# common vulnerabilities and exposures Published articles for common vulnerabilities and exposures. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing Chainguard Agent Skills: Because your AI agent shouldn't trust strangers DevFeed: [Introducing Chainguard Agent Skills: Because your AI agent shouldn't trust strangers]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard agent skills](), [Agent Skills](), [supply-chain-security](), [chainguard](), [Security](), [Vulnerabilities](), [Malware]() Tags: [ai-agents](), [anthropic](), [chainguard](), [chainguard-agent-skills](), [chainguard-ai-tools](), [chatgpt](), [claude](), [common-vulnerabilities-and-exposures](), [hardened-ai-agent-skills](), [hardening](), [malware](), [security](), [supply-chain-security]() ### AI overview Chainguard Agent Skills is introduced as a continuously maintained catalog of hardened AI agent skills. The catalog applies review, permission scoping, integrity verification, continuous hardening, and audit trails to reduce the supply-chain risks of third-party skills used with platforms such as Claude Code and OpenClaw. ### Source excerpt Chainguard Agent Skills is a continuously maintained catalog of hardened AI agent skills. ## Chainguard + Booz Allen: Delivering Trusted Open-Source Software to U.S. Government Agencies DevFeed: [Chainguard + Booz Allen: Delivering Trusted Open-Source Software to U.S. Government Agencies]() Original publisher: [Read original article]() Published: 2025-10-15T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [container images](), [Containers](), [open-source-security](), [Vulnerabilities](), [Open Source](), [Security]() Tags: [announce](), [ato](), [booz-allen-hamilton](), [chainguard](), [chainguard-booz-partnership](), [chainguard-containers](), [chainguard-dod-partnership](), [chainguard-libraries](), [common-vulnerabilities-and-exposures](), [compliance](), [container-images](), [containers](), [engineering](), [fedramp](), [fips](), [government](), [hardened-containers](), [open-source](), [open-source-software](), [sboms](), [secure-by-default](), [secure-software](), [security](), [stateramp](), [supply-chain](), [vulnerabilities](), [zero-cve-container-images]() ### AI overview Chainguard and Booz Allen announced a partnership to help U.S. government agencies and defense programs secure software supply chains, reduce vulnerabilities, and accelerate compliance. The partnership combines Booz Allen's mission expertise with Chainguard's secure-by-default open-source software, including hardened containers that helped one defense-related program obtain authorization to operate in eight weeks. ### Source excerpt Chainguard and Booz Allen partner to help federal programs eliminate vulnerabilities, save engineering time, and accelerate compliance timelines. ## Discover the Value of Chainguard Containers with the Value Calculator DevFeed: [Discover the Value of Chainguard Containers with the Value Calculator]() Original publisher: [Read original article]() Published: 2025-08-28T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [chainguard](), [Tool](), [Vulnerabilities](), [Development]() Tags: [business-value](), [chainguard](), [chainguard-containers](), [chainguard-images](), [chainguard-roi](), [common-vulnerabilities-and-exposures](), [compliance](), [container-images](), [cve-remediation](), [developers](), [engineering](), [tool](), [vulnerabilities](), [zero-cves]() ### AI overview Chainguard introduces a self-serve Value Calculator that estimates the organizational value of adopting Chainguard Containers. The tool uses metrics such as developer count, revenue, container-image usage, CVE remediation time, hardening effort, organizational maturity, industry, and compliance requirements to estimate potential gains from reducing engineering toil, mitigating risk, and supporting revenue growth. ### Source excerpt Chainguard's Value Calculator is a new tool we created to make it easy to quantify the value of using Chainguard Containers for your specific organization. ## Announcing Chainguard VMs: Minimal, Zero-CVE Container Host Images DevFeed: [Announcing Chainguard VMs: Minimal, Zero-CVE Container Host Images]() Original publisher: [Read original article]() Published: 2025-03-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [cloud-infrastructure](), [Containers](), [Security](), [Vulnerabilities](), [supply-chain-security](), [Linux]() Tags: [announce](), [blog](), [blog-post](), [chainguard](), [chainguard-vms](), [common-vulnerabilities-and-exposures](), [container](), [container-hosts](), [cve](), [images](), [infrastructure](), [kernel](), [multi-cloud](), [operating-systems](), [security](), [software-supply-chain](), [virtual-machines]() ### AI