GO-2026-6109 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList...

GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...

Security update for go1.26

This update for go1.26 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...

Security update for go1.25

This update for go1.25 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.29 security and extras update

Red Hat OpenShift Container Platform release 4.21.29 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.34 security and extras update

Red Hat OpenShift Container Platform release 4.20.34 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

MiracleLinux 8 : osbuild-composer-101.5-1.el8_10.ML.1 (AXSA:2026-1558:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1558:08 advisory. google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186...

OPENSUSE-SU-2026:11536-1 go1.27-1.27rc3-1.1 on GA media

These are all security issues fixed in the go1.27-1.27rc3-1.1 package on the GA media of openSUSE Tumbleweed...

Important Photon OS Security Update - PHSA-2026-5.0-92-0960

Updates of 'go', 'python3-mako' packages of Photon OS have been released...

Unity Linux 20.1070a Security Update: osbuild-composer (UTSA-2026-101489)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101489 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: ollama, bento, rclone, seaweedfs, kubescape, fortio-fips, gitea-fips, kitty, mattermost, pdfcpu, seaweedfs-fips, seaweedfs-rocksdb, nemo, bento-fips, seaweedfs-rocksdb-fips, kubescape-server-fips, seaweedfs-operator, mailpit, ollama-fips, mattermost-fips, rclone-fips...

containerized-data-importer1.66-api-1.66.0-1.1 on GA media (moderate)

containerized-data-importer1.66-api-1.66.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11514-1 Rating: moderate Cross-References: CVE-2025-47911 CVE-2025-58058 CVE-2025-58190 CVE-2026-27136 CVE-2026-34986 CVE-2026-35469 CVE-2026-39821 CVE-2026-39827 CVE-2026-39828 CVE-2026-39832...

go1.25-1.25.13-1.1 on GA media (moderate)

go1.25-1.25.13-1.1 on GA media Announcement ID: openSUSE-SU-2026:11516-1 Rating: moderate Cross-References: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVSS scores: CVE-2026-39821 SUSE : 7.4...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

CVE-2026-73043 SiYuan before v3.7.4 Remote Code Execution via Template Calculation

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...

CVE-2026-73043

SiYuan before v3.7.4 has a remote code execution vulnerability in the Template calculation operator. It renders user-authored Go templates and stores output verbatim without sanitization, permitting injection of malicious HTML/JavaScript that executes in the desktop client renderer with Node inte...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-bedrock-fips, aws-fsx-csi-driver-fips, kyverno-policy-reporter-plugins-trivy-fips, newrelic-k8s-metrics-adapter, opentelemetry-collector-k8s, athenz-csi-driver, coder-fips, crossplane-provider-aws-route53recoveryreadiness-fips,...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: go-msft, opentelemetry-collector-k8s, athenz-csi-driver, crossplane-provider-aws-route53recoveryreadiness-fips, azure-service-operator-fips, apm-server, crossplane-provider-terraform, crossplane-provider-aws-cognitoidentity-fips, crossplane-provider-aws-batch-fips,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost, redis-operator, lok...