SUSE CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

EUVD-2026-58628

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813

CVE-2026-72813 affects actix-files prior to 0.6.10 and describes a denial-of-service vulnerability triggered by an empty Range header in GET requests for static files. The issue arises when panic is set to abort, allowing remote attackers to crash the process on-demand by sending a GET request wi...

CVE-2026-72813 actix-files before 0.6.10 Denial of Service via empty Range header

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813 actix-files before 0.6.10 Denial of Service via empty Range header

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813 actix-files before 0.6.10 Denial of Service via empty Range header

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, aws-efs-csi-driver, argocd-image-updater, nodetaint, spark-operator, kubernetes-dns-node-cache, rancher-webhook-fips, kubernetes, kubernetes-csi-driver-hostpath, kubeflow-pipelines, rancher-webhook, aws-efs-csi-driver-fips, aws-ebs-csi-drive...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache, argocd-image-updater, k8s-device-plugin, kubeflow-pipelines, local-static-provisioner, spark-operator, nodetaint, ip-masq-agent, cri-tools, aws-efs-csi-driver...

GO-2024-3286 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, argocd-image-updater, k8s-device-plugin, kubeflow-pipelines, local-static-provisioner, nodetaint, ip-masq-agent, aws-efs-csi-driver...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: emissary, kubernetes-csi-driver-hostpath, rancher-fleet, kubernetes-dns-node-cache, argocd-image-updater, kubernetes, argo-rollouts, local-static-provisioner, vcluster, kubernetes-csi-driver-nfs, kapp, yunikorn-k8shim, nodetaint, ip-masq-agent, spark-operator,...

CLEANSTART-2026-QB53329 Security fixes in local-static-provisioner-fips 2.7.0-r1

Package local-static-provisioner-fips version 2.7.0-r1 fixes 4 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, CVE-2025-52881, ghsa-cgrx-mc8f-2prm...

CLEANSTART-2026-IF32046 Security fixes in local-static-provisioner 2.6.0-r1

Package local-static-provisioner version 2.6.0-r1 fixes 18 vulnerabilities: ghsa-7fxm-f474-hf8w, ghsa-q78c-gwqw-jcmc, CVE-2023-3676, CVE-2023-3955, ghsa-hq6q-c2x6-hmch...

CLEANSTART-2026-BY81163 Security fixes in local-static-provisioner-fips 2.6.0-r1

Package local-static-provisioner-fips version 2.6.0-r1 fixes 6 vulnerabilities: CVE-2023-44487, ghsa-m425-mq94-257g, CVE-2024-24786, ghsa-8r3f-844c-mc37, CVE-2025-52881...

Linux Distros Unpatched Vulnerability : CVE-2026-48813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue...

Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fgmr-7w36-9qfq. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypas...

CVE-2026-72796

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifact...

io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters

A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure...

CVE-2026-72796 SiYuan before v3.7.4 Access Control Bypass via Static Routes

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifact...