": "ghcr.io/quenchworks/images/questdb:9.4.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.4.1", "tag": "ghcr.io/quenchworks/images/questdb:9.4.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "quickwit", "name": "quickwit", "category": "Search", "summary": "Cloud-native search engine for logs, traces, and analytics with sub-second search over object storage. Built from Rust source (UI embedded, no Node at runtime) on a hardened nonroot Wolfi base; index data on object storage or a writable volume.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.3", "appVersion": "0.8.2", "description": "Cloud-native search engine for logs & traces (Rust) with a bundled admin UI. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/quickwit", "imageDigest": "sha256:c4ae313ed9dc0e7539bfc4315779a4cd1baef6878b10f87d0d9da8ecf2da81ba", "repositoryID": "a0c7c3b1-912f-42f3-837f-b09ca389d340", "port": 7280, "upstream": "https://quickwit.io", "chartRef": "oci://ghcr.io/quenchworks/charts/quickwit", "images": [ { "name": "quickwit", "image": "ghcr.io/quenchworks/images/quickwit@sha256:c4ae313ed9dc0e7539bfc4315779a4cd1baef6878b10f87d0d9da8ecf2da81ba" } ], "security": { "image": "ghcr.io/quenchworks/images/quickwit", "version": "0.8.2", "tag": "ghcr.io/quenchworks/images/quickwit:0.8.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.8.2", "tag": "ghcr.io/quenchworks/images/quickwit:0.8.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rabbitmq", "name": "RabbitMQ", "category": "Messaging", "summary": "Reliable message broker speaking AMQP plus MQTT and STOMP, with flexible routing, queues, and acknowledgements for decoupling services.", "tier": "critical", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "4.3.4", "description": "Reliable message broker speaking AMQP plus MQTT and STOMP, with flexible routing, queues, and acknowledgements for decoupling services. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rabbitmq", "imageDigest": "sha256:9321555e564ac1c81379902143635a43e5cff262578d37c8707d868cbaf05851", "repositoryID": "030e0367-02fa-4bcd-83e5-d05889532553", "port": 5672, "upstream": "https://github.com/rabbitmq/rabbitmq-server", "chartRef": "oci://ghcr.io/quenchworks/charts/rabbitmq", "images": [ { "name": "rabbitmq", "image": "ghcr.io/quenchworks/images/rabbitmq@sha256:9321555e564ac1c81379902143635a43e5cff262578d37c8707d868cbaf05851" } ], "security": { "image": "ghcr.io/quenchworks/images/rabbitmq", "version": "4.3.4", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.3.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "4.3.4", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.3.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.2.8", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.2.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "4.1.8", "tag": "ghcr.io/quenchworks/images/rabbitmq:4.1.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "redis", "name": "Redis", "category": "Cache", "summary": "In-memory key-value store used as a cache, message broker, and ephemeral datastore. Shipped under AGPL (not permissive); Valkey is the BSD-licensed open alternative.", "tier": "critical", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.15", "appVersion": "8.10.0", "description": "In-memory key-value store used as a cache, message broker, and ephemeral datastore. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/redis", "imageDigest": "sha256:95942647e5f2eeaefb01fd34d95d796b3fddfa5d38d67050710c8b99893d1c08", "repositoryID": "8bef6dc9-50b6-406e-928b-c50115e83c02", "port": 6379, "upstream": "https://github.com/redis/redis", "chartRef": "oci://ghcr.io/quenchworks/charts/redis", "images": [ { "name": "redis", "image": "ghcr.io/quenchworks/images/redis@sha256:95942647e5f2eeaefb01fd34d95d796b3fddfa5d38d67050710c8b99893d1c08" }, { "name": "redis-exporter", "image": "ghcr.io/quenchworks/images/redis-exporter@sha256:41655ee4573807859c2d4fbc9ef5655961ed80cb66434376fc8369f467f7240d" } ], "security": { "image": "ghcr.io/quenchworks/images/redis", "version": "8.8.1", "tag": "ghcr.io/quenchworks/images/redis:8.8.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "8.8.1", "tag": "ghcr.io/quenchworks/images/redis:8.8.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.6.4", "tag": "ghcr.io/quenchworks/images/redis:8.6.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.4.4", "tag": "ghcr.io/quenchworks/images/redis:8.4.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "rqlite", "name": "rqlite", "category": "Relational", "summary": "Lightweight, distributed relational database built on SQLite and Raft. Ships rqlited and the rqlite CLI as static (musl) Go binaries on a hardened nonroot Wolfi base; data dir is a writable volume.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "10.2.5", "description": "Lightweight distributed relational database built on SQLite with Raft consensus (Go). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rqlite", "imageDigest": "sha256:8322ad9a89976557cc70e94500ea1521a590a48cc0d8b41beffbff25c6a8a7e6", "repositoryID": "e66bc57f-d10d-4e7c-a13d-a663d33c3d32", "upstream": "https://rqlite.io", "chartRef": "oci://ghcr.io/quenchworks/charts/rqlite", "images": [ { "name": "rqlite", "image": "ghcr.io/quenchworks/images/rqlite@sha256:8322ad9a89976557cc70e94500ea1521a590a48cc0d8b41beffbff25c6a8a7e6" } ], "security": { "image": "ghcr.io/quenchworks/images/rqlite", "version": "10.2.5", "tag": "ghcr.io/quenchworks/images/rqlite:10.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ], "versions": [ { "version": "10.2.5", "tag": "ghcr.io/quenchworks/images/rqlite:10.2.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/rqlite" ] } ] } ] } }, { "slug": "rustfs", "name": "RustFS", "category": "Object storage", "summary": "S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Beta/preview.