CVE-2026-105163Medium· 5.3▾ SunlitA vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-u…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/crossplane/crossplane-runtime/v2 >= 2.4.0-rc.0, < 2.4.0-rc.1github.com/crossplane/crossplane-runtime/v2 >= 2.3.0, < 2.3.3Patched in:
github.com/crossplane/crossplane-runtime/v2 2.4.0-rc.1github.com/crossplane/crossplane-runtime/v2 2.3.3Connected by shared product, vendor, weakness, or advisory.
GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…
GO-2026-6302NoneSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
CVE-2025-38440High· 7.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks th…
CVE-2026-100394Medium· 6.5Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool
CVE-2026-107276Medium· 6.3MISP contains a race condition in the email-based one-time password (OTP) login flow