CVE-2026-10722 until=2026-09-30 # github.com/cilium/ebpf BTF integer overflow; latest release v0.21.0 still flagged, no fixed release yet. Transitive only, not compiled into kubectl-gs. Track cilium/ebpf for a fixed release, then bump.
CVE-2026-41579 until=2026-09-30 # github.com/opencontainers/runc symlink following (GHSA-xjvp-4fhw-gc47); fix is in runc 1.3.6+ but that removes libcontainer/user which github.com/ory/dockertest (latest) imports, so runc cannot move off the flagged release. Transitive test/tooling dep. Track ory/dockertest dropping runc/libcontainer/user, then bump.
CVE-2026-63209 until=2026-09-04 # github.com/klauspost/compress@v1.18.6