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "1.0.0_beta12", "description": "S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/rustfs", "imageDigest": "sha256:db83dde295d0b8c980a16eb3bbb455116abdb56e1f9770389f85a063c759f18c", "repositoryID": "304c53e5-aaac-42f5-b1bb-aa702aaf1596", "port": 9000, "upstream": "https://github.com/rustfs/rustfs", "chartRef": "oci://ghcr.io/quenchworks/charts/rustfs", "images": [ { "name": "rustfs", "image": "ghcr.io/quenchworks/images/rustfs@sha256:db83dde295d0b8c980a16eb3bbb455116abdb56e1f9770389f85a063c759f18c" } ], "security": { "image": "ghcr.io/quenchworks/images/rustfs", "version": "1.0.0_beta11_p1", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.0_beta11_p1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.0.0_beta11_p1", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.0_beta11_p1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.0.0_beta11", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.0_beta11", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "1.0.0_beta10_p5", "tag": "ghcr.io/quenchworks/images/rustfs:1.0.0_beta10_p5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "scylladb", "name": "ScyllaDB", "category": "Wide-column", "summary": "High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. This 6.x build is the final OSS line under AGPL.", "tier": "low", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.11", "appVersion": "2026.2.2", "description": "High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/scylladb", "imageDigest": "sha256:e96ca9dd6b6c8c278639945a4a68dcb7c4f093255eced4c2124bb7923a59bfaa", "repositoryID": "c7b3870a-4c0f-47a7-a129-f34c038e1614", "upstream": "https://github.com/scylladb/scylladb", "chartRef": "oci://ghcr.io/quenchworks/charts/scylladb", "images": [ { "name": "scylladb", "image": "ghcr.io/quenchworks/images/scylladb@sha256:e96ca9dd6b6c8c278639945a4a68dcb7c4f093255eced4c2124bb7923a59bfaa" } ], "security": { "image": "ghcr.io/quenchworks/images/scylladb", "version": "2026.2.2", "tag": "ghcr.io/quenchworks/images/scylladb:2026.2.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2026.2.2", "tag": "ghcr.io/quenchworks/images/scylladb:2026.2.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "sealed-secrets", "name": "sealed-secrets", "category": "Security & supply chain", "summary": "Sealed Secrets, the controller that lets you commit encrypted secrets to Git safely. A cluster-side private key decrypts SealedSecret resources into ordinary Kubernetes Secrets, so the encrypted form is the only thing that ever leaves the cluster.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "0.38.4", "description": "Sealed Secrets, the Kubernetes controller that decrypts one-way-encrypted SealedSecret resources into regular Secrets, so secrets can live safely in Git. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/sealed-secrets", "imageDigest": "sha256:7e2522cfc9ed4f82ffd15037afe2055c029e4bbfc9eb2c54e09850e83e957d47", "repositoryID": "5377705a-ca51-404c-b247-2f7624640606", "port": 8080, "upstream": "https://sealed-secrets.netlify.app", "chartRef": "oci://ghcr.io/quenchworks/charts/sealed-secrets", "images": [ { "name": "sealed-secrets", "image": "ghcr.io/quenchworks/images/sealed-secrets@sha256:7e2522cfc9ed4f82ffd15037afe2055c029e4bbfc9eb2c54e09850e83e957d47" } ], "security": { "image": "ghcr.io/quenchworks/images/sealed-secrets", "version": "0.38.4", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.38.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ], "versions": [ { "version": "0.38.4", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.38.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "0.37.0", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.37.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] }, { "version": "0.36.6", "tag": "ghcr.io/quenchworks/images/sealed-secrets:0.36.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/controller" ] } ] } ] } }, { "slug": "seaweedfs", "name": "SeaweedFS", "category": "Object storage", "summary": "Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Default object store after MinIO restricted its community edition.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.14", "appVersion": "4.40", "description": "Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/seaweedfs", "imageDigest": "sha256:7bb0bbc92fe277023f63e0292ae272231d54161948225a982213578bc41e775e", "repositoryID": "c0e22525-4794-4f13-a436-671e0a536544", "port": 8333, "upstream": "https://github.com/seaweedfs/seaweedfs", "chartRef": "oci://ghcr.io/quenchworks/charts/seaweedfs", "images": [ { "name": "seaweedfs", "image": "ghcr.io/quenchworks/images/seaweedfs@sha256:7bb0bbc92fe277023f63e0292ae272231d54161948225a982213578bc41e775e" } ], "security": { "image": "ghcr.io/quenchworks/images/seaweedfs", "version": "4.40", "tag": "ghcr.io/quenchworks/images/seaweedfs:4.40", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weed" ] } ], "versions": [ { "version": "4.40", "tag": "ghcr.io/quenchworks/images/seaweedfs:4.40", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weed" ] } ] } ] } }, { "slug": "skywalking", "name": "skywalking", "category": "Datastore", "summary": "Hardened skywalking image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "10.4.0", "description": "Hardened Apache SkyWalking OAP (Observability Analysis Platform) backend — APM metrics/traces/logs collector — on a 0-CVE nonroot image, with an optional bundled Elasticsearch storage backend.", "imageRepository": "ghcr.io/quenchworks/images/skywalking", "imageDigest": "sha256:9b14e8630207b5445f28958609c9d9470803fe0e6ed7fb38837cfc6783da1f9d", "repositoryID": "a812a44e-e422-4743-b306-09a834e536b5", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/skywalking", "images": [ { "name": "skywalking", "image": "ghcr.io/quenchworks/images/skywalking@sha256:9b14e8630207b5445f28958609c9d9470803fe0e6ed7fb38837cfc6783da1f9d" } ], "security": null }, { "slug": "solr", "name": "Solr", "category": "Search", "summary": "Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "10.0.0", "description": "Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/solr", "imageDigest": "sha256:9fd776670393c21b8d6a16dc02a29c63fe36caa981e23cc648c9a4cf6a08291a", "repositoryID": "454a51ee-3e78-44ca-ba05-0ec7db85503e", "upstream": "https://github.com/apache/solr", "chartRef": "oci://ghcr.io/quenchworks/charts/solr", "images": [ { "name": "solr", "image": "ghcr.io/quenchworks/images/solr@sha256:9fd776670393c21b8d6a16dc02a29c63fe36caa981e23cc648c9a4cf6a08291a" } ], "security": { "image": "ghcr.io/quenchworks/images/solr", "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/solr:10.0.