Lfprojects Zarf vulnerabilities

2 CVEs affecting Lfprojects Zarf, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40090, published 2026-04-15.

More from Lfprojects.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-40090, published 2026-04-15. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect…
• CVE-2026-29064, published 2026-03-06. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction allows a specifically crafted Zarf package…