GO-2026-5021 vulnerabilities

Vulnerabilities for packages: telegraf, argo-workflows, zitadel, gatekeeper, opentofu, flux, prometheus, external-secrets-operator, vault, kube-conformance, loki, argo-events, commercial-grafana, guac, nemo, harbor-fips, gitlab-workhorse-ce, commercial-expanso-edge, etcd, vault-fips, grafana-fips...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: mc-fips, gatekeeper, gatekeeper-fips, mongodb-k8s-operator-version-upgrade-post-start-hook-fips, pgwatch, velero-plugin-for-microsoft-azure-fips, timescaledb-parallel-copy, wazero, loki, prometheus-bind-exporter, fq, licenseclassifier, velero-plugin-for-csi-fips,...

GO-2026-5247 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

GO-2026-5757 vulnerabilities

Vulnerabilities for packages: minio...

GO-2025-4043 vulnerabilities

Vulnerabilities for packages: neuvector-scanner...

GO-2023-1897 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3845 vulnerabilities

Vulnerabilities for packages: gatus...

GO-2026-4740 vulnerabilities

Vulnerabilities for packages: flyte...

GO-2025-4181 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2026-4865 vulnerabilities

Vulnerabilities for packages: grafana-mimir, neuvector-scanner, rabbitmq-messaging-topology-operator, cert-manager-cmctl, docker-credential-gcr, step-issuer, newrelic-infrastructure-agent, kwok, sftpgo, migrate, crossplane-provider-azure-sql, runc, helm, tetragon, terraform-provider-azuread, kpt,...

CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

Photon OS 5.0: Go PHSA-2026-5.0-90-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-91-0830

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0830. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-92-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Pmd PHSA-2023-5.0-91-0037

An update of the pmd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0037. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-47427: NULL Pointer Dereference

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

EUVD-2026-46642

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

CVE-2026-65315

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

CVE-2026-53432

CVE-2026-53432 (fzf) affects the fzf project, specifically the FuzzyMatchV2 function. Affected scenario involves processing extremely long input lines (≈2,200,000 bytes) with a pattern length of 999 bytes, which causes an integer overflow and triggers a non-recoverable panic, terminating the proc...