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "D", "score": 90, "cves": [ { "id": "CVE-2026-44825", "severity": "HIGH", "pkg": "org.apache.solr:solr-core", "installed": "10.0.0", "fixed": null, "title": "solr: Apache Solr: Remote attacker gains administrative access via hardcoded credentials in Basic Authentication setup.", "url": "https://avd.aquasec.com/nvd/cve-2026-44825", "targets": [ "Java" ] } ], "versions": [ { "version": "10.0.0", "tag": "ghcr.io/quenchworks/images/solr:10.0.0", "critical": 0, "high": 1, "medium": 0, "low": 0, "unknown": 0, "total": 1, "fixable": 0, "grade": "D", "score": 90, "cves": [ { "id": "CVE-2026-44825", "severity": "HIGH", "pkg": "org.apache.solr:solr-core", "installed": "10.0.0", "fixed": null, "title": "solr: Apache Solr: Remote attacker gains administrative access via hardcoded credentials in Basic Authentication setup.", "url": "https://avd.aquasec.com/nvd/cve-2026-44825", "targets": [ "Java" ] } ] } ] } }, { "slug": "spicedb", "name": "spicedb", "category": "Identity", "summary": "Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "1.56.0", "description": "SpiceDB, the Authzed open-source, Google Zanzibar-inspired database for fine-grained authorization (ReBAC/relationship-based permissions) over a gRPC API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/spicedb", "imageDigest": "sha256:1f8dbdcc20597944240261b491221efd13c77f0c0fd832c28377a5ce9ed82a3d", "repositoryID": "820d8604-d2b5-459b-af41-2be29d05eccf", "upstream": "https://authzed.com", "chartRef": "oci://ghcr.io/quenchworks/charts/spicedb", "images": [ { "name": "spicedb", "image": "ghcr.io/quenchworks/images/spicedb@sha256:1f8dbdcc20597944240261b491221efd13c77f0c0fd832c28377a5ce9ed82a3d" } ], "security": { "image": "ghcr.io/quenchworks/images/spicedb", "version": "1.56.0", "tag": "ghcr.io/quenchworks/images/spicedb:1.56.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ], "versions": [ { "version": "1.56.0", "tag": "ghcr.io/quenchworks/images/spicedb:1.56.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/spicedb" ] } ] } ] } }, { "slug": "step-ca", "name": "step-ca", "category": "Security & supply chain", "summary": "Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "0.30.2", "description": "Smallstep step-ca online certificate authority (ACME/step CA over HTTPS). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest; the bundled step CLI bootstraps the PKI on first boot.", "imageRepository": "ghcr.io/quenchworks/images/step-ca", "imageDigest": "sha256:09210b2c05d273ab2d72811c69d20e42081263f1cbc470de870b7a725c87cd65", "repositoryID": "8d7a2efe-988d-4e8e-9e0f-971f76206012", "port": 443, "upstream": "https://smallstep.com", "chartRef": "oci://ghcr.io/quenchworks/charts/step-ca", "images": [ { "name": "step-ca", "image": "ghcr.io/quenchworks/images/step-ca@sha256:09210b2c05d273ab2d72811c69d20e42081263f1cbc470de870b7a725c87cd65" } ], "security": { "image": "ghcr.io/quenchworks/images/step-ca", "version": "0.30.2", "tag": "ghcr.io/quenchworks/images/step-ca:0.30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] } ], "versions": [ { "version": "0.30.2", "tag": "ghcr.io/quenchworks/images/step-ca:0.30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/step", "usr/bin/step-ca" ] } ] } ] } }, { "slug": "tempo", "name": "Tempo", "category": "Observability", "summary": "Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed AGPL.", "tier": "standard", "license": "AGPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.12", "appVersion": "3.0.2", "description": "Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tempo", "imageDigest": "sha256:069eaae190bd2c5a36c247bd5e535b65d84798618d395ce6654ab24ad53dcb96", "repositoryID": "56401048-50e6-4ee5-925c-bf82224af054", "port": 3200, "upstream": "https://github.com/grafana/tempo", "chartRef": "oci://ghcr.io/quenchworks/charts/tempo", "images": [ { "name": "tempo", "image": "ghcr.io/quenchworks/images/tempo@sha256:069eaae190bd2c5a36c247bd5e535b65d84798618d395ce6654ab24ad53dcb96" } ], "security": { "image": "ghcr.io/quenchworks/images/tempo", "version": "3.0.2", "tag": "ghcr.io/quenchworks/images/tempo:3.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ], "versions": [ { "version": "3.0.2", "tag": "ghcr.io/quenchworks/images/tempo:3.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tempo" ] } ] } ] } }, { "slug": "temporal", "name": "Temporal", "category": "Workflow", "summary": "Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "1.31.2", "description": "Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/temporal", "imageDigest": "sha256:e476bb1280ee530a0d963b1c94f2e50e6328d943e96e2fa4332aa12929b7f833", "repositoryID": "52dca231-7f15-4b72-8150-ed5806969292", "upstream": "https://github.com/temporalio/temporal", "chartRef": "oci://ghcr.io/quenchworks/charts/temporal", "images": [ { "name": "temporal", "image": "ghcr.io/quenchworks/images/temporal@sha256:e476bb1280ee530a0d963b1c94f2e50e6328d943e96e2fa4332aa12929b7f833" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" } ], "security": { "image": "ghcr.io/quenchworks/images/temporal", "version": "1.31.2", "tag": "ghcr.io/quenchworks/images/temporal:1.31.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 0, "grade": "B", "score": 94, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] } ], "versions": [ { "version": "1.31.2", "tag": "ghcr.io/quenchworks/images/temporal:1.31.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 3, "total": 3, "fixable": 0, "grade": "B", "score": 94, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/temporal-cassandra-tool", "usr/bin/temporal-server", "usr/bin/temporal-sql-tool" ] } ] } ] } }, { "slug": "thanos", "name": "thanos", "category": "Datastore", "summary": "Hardened thanos image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "0.42.3", "description": "Thanos, the CNCF highly-available Prometheus setup with long-term storage and a global query view. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. The single binary runs every component (query, receive, store, compact, rule, sidecar) as separate toggleable workloads; this chart ships a self-contained query + receive pair by default.", "imageRepository": "ghcr.io/quenchworks/images/thanos", "imageDigest": "sha256:7a05551ba7b8eb49c8a0c724f1afb0ef6f3652284033a342a74a6705c721b777", "repositoryID": "18b16ed4-ceb8-4911-8a79-6b2cbd555c8f", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/thanos", "images": [ { "name": "thanos", "image": "ghcr.io/quenchworks/images/thanos@sha256:7a05551ba7b8eb49c8a0c724f1afb0ef6f3652284033a342a74a6705c721b777" } ], "security": null }, { "slug": "tigerbeetle", "name": "tigerbeetle", "category": "Database", "summary": "Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Ships a single self-contained static Zig binary; speaks its own binary protocol (not HTTP) on port 3000.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "0.17.9", "description": "Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Single-node standalone.", "imageRepository": "ghcr.io/quenchworks/images/tigerbeetle", "imageDigest": "sha256:81cd83b527c9e21db69417a33b02ef7800702d1e0f0c0754a52e5ed32316887d", "repositoryID": "97c5030c-b1a9-4006-9a1a-f1ed05f576f7", "port": 3000, "upstream": "https://github.com/tigerbeetle/tigerbeetle", "chartRef": "oci://ghcr.io/quenchworks/charts/tigerbeetle", "images": [ { "name": "tigerbeetle", "image": "ghcr.io/quenchworks/images/tigerbeetle@sha256:81cd83b527c9e21db69417a33b02ef7800702d1e0f0c0754a52e5ed32316887d" } ], "security": { "image": "ghcr.io/quenchworks/images/tigerbeetle", "version": "0.17.9", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.17.9", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.17.8", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "0.17.4", "tag": "ghcr.io/quenchworks/images/tigerbeetle:0.17.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "timescaledb", "name": "timescaledb", "category": "Time series", "summary": "PostgreSQL 17 plus the open TimescaleDB extension (Apache-only edition), adding hypertables, continuous aggregates, and time-series functions for high-ingest metrics and event data. Built clean-licensed from source on Wolfi (no TSL community code).", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "2.29.0", "description": "PostgreSQL 17 with the open-source (Apache-2.0) TimescaleDB extension for time-series workloads: hypertables, continuous aggregates, and native compression. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/timescaledb", "imageDigest": "sha256:1a769b019525f5b8f5ae529dd9d8bf8d7c40d689eafd2c2280d9b12951742bdd", "repositoryID": "ab4e6296-ee14-436f-b273-496d5f46527d", "port": 5432, "upstream": "https://www.timescale.com", "chartRef": "oci://ghcr.io/quenchworks/charts/timescaledb", "images": [ { "name": "timescaledb", "image": "ghcr.io/quenchworks/images/timescaledb@sha256:1a769b019525f5b8f5ae529dd9d8bf8d7c40d689eafd2c2280d9b12951742bdd" } ], "security": { "image": "ghcr.io/quenchworks/images/timescaledb", "version": "2.28.3", "tag": "ghcr.io/quenchworks/images/timescaledb:2.28.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "2.28.3", "tag": "ghcr.io/quenchworks/images/timescaledb:2.28.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.28.2", "tag": "ghcr.io/quenchworks/images/timescaledb:2.28.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "2.28.1", "tag": "ghcr.io/quenchworks/images/timescaledb:2.28.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tomcat", "name": "tomcat", "category": "Gateway", "summary": "Apache Tomcat, the widely used open-source Java servlet container and web/application server for running Jakarta Servlet, JSP, and WebSocket web applications.", "tier": "critical", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "11.0.24", "description": "Apache Tomcat servlet container and Jakarta EE web server for running Java web applications and WARs. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image built from source on Wolfi (openjdk-21-jre), cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/tomcat", "imageDigest": "sha256:628940ef118c30a1fe99b5ae44ca590f9f40e22a31bbca58ff943377a8cc913d", "repositoryID": "825f85ca-0b6c-46c0-b7fb-f9d75e9272ac", "port": 8080, "upstream": "https://github.com/apache/tomcat", "chartRef": "oci://ghcr.io/quenchworks/charts/tomcat", "images": [ { "name": "tomcat", "image": "ghcr.io/quenchworks/images/tomcat@sha256:628940ef118c30a1fe99b5ae44ca590f9f40e22a31bbca58ff943377a8cc913d" } ], "security": { "image": "ghcr.io/quenchworks/images/tomcat", "version": "11.0.24", "tag": "ghcr.io/quenchworks/images/tomcat:11.0.24", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "11.0.24", "tag": "ghcr.io/quenchworks/images/tomcat:11.0.24", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "tracing-stack", "name": "tracing-stack", "category": "Stacks", "summary": "Hardened, operator-free distributed tracing stack: Tempo (trace store/query) + Grafana (Tempo datasource + trace exploration) + an OpenTelemetry Collector gateway that receives OTLP from your apps and forwards spans to Tempo.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.4", "appVersion": "1.0.0", "description": "Hardened, operator-free distributed tracing stack: Tempo (trace store/query) + Grafana (Tempo datasource + trace exploration) + an OpenTelemetry Collector gateway that receives OTLP from your apps and forwards spans to Tempo. No operator, no CRDs. All component images are QuenchWorks-hardened, nonroot, 0-CVE, pinned by digest and cosign-signed. Apps send traces to -otel-collector:4317 (OTLP gRPC) / :4318 (OTLP HTTP); explore them in Grafana via Explore -> Tempo.", "repositoryID": "5371e037-2138-4f64-8004-d31b0b01d339", "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/tracing-stack", "stack": true, "components": [ "tempo", "grafana" ], "images": [ { "name": "tempo", "image": "ghcr.io/quenchworks/images/tempo@sha256:2da185a3d2d088a20a975e8bb8a1c1e6522213bda5975380ea0bc01b4779b775" }, { "name": "grafana", "image": "ghcr.io/quenchworks/images/grafana@sha256:ae5dfc810d218c92a6e3e5ae2401317c86ab76206e5f53c3388c74ef7961f995" }, { "name": "otel-collector", "image": "ghcr.io/quenchworks/images/otel-collector@sha256:ed19a525ab80c31f8997e417fbc669fca4bed5c8748264d5f24a99d5d1dcec83" } ], "upstreams": [ "https://github.com/grafana/tempo", "https://github.com/grafana/grafana", "https://github.com/open-telemetry/opentelemetry-collector" ], "security": null }, { "slug": "traefik", "name": "Traefik", "category": "Gateway", "summary": "Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS.", "tier": "standard", "license": "MIT", "licenseClean": "clean", "chartVersion": "0.0.13", "appVersion": "3.7.9", "description": "Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/traefik", "imageDigest": "sha256:8c2d7f3557eae0f28e7aaf9a76c2671d4593f0f494c5f0328f1931da513e829e", "repositoryID": "a2a33f4e-0ce3-4e18-9410-d53e0a6ee38e", "port": 80, "upstream": "https://github.com/traefik/traefik", "chartRef": "oci://ghcr.io/quenchworks/charts/traefik", "images": [ { "name": "traefik", "image": "ghcr.io/quenchworks/images/traefik@sha256:8c2d7f3557eae0f28e7aaf9a76c2671d4593f0f494c5f0328f1931da513e829e" } ], "security": { "image": "ghcr.io/quenchworks/images/traefik", "version": "3.7.9", "tag": "ghcr.io/quenchworks/images/traefik:3.7.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/traefik" ] } ], "versions": [ { "version": "3.7.9", "tag": "ghcr.io/quenchworks/images/traefik:3.7.9", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/traefik" ] } ] } ] } }, { "slug": "tyk", "name": "tyk", "category": "Gateway", "summary": "Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime dependency the operator provides.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.6", "appVersion": "5.13.1", "description": "Tyk Gateway (open-source), a fast, Go-based API gateway backed by Redis. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Ships a bundled Redis by default for a self-contained install.", "imageRepository": "ghcr.io/quenchworks/images/tyk", "imageDigest": "sha256:9cfda1cf047ad83818dd92116b23777d4fbaf7c6974c395a504ca456bcd13c33", "repositoryID": "31e078a5-57aa-431e-bb37-7b5e3087c82f", "port": 80, "upstream": "https://tyk.io", "chartRef": "oci://ghcr.io/quenchworks/charts/tyk", "images": [ { "name": "tyk", "image": "ghcr.io/quenchworks/images/tyk@sha256:9cfda1cf047ad83818dd92116b23777d4fbaf7c6974c395a504ca456bcd13c33" } ], "security": { "image": "ghcr.io/quenchworks/images/tyk", "version": "5.13.1", "tag": "ghcr.io/quenchworks/images/tyk:5.13.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ], "versions": [ { "version": "5.13.1", "tag": "ghcr.io/quenchworks/images/tyk:5.13.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/tyk" ] } ] } ] } }, { "slug": "typesense", "name": "typesense", "category": "Search", "summary": "Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency site and in-app search.", "tier": "standard", "license": "GPL-3.0", "licenseClean": "agpl", "chartVersion": "0.0.1", "appVersion": "30.2", "description": "Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/typesense", "imageDigest": "sha256:cd0f547e0efe05502c9d2dcbef4a2e0071084d4bed694aac244b6c3a5f6e8337", "repositoryID": "bc8a8757-08f3-4728-9309-b29cedead0a8", "port": 8108, "upstream": "https://github.com/typesense/typesense", "chartRef": "oci://ghcr.io/quenchworks/charts/typesense", "images": [ { "name": "typesense", "image": "ghcr.io/quenchworks/images/typesense@sha256:cd0f547e0efe05502c9d2dcbef4a2e0071084d4bed694aac244b6c3a5f6e8337" } ], "security": { "image": "ghcr.io/quenchworks/images/typesense", "version": "30.2", "tag": "ghcr.io/quenchworks/images/typesense:30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "30.2", "tag": "ghcr.io/quenchworks/images/typesense:30.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "29.1", "tag": "ghcr.io/quenchworks/images/typesense:29.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "28.0", "tag": "ghcr.io/quenchworks/images/typesense:28.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "valkey", "name": "Valkey", "category": "Cache", "summary": "BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in replacement.", "tier": "critical", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.15", "appVersion": "9.1.1", "description": "BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/valkey", "imageDigest": "sha256:8ee902be36ca7d49a25607ee77629433f225e89f905e15fdde67dd29a15686f2", "repositoryID": "2b3e73a8-e891-4878-af28-33e8a1dba292", "port": 6379, "upstream": "https://github.com/valkey-io/valkey", "chartRef": "oci://ghcr.io/quenchworks/charts/valkey", "images": [ { "name": "valkey", "image": "ghcr.io/quenchworks/images/valkey@sha256:8ee902be36ca7d49a25607ee77629433f225e89f905e15fdde67dd29a15686f2" }, { "name": "redis-exporter", "image": "ghcr.io/quenchworks/images/redis-exporter@sha256:41655ee4573807859c2d4fbc9ef5655961ed80cb66434376fc8369f467f7240d" } ], "security": { "image": "ghcr.io/quenchworks/images/valkey", "version": "9.1.1", "tag": "ghcr.io/quenchworks/images/valkey:9.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.1.1", "tag": "ghcr.io/quenchworks/images/valkey:9.1.1", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "9.0.4", "tag": "ghcr.io/quenchworks/images/valkey:9.0.4", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.1.8", "tag": "ghcr.io/quenchworks/images/valkey:8.1.8", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "varnish", "name": "varnish", "category": "Cache", "summary": "HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.", "tier": "standard", "license": "BSD-2-Clause", "licenseClean": "clean", "chartVersion": "0.0.1", "appVersion": "9.0.3", "description": "Varnish Cache, the HTTP reverse-proxy cache (web accelerator). Fronts an origin, caches its responses in memory, and serves them without touching the backend. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/varnish", "imageDigest": "sha256:97d1607e3e49d53ec45173a82a8fb9636017b76b05f09ad7f99fe4bb540a7a77", "repositoryID": "d6476825-3478-408a-b9e1-04ded538426c", "port": 80, "upstream": "https://www.varnish.org", "chartRef": "oci://ghcr.io/quenchworks/charts/varnish", "images": [ { "name": "varnish", "image": "ghcr.io/quenchworks/images/varnish@sha256:97d1607e3e49d53ec45173a82a8fb9636017b76b05f09ad7f99fe4bb540a7a77" } ], "security": { "image": "ghcr.io/quenchworks/images/varnish", "version": "9.0.3", "tag": "ghcr.io/quenchworks/images/varnish:9.0.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "9.0.3", "tag": "ghcr.io/quenchworks/images/varnish:9.0.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "8.0.0", "tag": "ghcr.io/quenchworks/images/varnish:8.0.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "7.7.3", "tag": "ghcr.io/quenchworks/images/varnish:7.7.3", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "vault", "name": "vault", "category": "Secrets", "summary": "Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source without the web UI; the 1.20.x line is CVE-blocked upstream and not shipped.", "tier": "low", "license": "BUSL-1.1", "licenseClean": "caution", "chartVersion": "0.0.1", "appVersion": "2.0.3", "description": "Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. Shipped under the Business Source License, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vault", "imageDigest": "sha256:3428da8e9cee6078dfb909784150e6ac487123ffa13c94091f18b82c8865d893", "repositoryID": "f21e3927-e0b6-4bb2-a660-90a3795afa4f", "upstream": "https://github.com/hashicorp/vault", "chartRef": "oci://ghcr.io/quenchworks/charts/vault", "images": [ { "name": "vault", "image": "ghcr.io/quenchworks/images/vault@sha256:3428da8e9cee6078dfb909784150e6ac487123ffa13c94091f18b82c8865d893" } ], "caution": true, "security": null }, { "slug": "vector", "name": "Vector", "category": "Observability", "summary": "High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.", "tier": "standard", "license": "MPL-2.0", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "0.56.0", "description": "High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vector", "imageDigest": "sha256:585def3cf0583f7cd27de242940b2f9196b79bd3832a079970c1d8fedd607d3c", "repositoryID": "8f957e7a-a457-4ec0-8e5b-b6761b06463d", "upstream": "https://github.com/vectordotdev/vector", "chartRef": "oci://ghcr.io/quenchworks/charts/vector", "images": [ { "name": "vector", "image": "ghcr.io/quenchworks/images/vector@sha256:585def3cf0583f7cd27de242940b2f9196b79bd3832a079970c1d8fedd607d3c" } ], "security": { "image": "ghcr.io/quenchworks/images/vector", "version": "0.57.0", "tag": "ghcr.io/quenchworks/images/vector:0.57.