RLSA-2026:54487 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

CVE-2026-72837

Summary: CVE-2026-72837 affects File Browser prior to 2.63.20, where createUserDir isolation in proxy and hook authentication auto-provisioning paths is not honored. This allows attackers with valid upstream-auth credentials to read, modify, delete, and share files belonging to other users due to...

CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

EUVD-2026-58651

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

EUVD-2026-58631

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: caddy, metrics-server-fips, buildkitd, kubernetes-fips, k3s, kubernetes, prometheus-adapter, up, kubevela, kube-oidc-proxy, rancher-webhook, rancher-webhook-fips...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, gomplate, temporal-ui-server-fips, request-1279, conftest, crossplane-provider-aws-elasticache, azure-aad-pod-identity-mic, bank-vaults, cluster-proportional-autoscaler, flux-image-reflector-controller, grafana-operator-fips, terraform-provider-google,...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, zot, kubescape-operator, kube-logging-operator-fips, kuma, knative-serving-fips, knative-eventing, frankenphp-8.3, frankenphp-8.4, headlamp, livekit-server, milvus, ory-kratos-fips, teleport-operator-fips, tekton-pipelines-fips, aactl, op-geth,...

GO-2026-4289 vulnerabilities

Vulnerabilities for packages: cloudflared...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: minio, k8sgpt, opentelemetry-collector, conftest, temporal, dbmate, sigstore-scaffolding, zarf, kots, restic, dex, k8sgpt-operator, vcluster, grafana-agent-operator, pulumi-language-dotnet, cilium-cli, terragrunt, tflint, gomplate, trivy, dagger,...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, splunk-otel-collector, fluent-bit-plugin-loki, gitea, atlantis, authservice, kots, falcosidekick...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: shadowsocks-rust, linkerd-extension-init, oranda, parseable, wasmcloud, ntpd-rs, qdrant, tealdeer, uv, sdp-k8s-injector, wash, cargo-audit, zola, samply, kdash, lychee, wadm, xh, pixi, deno, nushell, zizmor, sccache, atuin, rye, rustup, sqlx, linkerd2-proxy, wasmtime...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: minio, splunk-otel-collector, grafana-pyroscope, prometheus-pushgateway, mc, jaeger, istio, mcp-grafana, telegraf, cloud-sql-proxy, certificate-transparency, karma, keda, datadog-agent, aws-otel-collector, loki, minio-operator, tempo, trillian, minio-object-browser...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: minio, k8sgpt, opentelemetry-collector, splunk-otel-collector, prometheus-pushgateway, mc, jaeger, istio, fluent-bit-plugin-loki, cloud-sql-proxy, certificate-transparency, karma, amazon-cloudwatch-agent-operator, keda, datadog-agent, aws-otel-collector,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, kots, dex, cloudflared, argo-workflows, terragrunt, vexctl, flux-kustomize-controller, slsa-verifier, rekor, sops, spire-server, aactl, kubescape, gitsign, cosign, oauth2-proxy, flux-source-controller, fulcio...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: terraform-mcp-server, helm-operator, manifest-tool, crossplane-provider-aws-s3, neuvector-sigstore-interface, authservice, mongodb-kubernetes-operator, volume-modifier-for-k8s, gptscript, kubernetes-event-exporter, kubernetes-csi-driver-nfs, x509-certificate-exporter...