The vulnerability of the golang-x-net package in the Golang programming language arises from an improper limitation on the visible layers of the user interface. This allows attackers to carry out clickjacking attacks.

The vulnerability of the golang-x-net package in the Golang programming language is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...

The vulnerability of the golang-x-net package in the Golang programming language arises from an improper limitation on the visible layers of the user interface. This allows attackers to carry out clickjacking attacks.

The vulnerability of the golang-x-net package in the Golang programming language is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...

The vulnerability of the golang-x-image package, a programming language, arises from insufficient resource control with dynamic management, allowing attackers to execute arbitrary code.

The vulnerability of the golang-x-image package, a programming language, is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

PT-2026-99110

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...

PT-2026-98930

Name of the Vulnerable Software and Affected Versions golang.org/x/playground affected versions not specified Description A malicious txtar archive can escape its execution context to force arbitrary writes to the trusted filesystem of the playground host. Additionally, a specific path used to...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-67413: Inefficient Regular Expression Complexity

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic exchange accepted a client-controlled rjmserlangselector binding expression whose LIKE evaluator expanded percent and underscore wildcards in...

PT-2026-99021

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

CVE-2026-97064: Use of Default Credentials

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number...

CVE-2026-100192: Missing Authentication for Critical Function

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

PT-2026-99093

X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint with a known email or mobile number...

Fedora 46 : golang-x-mod (2026-f84c399b38)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f84c399b38 advisory. Automatic update for golang-x-mod-0.41.0-1.fc46. Changelog Fri Sep 25 2026 Packit - 0.41.0-1 - Update to 0.41.0 upstream release - Resolves: rhbz2486558 -...

Fedora 46 : golang-x-image (2026-2d6aee1dc4)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2d6aee1dc4 advisory. Automatic update for golang-x-image-0.46.0-2.fc46. Changelog Fri Sep 25 2026 lex Sez - 0.46.0-2 - Add requiresexclude Fri Sep 25 2026 Packit -...

SUSE SLES12 Security Update : docker-stable (SUSE-SU-2026:1118-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1118-1 advisory. - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption bsc1253904. Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-67413

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic...

Linux Distros Unpatched Vulnerability : CVE-2026-93246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks...

The vulnerability of the golang-x-net package in the Golang programming language arises from the lack of security measures for handling web page structures, allowing attackers to execute arbitrary code.

The vulnerability of the golang-x-net package in the Golang programming language is related to the lack of protective measures for web page structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included...