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "0.57.0", "tag": "ghcr.io/quenchworks/images/vector:0.57.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "velero", "name": "velero", "category": "Storage & platform", "summary": "CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.1.2", "appVersion": "1.18.2", "description": "Velero, the CNCF backup and disaster-recovery controller for Kubernetes cluster resources and persistent volumes. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Runs the velero server as a single Deployment; object-store and volume-snapshot backends are plugged in as initContainers.", "imageRepository": "ghcr.io/quenchworks/images/velero", "imageDigest": "sha256:6d22413905ef1e3c2c04197fb2b6b446665ad9f2e72050dc75894b3029d196f8", "repositoryID": "cf1f3537-cbf6-46b5-9892-ed260f3b3765", "upstream": "https://velero.io", "chartRef": "oci://ghcr.io/quenchworks/charts/velero", "images": [ { "name": "velero", "image": "ghcr.io/quenchworks/images/velero@sha256:6d22413905ef1e3c2c04197fb2b6b446665ad9f2e72050dc75894b3029d196f8" } ], "security": { "image": "ghcr.io/quenchworks/images/velero", "version": "1.18.2", "tag": "ghcr.io/quenchworks/images/velero:1.18.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/velero" ] } ], "versions": [ { "version": "1.18.2", "tag": "ghcr.io/quenchworks/images/velero:1.18.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/velero" ] } ] } ] } }, { "slug": "victorialogs", "name": "victorialogs", "category": "Observability", "summary": "Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "1.51.0", "description": "Single-binary log database (VictoriaLogs, Go) with an HTTP ingestion + query API. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/victorialogs", "imageDigest": "sha256:bd1f3a98a422a596d6f9c776dc08c5f36ddbc61c0584c8e38fc395eb406086ba", "repositoryID": "2f50041f-c821-497e-909e-bcf4d9762eff", "port": 9428, "upstream": "https://docs.victoriametrics.com/victorialogs", "chartRef": "oci://ghcr.io/quenchworks/charts/victorialogs", "images": [ { "name": "victorialogs", "image": "ghcr.io/quenchworks/images/victorialogs@sha256:bd1f3a98a422a596d6f9c776dc08c5f36ddbc61c0584c8e38fc395eb406086ba" } ], "security": { "image": "ghcr.io/quenchworks/images/victorialogs", "version": "1.51.0", "tag": "ghcr.io/quenchworks/images/victorialogs:1.51.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.51.0", "tag": "ghcr.io/quenchworks/images/victorialogs:1.51.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "victoriametrics", "name": "VictoriaMetrics", "category": "Time series", "summary": "Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.", "tier": "low", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.11", "appVersion": "1.148.0", "description": "Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/victoriametrics", "imageDigest": "sha256:c6890da882b13ed5dbef8811b5974feffe5af5374ce963c50f2442dc59b1220d", "repositoryID": "18aeaade-1bb0-4b11-9787-f80599ccde32", "port": 8428, "upstream": "https://github.com/VictoriaMetrics/VictoriaMetrics", "chartRef": "oci://ghcr.io/quenchworks/charts/victoriametrics", "images": [ { "name": "victoriametrics", "image": "ghcr.io/quenchworks/images/victoriametrics@sha256:c6890da882b13ed5dbef8811b5974feffe5af5374ce963c50f2442dc59b1220d" } ], "security": { "image": "ghcr.io/quenchworks/images/victoriametrics", "version": "1.148.0", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.148.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.148.0", "tag": "ghcr.io/quenchworks/images/victoriametrics:1.148.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "vikunja", "name": "vikunja", "category": "Apps & productivity", "summary": "Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.", "tier": "standard", "license": "AGPL-3.0+", "licenseClean": "agpl", "chartVersion": "0.0.5", "appVersion": "2.3.0", "description": "Self-hosted to-do & project management app (Go single binary + embedded frontend). Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/vikunja", "imageDigest": "sha256:4a45a0d821538a6af5d08fea9f9c88f55d1bae3ebeef0a8417ee7ec815c5c169", "repositoryID": "81d90cd8-1b9c-4172-9c6c-373b83971370", "port": 80, "upstream": "https://vikunja.io", "chartRef": "oci://ghcr.io/quenchworks/charts/vikunja", "images": [ { "name": "vikunja", "image": "ghcr.io/quenchworks/images/vikunja@sha256:4a45a0d821538a6af5d08fea9f9c88f55d1bae3ebeef0a8417ee7ec815c5c169" } ], "security": { "image": "ghcr.io/quenchworks/images/vikunja", "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/vikunja:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 2, "fixable": 0, "grade": "B", "score": 97, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ], "versions": [ { "version": "2.3.0", "tag": "ghcr.io/quenchworks/images/vikunja:2.3.0", "critical": 0, "high": 0, "medium": 0, "low": 1, "unknown": 1, "total": 2, "fixable": 0, "grade": "B", "score": 97, "cves": [ { "id": "CVE-2023-36308", "severity": "LOW", "pkg": "github.com/disintegration/imaging", "installed": "v1.6.2", "fixed": null, "title": "disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...", "url": "https://avd.aquasec.com/nvd/cve-2023-36308", "targets": [ "usr/bin/vikunja" ] }, { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/vikunja" ] } ] } ] } }, { "slug": "vllm", "name": "vllm", "category": "Machine learning & AI", "summary": "vLLM, the high-throughput LLM inference and serving engine with an OpenAI-compatible API. CPU build — installs vLLM's prebuilt CPU wheel (torch+cpu, no source compile, no CUDA) into a venv on a hardened Wolfi python-3.12 base, 0-CVE across ~140 Python packages. The user supplies the model; the chart runs it as a StatefulSet with a persistent model cache.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.3", "appVersion": "0.24.0", "description": "vLLM, the high-throughput OpenAI-compatible inference/serving engine for open LLMs. