PT-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...

PT-2026-76442

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11516-1 go1.25-1.25.13-1.1 on GA media

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11517-1 go1.26-1.26.6-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-33818

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

SUSE CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, kitty, flux, victoriametrics-cluster, knative-serving, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, crossplane-provider-azure-sql, trufflehog, scorecard,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, kitty, flux, victoriametrics-cluster, knative-serving, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, crossplane-provider-azure-sql, trufflehog, scorecard,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, kitty, flux, victoriametrics-cluster, knative-serving, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, crossplane-provider-azure-sql, trufflehog, scorecard,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, kitty, flux, victoriametrics-cluster, knative-serving, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, crossplane-provider-azure-sql, trufflehog, scorecard,...

CVE-2026-56853 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, traefik, nats, kapp-controller, vcluster, net-kourier, timoni, gogatekeeper, cloudnative-pg, grafana, amazon-cloudwatch-agent-operator, github-mcp-server, gcp-compute-persistent-disk-csi-driver, jaeger-operator, kitty,...

CVE-2026-33818

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-56860

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-56858

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-56853

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...