{"api_version":"v1","generated_at":"2026-10-07T19:40:00+00:00","product":{"cve_count":9,"evidence_gap_note":"This identity is present in BlackTree CVE records, but no product-specific publisher support or retirement history is currently registered in Lifecycle.","id":"security:cve-chainguard-dev-apko-a0cd30809219","lifecycle_state":"evidence_gap","linked_lifecycle_url":null,"name":"apko","next_cursor":null,"observations":[{"affected":"apko: 0.2.0 < 1.4.5","affected_versions_present":true,"cve_id":"CVE-2026-105768","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-105768","fixed":"Upgrade to apko 1.4.5 or later, which rejects UID and GID values outside 0 to 4294967295 instead of truncating them. Images built with earlier versions from untrusted packages should be rebuilt.","last_modified":"2026-10-06T13:59:32.353Z","patch_url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-rj6x-hwpv-vhvf","primary_source":"","published":"2026-10-05T20:17:46.477Z"},{"affected":"< 1.2.7","affected_versions_present":true,"cve_id":"CVE-2026-42576","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-42576","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-05-11T14:57:58.452Z","patch_url":"","primary_source":"","published":"2026-05-09T19:26:56.224Z"},{"affected":"< 1.2.7","affected_versions_present":true,"cve_id":"CVE-2026-42575","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-42575","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-05-13T17:45:37.672Z","patch_url":"","primary_source":"","published":"2026-05-09T19:26:27.415Z"},{"affected":">= 0.14.8, < 1.2.5","affected_versions_present":true,"cve_id":"CVE-2026-42574","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-42574","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-05-11T17:11:40.244Z","patch_url":"","primary_source":"","published":"2026-05-09T19:24:48.497Z"},{"affected":">= 0.14.8, < 1.1.1","affected_versions_present":true,"cve_id":"CVE-2026-25140","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-25140","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-02-04T19:17:36.596Z","patch_url":"https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09","primary_source":"","published":"2026-02-04T19:02:20.988Z"},{"affected":">= 0.14.8, < 1.1.1","affected_versions_present":true,"cve_id":"CVE-2026-25121","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-25121","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-02-04T19:18:52.495Z","patch_url":"https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14","primary_source":"","published":"2026-02-04T19:02:17.979Z"},{"affected":">= 0.14.8, < 1.1.0","affected_versions_present":true,"cve_id":"CVE-2026-25122","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-25122","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-02-04T19:19:35.546Z","patch_url":"https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09","primary_source":"","published":"2026-02-04T19:02:15.838Z"},{"affected":">= 0.27.0, < 0.29.5","affected_versions_present":true,"cve_id":"CVE-2025-53945","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-53945","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-07-22T15:03:42.966Z","patch_url":"","primary_source":"","published":"2025-07-18T15:35:17.325Z"},{"affected":"< 0.14.5","affected_versions_present":true,"cve_id":"CVE-2024-36127","cve_url":"https://cve.blacktree.nl/cve/CVE-2024-36127","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2024-09-03T15:49:45.766Z","patch_url":"","primary_source":"","published":"2024-06-03T14:49:39.055Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"chainguard-dev"}}