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. CPU-only; runs as a StatefulSet that serves a user-supplied model over an OpenAI-compatible REST API, with a persistent Hugging Face cache volume.", "imageRepository": "ghcr.io/quenchworks/images/vllm", "imageDigest": "sha256:010dd904cf2ddbe4468cf16ac6625cd19492ff767690e149975842a32aa669cd", "repositoryID": "6953f63b-89cf-4793-8f39-75b8287c2f7f", "port": 8000, "upstream": "https://docs.vllm.ai", "chartRef": "oci://ghcr.io/quenchworks/charts/vllm", "images": [ { "name": "vllm", "image": "ghcr.io/quenchworks/images/vllm@sha256:010dd904cf2ddbe4468cf16ac6625cd19492ff767690e149975842a32aa669cd" } ], "security": { "image": "ghcr.io/quenchworks/images/vllm", "version": "0.25.1", "tag": "ghcr.io/quenchworks/images/vllm:0.25.1", "critical": 0, "high": 0, "medium": 2, "low": 1, "unknown": 0, "total": 3, "fixable": 2, "grade": "C", "score": 81, "cves": [ { "id": "CVE-2026-59890", "severity": "MEDIUM", "pkg": "setuptools", "installed": "80.9.0", "fixed": "83.0.0", "title": "setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)", "url": "https://avd.aquasec.com/nvd/cve-2026-59890", "targets": [ "Python" ] }, { "id": "CVE-2025-69872", "severity": "MEDIUM", "pkg": "diskcache", "installed": "5.6.3", "fixed": null, "title": "python-diskcache: python-diskcache: Arbitrary code execution via insecure pickle deserialization", "url": "https://avd.aquasec.com/nvd/cve-2025-69872", "targets": [ "Python" ] }, { "id": "CVE-2025-3000", "severity": "LOW", "pkg": "torch", "installed": "2.11.0+cpu", "fixed": "2.13.0", "title": "A vulnerability classified as critical has been found in PyTorch 2.6.0 ...", "url": "https://avd.aquasec.com/nvd/cve-2025-3000", "targets": [ "Python" ] } ], "versions": [ { "version": "0.25.1", "tag": "ghcr.io/quenchworks/images/vllm:0.25.1", "critical": 0, "high": 0, "medium": 2, "low": 1, "unknown": 0, "total": 3, "fixable": 2, "grade": "C", "score": 81, "cves": [ { "id": "CVE-2026-59890", "severity": "MEDIUM", "pkg": "setuptools", "installed": "80.9.0", "fixed": "83.0.0", "title": "setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)", "url": "https://avd.aquasec.com/nvd/cve-2026-59890", "targets": [ "Python" ] }, { "id": "CVE-2025-69872", "severity": "MEDIUM", "pkg": "diskcache", "installed": "5.6.3", "fixed": null, "title": "python-diskcache: python-diskcache: Arbitrary code execution via insecure pickle deserialization", "url": "https://avd.aquasec.com/nvd/cve-2025-69872", "targets": [ "Python" ] }, { "id": "CVE-2025-3000", "severity": "LOW", "pkg": "torch", "installed": "2.11.0+cpu", "fixed": "2.13.0", "title": "A vulnerability classified as critical has been found in PyTorch 2.6.0 ...", "url": "https://avd.aquasec.com/nvd/cve-2025-3000", "targets": [ "Python" ] } ] } ] } }, { "slug": "weaviate", "name": "weaviate", "category": "Search & vector", "summary": "Open-source AI-native vector database for semantic search and retrieval-augmented generation, with hybrid keyword plus vector queries.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "1.38.8", "description": "Open-source vector database for AI-native applications: stores objects and their vector embeddings and serves low-latency semantic search over REST and gRPC. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/weaviate", "imageDigest": "sha256:519ffc0a60bb2d763a9186f859c1e736947a1cbc519925ea205edff3aa5dcd2a", "repositoryID": "59500368-862f-4896-9543-a154bb62797a", "upstream": "https://weaviate.io", "chartRef": "oci://ghcr.io/quenchworks/charts/weaviate", "images": [ { "name": "weaviate", "image": "ghcr.io/quenchworks/images/weaviate@sha256:519ffc0a60bb2d763a9186f859c1e736947a1cbc519925ea205edff3aa5dcd2a" } ], "security": { "image": "ghcr.io/quenchworks/images/weaviate", "version": "1.38.7", "tag": "ghcr.io/quenchworks/images/weaviate:1.38.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ], "versions": [ { "version": "1.38.7", "tag": "ghcr.io/quenchworks/images/weaviate:1.38.7", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.54.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/weaviate-server" ] } ] } ] } }, { "slug": "woodpecker", "name": "woodpecker", "category": "CI/CD & registry", "summary": "Lightweight, container-native CI/CD engine (a Drone-compatible fork) with a server, agent, and CLI. From source (Vue UI embedded in the static Go server) on a hardened nonroot Wolfi base.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.5", "appVersion": "3.16.0", "description": "Woodpecker CI server (Go): a lightweight, forge-driven CI/CD engine. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/woodpecker", "imageDigest": "sha256:66a6768fbc6a8e6fc5d57e757dceaa2afbdaf8eddaf361bd489868b251b6d1e7", "repositoryID": "0831bcfa-fc10-4aaf-a4e9-e75f4ac7685f", "port": 80, "upstream": "https://woodpecker-ci.org", "chartRef": "oci://ghcr.io/quenchworks/charts/woodpecker", "images": [ { "name": "woodpecker", "image": "ghcr.io/quenchworks/images/woodpecker@sha256:66a6768fbc6a8e6fc5d57e757dceaa2afbdaf8eddaf361bd489868b251b6d1e7" } ], "security": { "image": "ghcr.io/quenchworks/images/woodpecker", "version": "3.16.0", "tag": "ghcr.io/quenchworks/images/woodpecker:3.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ], "versions": [ { "version": "3.16.0", "tag": "ghcr.io/quenchworks/images/woodpecker:3.16.0", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 2, "total": 2, "fixable": 0, "grade": "B", "score": 96, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/woodpecker-cli", "usr/bin/woodpecker-server" ] } ] } ] } }, { "slug": "wordpress", "name": "wordpress", "category": "Apps & productivity", "summary": "WordPress, the PHP content-management system and blogging platform. Reconstructed clean-room from the official release on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), not the php:apache upstream image. The image ships no wp-config.php; the chart supplies one via ConfigMap and provides a MySQL backend.", "tier": "standard", "license": "GPL-2.0+", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "7.0.2", "description": "Hardened WordPress CMS (PHP-FPM + nginx) on a 0-CVE nonroot image, with a bundled MySQL backend.", "imageRepository": "ghcr.io/quenchworks/images/wordpress", "imageDigest": "sha256:dbe5e89bf4b10d8950e7bed7aea88d134fdd5554629de29c3aa6427bab8804f6", "repositoryID": "0f6074fa-6aa1-44c8-b699-7eefe6b8936c", "port": 8080, "upstream": "https://wordpress.org", "chartRef": "oci://ghcr.io/quenchworks/charts/wordpress", "images": [ { "name": "wordpress", "image": "ghcr.io/quenchworks/images/wordpress@sha256:dbe5e89bf4b10d8950e7bed7aea88d134fdd5554629de29c3aa6427bab8804f6" }, { "name": "mysql", "image": "ghcr.io/quenchworks/images/mysql@sha256:e345a54ed4d42b030515ec9e5b6bf359e3d303f4fbc7deea83800e28e5cc1cee" } ], "security": { "image": "ghcr.io/quenchworks/images/wordpress", "version": "7.0.2", "tag": "ghcr.io/quenchworks/images/wordpress:7.