Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into…
Exact source revision recorded 3 Nov 2026 09:59:37 UTC. It does not establish the source's current position. Latest evidence.
euvd · EUVD-2026-57928
PublishedEUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Aug 13, 2026, 1:14:19 PM
dateUpdated: Aug 13, 2026, 3:16:26 PM
7 related source bulletins · separate from aliases
openSUSE-SU-2026:11398-1: tekton-cli-0.45.1-1.1 on GA media
CVE-2026-48702 · CVE-2026-49835
RHSA-2026:35111: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-32285 · CVE-2026-41506 · CVE-2026-44740 · CVE-2026-46680 · CVE-2026-47262 · CVE-2026-48702 · CVE-2026-50195 · CVE-2026-53488
RHSA-2026:25138: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
CVE-2026-41889 · CVE-2026-45287 · CVE-2026-48702
openSUSE-SU-2026:11154-1: hauler-2.0.1-1.1 on GA media
CVE-2026-48702
openSUSE-SU-2026:21262-1: Security update for hauler
CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-42502 · CVE-2026-42506 · CVE-2026-48702
RHSA-2026:50873: Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
CVE-2026-39831 · CVE-2026-46597 · CVE-2026-48702 · CVE-2026-59869
RHSA-2026:59439: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
CVE-2024-9355 · CVE-2025-7783 · CVE-2025-47907 · CVE-2026-48702 · CVE-2026-59869
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON