PT-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...

PT-2026-76442

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11516-1 go1.25-1.25.13-1.1 on GA media

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11517-1 go1.26-1.26.6-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.6-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-33818

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

SUSE CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

CVE-2026-56853 vulnerabilities

Vulnerabilities for packages: descheduler, docker-machine-driver-harvester, karma, kube-fluentd-operator, kubo, nri-prometheus, flyte, net-kourier, crossplane-provider-azure-authorization, sftpgo, stakater-reloader, verticadb-operator, flux, policy-controller, knative-operator, spark-operator,...

CVE-2026-33818

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-56860

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-56858

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-56853

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...