overview Chainguard VMs has entered Early Access as a catalog of guarded, minimal, zero-CVE container host images for ephemeral cloud workloads. The images are built from source, include only required container-host components, and are designed to reduce attack surface and simplify vulnerability remediation. ### Source excerpt Chainguard VMs is a catalog of guarded, minimal, zero-CVE container host images that is now in Early Access. ## Guest Post: Securing the Foundation of Dynamic Data Governance at Velotix DevFeed: [Guest Post: Securing the Foundation of Dynamic Data Governance at Velotix]() Original publisher: [Read original article]() Published: 2025-02-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [data-governance](), [chainguard images](), [Security](), [Vulnerabilities](), [Amazon OpenSearch Service](), [Kafka]() Tags: [case-study](), [chainguard](), [chainguard-images](), [common-vulnerabilities-and-exposures](), [guest-post](), [performance](), [productivity](), [security](), [time](), [velotix](), [vulnerabilities](), [zero-cves]() ### AI overview A guest post explains how Velotix uses Chainguard Images to reduce CVEs across its data-governance platform. The article describes challenges with vendor-provided images and dependency upgrades, and highlights scheduled recompilation to keep infrastructure-level libraries current. ### Source excerpt Velotix utilizes Chainguard Images to help reduce CVEs, improve performance, and save time. Learn how Chainguard helps them build a more secure infrastructure. ## FedRAMP vulnerability scanning requirements explained DevFeed: [FedRAMP vulnerability scanning requirements explained]() Original publisher: [Read original article]() Author: Can secure-by-default container images or VMs speed up FedRAMP authorization Published: 2024-11-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability scanning](), [Vulnerabilities](), [Security](), [configuration](), [Containers]() Tags: [audits](), [authorization](), [automated](), [common-vulnerabilities-and-exposures](), [compliance](), [container-images](), [containers](), [cve](), [fedramp](), [fips](), [requirements](), [security](), [stigs](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains FedRAMP vulnerability scanning requirements, including the required scan scope, recurring authenticated scans, reporting expectations, remediation timelines, and the role of scan data in continuous monitoring, authorization evidence, POA&Ms, and risk reviews. ### Source excerpt Understand FedRAMP vulnerability scanning rules, scope, and SLAs. Get compliance clarity and learn how to simplify audits. ## Latest CVE patch report: Securing software supply chains DevFeed: [Latest CVE patch report: Securing software supply chains]() Original publisher: [Read original article]() Published: 2024-06-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard images](), [Vulnerabilities](), [chainguard](), [Security]() Tags: [attacks](), [chainguard](), [chainguard-images](), [command-line](), [common-vulnerabilities-and-exposures](), [cve](), [cve-2024-4603](), [cve-remediation](), [openssl](), [report](), [security](), [software-supply-chain](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview Chainguard's latest CVE patch report describes how its remediation team patches vulnerabilities in Chainguard Images and Wolfi Packages, aiming to provide accurate scanner results and reduce false positives. It also examines CVE-2024-4603 in OpenSSL, which can cause denial-of-service attacks when untrusted, excessively large DSA parameters are checked. ### Source excerpt Dive into our latest CVE patch report and see how Chainguard proactively mitigates vulnerabilities to enhance software supply chain security. ## GitGuardian pioneers secure code solutions down to its source with Chainguard Images DevFeed: [GitGuardian pioneers secure code solutions down to its source with Chainguard Images]() Original publisher: [Read original article]() Published: 2024-03-13T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Vulnerabilities](), [vulnerability management](), [code security](), [Containers]() Tags: [chainguard](), [chainguard-images](), [code-security](), [common-vulnerabilities-and-exposures](), [compliance](), [containers](), [customer-trust](), [gitguardian](), [security](), [vulnerability-management]() ### AI overview This case study describes how GitGuardian partnered with Chainguard and adopted Chainguard Images to address software-container vulnerabilities, reduce CVEs, streamline vulnerability management, and