21107 matches found
CVE-2026-59168: Uncontrolled Recursion
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...
PT-2026-96077
Name of the Vulnerable Software and Affected Versions github.com/temporalio/ringpop-go affected versions not specified Description The software fails to apply configured LabelOptions limits to label maps received during SWIM membership changes. A network peer with access to a live Ringpop TChanne...
RHEL 10 : rhc (RHSA-2026:69103)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:69103 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...
CVE-2026-16651: Improper Validation of Array Index
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The...
ROS-20260921-73-0116
The vulnerability of the NewKeyring function in the Go programming language is related to improper storage of permissions. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...
ROS-20260921-73-0112
The vulnerability of the Verify function in the Go programming language is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2026-96075
Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go affected versions not specified Description The software fails to validate the one-byte checksum-type field in inbound TChannel call frames. A remote network peer can complete the standard initialization...
CVE-2026-65652: Improper Validation of Array Index
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...
CVE-2026-55060: Incorrect Authorization
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...
PT-2026-96133
Name of the Vulnerable Software and Affected Versions GoCD versions 13.1.0 through 26.0.0 Description The /go/api/support/process list endpoint fails to enforce administrator-only authorization. This allows an authenticated internal user to query the endpoint during the execution of source contro...
PT-2026-96076
Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go affected versions not specified Description The software fails to reject TChannel call fragments that contain checksum metadata but lack length-prefixed argument chunks. In this scenario, the fragment reader...
OESA-2026-3880 git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links,...
kontext-cli v1.8.1
Website | Documentation | Dashboard | Discord Stop risky AI-agent actions before they run AI agents do more than suggest code. They run shell commands, read files, call services, change infrastructure, and interact with production systems. Kontext puts local policy between AI agents and the tools...
webanalyze v0.4.6
webanalyze This is a port of Wappalyzer in Go. This tool is designed to be performant and allows to test huge lists of hosts. !NOTE Because Wappalyzer removed the public access to their app definitions, webanalyze currently loads definitions from enthec. Installation and usage Precompiled release...
Xalgorix Autonomous AI Pentesting Agent 4.6.83
Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...
CLEANSTART-2026-DE21669 RabbitMQ amqp091-go is a Go AMQP 0
Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...
CLEANSTART-2026-KV65948 RabbitMQ amqp091-go is a Go AMQP 0
Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...
CLEANSTART-2026-AD74285 RabbitMQ amqp091-go is a Go AMQP 0
Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0...