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "7.0.2", "tag": "ghcr.io/quenchworks/images/wordpress:7.0.2", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.9.5", "tag": "ghcr.io/quenchworks/images/wordpress:6.9.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] }, { "version": "6.8.6", "tag": "ghcr.io/quenchworks/images/wordpress:6.8.6", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "xyops", "name": "xyops", "category": "Workflow", "summary": "xyops, a workflow-automation and server-monitoring system (job scheduler, monitors, alerting, ticketing) by the creator of Cronicle. Built from source on Wolfi nodejs-22 (native better-sqlite3), nonroot on a hardened read-only-rootfs base. Single-instance with an embedded SQLite store on a persistent volume; the chart runs it as a StatefulSet.", "tier": "standard", "license": "BSD-3-Clause", "licenseClean": "clean", "chartVersion": "0.0.9", "appVersion": "1.0.86", "description": "xyOps, a complete workflow-automation and server-monitoring system (job scheduler, monitors, alerting, ticketing) by the creator of Cronicle. Hardened by QuenchWorks as a minimal, nonroot, read-only-rootfs, 0-CVE image, cosign-signed and pinned by digest. Ships an embedded better-sqlite3 store, so it runs as a single-replica StatefulSet with a persistent data volume; no external database.", "imageRepository": "ghcr.io/quenchworks/images/xyops", "imageDigest": "sha256:ee7074c8201e3b2a05c4145af92ca3beb2421687ee347f033c831926fc02ed06", "repositoryID": "4d2b242e-e962-40b7-9d13-794f35b54dcc", "port": 5522, "upstream": "https://github.com/pixlcore/xyops", "chartRef": "oci://ghcr.io/quenchworks/charts/xyops", "images": [ { "name": "xyops", "image": "ghcr.io/quenchworks/images/xyops@sha256:ee7074c8201e3b2a05c4145af92ca3beb2421687ee347f033c831926fc02ed06" } ], "security": { "image": "ghcr.io/quenchworks/images/xyops", "version": "1.0.85", "tag": "ghcr.io/quenchworks/images/xyops:1.0.85", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "1.0.85", "tag": "ghcr.io/quenchworks/images/xyops:1.0.85", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "zitadel", "name": "zitadel", "category": "Datastore", "summary": "Hardened zitadel image, built from source on Wolfi.", "tier": "standard", "license": "Unknown", "licenseClean": "clean", "chartVersion": "0.0.8", "appVersion": "4.16.2", "description": "Open-source identity infrastructure — a cloud-native OIDC/OAuth2/SAML identity and access management server with multi-tenancy, self-service, and a built-in management API/console. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest. Bundles PostgreSQL.", "imageRepository": "ghcr.io/quenchworks/images/zitadel", "imageDigest": "sha256:9d3a7e6663962c9b68e3f8bc967006e212c1f7deb11c0d834be1df6744c7f720", "repositoryID": "6f205d15-ee9e-4ad0-b418-1ff79e383fa2", "port": 8080, "upstream": "https://quench-works.com", "chartRef": "oci://ghcr.io/quenchworks/charts/zitadel", "images": [ { "name": "zitadel", "image": "ghcr.io/quenchworks/images/zitadel@sha256:9d3a7e6663962c9b68e3f8bc967006e212c1f7deb11c0d834be1df6744c7f720" }, { "name": "postgresql", "image": "ghcr.io/quenchworks/images/postgresql@sha256:b492e8f2aa8528a0af8bc1aa835522ab222aa8e0a0a6c135b2d5fdc3e9467bd4" } ], "security": null }, { "slug": "zookeeper", "name": "ZooKeeper", "category": "Coordination", "summary": "Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.12", "appVersion": "3.9.5", "description": "Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/zookeeper", "imageDigest": "sha256:a2faaae10d092e74078559ceeeffc0c3246f0421e6559701c04db6832c3c5329", "repositoryID": "53f0539d-ef99-4dfb-9972-4efa995b0294", "upstream": "https://github.com/apache/zookeeper", "chartRef": "oci://ghcr.io/quenchworks/charts/zookeeper", "images": [ { "name": "zookeeper", "image": "ghcr.io/quenchworks/images/zookeeper@sha256:a2faaae10d092e74078559ceeeffc0c3246f0421e6559701c04db6832c3c5329" } ], "security": { "image": "ghcr.io/quenchworks/images/zookeeper", "version": "3.9.5", "tag": "ghcr.io/quenchworks/images/zookeeper:3.9.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [], "versions": [ { "version": "3.9.5", "tag": "ghcr.io/quenchworks/images/zookeeper:3.9.5", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 0, "total": 0, "fixable": 0, "grade": "A+", "score": 100, "cves": [] } ] } }, { "slug": "zot", "name": "zot", "category": "Registry", "summary": "OCI-native container registry (registry, sync, and dist-spec surface). Built from source as a static Go binary on a hardened nonroot Wolfi base; filesystem storage under a writable volume.", "tier": "standard", "license": "Apache-2.0", "licenseClean": "clean", "chartVersion": "0.0.7", "appVersion": "2.1.18", "description": "A production-ready, vendor-neutral OCI-native container image registry for storing and distributing OCI artifacts. Hardened by QuenchWorks as a minimal, nonroot, 0-CVE image, cosign-signed and pinned by digest.", "imageRepository": "ghcr.io/quenchworks/images/zot", "imageDigest": "sha256:90d5fae2927a377892e1579bc41ace4370963e7e60fd44e4e5f9de376bd83a3d", "repositoryID": "10b85a3d-c95b-4faf-b0e7-6786c609bd32", "port": 5000, "upstream": "https://zotregistry.dev", "chartRef": "oci://ghcr.io/quenchworks/charts/zot", "images": [ { "name": "zot", "image": "ghcr.io/quenchworks/images/zot@sha256:90d5fae2927a377892e1579bc41ace4370963e7e60fd44e4e5f9de376bd83a3d" } ], "security": { "image": "ghcr.io/quenchworks/images/zot", "version": "2.1.18", "tag": "ghcr.io/quenchworks/images/zot:2.1.18", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zot" ] } ], "versions": [ { "version": "2.1.18", "tag": "ghcr.io/quenchworks/images/zot:2.1.18", "critical": 0, "high": 0, "medium": 0, "low": 0, "unknown": 1, "total": 1, "fixable": 0, "grade": "B", "score": 98, "cves": [ { "id": "GO-2026-5932", "severity": "UNKNOWN", "pkg": "golang.org/x/crypto", "installed": "v0.53.0", "fixed": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "url": "https://go.dev/issue/44226", "targets": [ "usr/bin/zot" ] } ] } ] } } ] }