Linuxfoundation Oras vulnerabilities

• linuxfoundation oras, oras-project oras-go +1 more oras-go: credential forwarding via unvalidated Location header in blob upload CVE-2026-50151 Fix available 7.5 HighJuly 1, 2026