meet customer SLAs and compliance requirements. ### Source excerpt GitGuardian partners with Chainguard, utilizing Chainguard Images to reduce CVEs, enhance security, and meet compliance standards efficiently. ## Why your company is wasting thousands of hours on software vulnerabilities DevFeed: [Why your company is wasting thousands of hours on software vulnerabilities]() Original publisher: [Read original article]() Published: 2024-02-06T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability management](), [Vulnerabilities](), [Containers](), [container images](), [chainguard images](), [chainguard labs]() Tags: [chainguard-images](), [chainguard-labs](), [common-vulnerabilities-and-exposures](), [container-images](), [containers](), [cve-management](), [security](), [vulnerabilities](), [vulnerability](), [vulnerability-management]() ### AI overview Chainguard Labs interviewed approximately ten software professionals and found that companies building or deploying containers may spend thousands of hours each year on vulnerability management. The article attributes much of this burden to large numbers of known vulnerabilities and image-selection practices that disregard vulnerability counts. ### Source excerpt Chainguard Labs surveyed nine companies to see how many hours they spent on vulnerability management each year. Check out this blog to see the results. ## Building minimal, up-to-date cloud images with Wolfi DevFeed: [Building minimal, up-to-date cloud images with Wolfi]() Original publisher: [Read original article]() Published: 2023-12-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cloud](), [container images](), [supply-chain-security](), [Open Source](), [Tooling](), [DevOps]() Tags: [apk](), [apko](), [architecture](), [chainguard-academy](), [cloud](), [common-vulnerabilities-and-exposures](), [container](), [container-images](), [devops](), [efficiency](), [kubecon-na](), [melange](), [minimalism](), [open-source](), [os](), [packages](), [security](), [software-supply-chain-security](), [supply-chain-security](), [vulnerabilities](), [wolfi]() ### AI overview The article introduces Wolfi, an open source project for building minimal, up-to-date cloud and container images. It explains how Wolfi's security-first architecture, proactive updates, minimalism, and supporting tools such as melange, apko, and apk help reduce attack surfaces and CVE exposure while improving software supply chain security. ### Source excerpt Discover Wolfi OS: Crafting minimal, always up-to-date cloud images for superior security and efficiency in the cloud. ## New year, new image: Introducing the Chainguard Images Directory DevFeed: [New year, new image: Introducing the Chainguard Images Directory]() Original publisher: [Read original article]() Published: 2023-12-13T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [Docker Hardened Images](), [Docker Hub](), [vulnerability](), [Security]() Tags: [chainguard](), [chainguard-images](), [chainguard-images-directory](), [common-vulnerabilities-and-exposures](), [container-image-registry](), [container-images](), [digestabot](), [security](), [vulnerability]() ### AI overview Chainguard introduces an updated Images Directory for discovering and using its minimal, hardened container images. The release also adds Security Advisories with information about CVE mitigation and introduces digestabot, a free GitHub Action for keeping Developer Images current. ### Source excerpt Discover how the updated Chainguard Images Directory simplifies finding container images and critical vulnerability advisories. ## Fuzzy CVEs, tarfiles, and untrusted input DevFeed: [Fuzzy CVEs, tarfiles, and untrusted input]() Original publisher: [Read original article]() Published: 2023-07-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Vulnerabilities](), [common vulnerabilities and exposures](), [Python](), [Open Source](), [Maintainers](), [NVD]() Tags: [common-vulnerabilities-and-exposures](), [cve](), [cves](), [cybersecurity](), [go](), [maintainers](), [nvd](), [open-source](), [python](), [scanner](), [scanners](), [software-supply-chain](), [vulnerability-scanner](), [vulnerability-scanning](), [wolfi]() ### AI overview This article examines CVE-2007-4559 in Python's tarfile module, why the 15-year-old issue may still appear in security scanners, and why its classification as a vulnerability is disputed. It discusses CVE processes, NVD entries, open-source maintainer constraints, and the risks of extracting untrusted tarfile inputs. ### Source excerpt Navigate fuzzy CVEs, tarfiles, and untrusted input with Chainguard, paving the way to secure coding practices.