CVE-2026-86242

Bifrost HTTP transport (before 2.0.0) is vulnerable to unauthenticated remote code execution on dynamically linked builds. When management authentication is disabled (the default), an attacker can send a POST /api/plugins request with an HTTP URL as the plugin path. The shared-object loader downl...

EUVD-2026-72104

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

CVE-2026-86242 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...

rewerse-engineering v1.4.0

rewerse engineering An unofficial REWE API client in Go and Python. It implements the publicly accessible unauthenticated endpoints the REWE app uses for querying current discounts Angebote, products, markets and recalls. Current supported APK version: 5.18.1 as of 29.09.26 !CAUTION The...

rdap v0.10.2

OpenRDAP is a command line RDAP client implementation in Go. https://www.openrdap.org - homepage https://www.openrdap.org/demo - live demo Features Command line RDAP client Output formats: text, JSON, WHOIS style Query types supported: ip domain autnum nameserver entity help url domain-search...

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

...

opa v1.20.2

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

GO-2026-4384 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

SUSE CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

SUSE CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

SUSE CVE-2026-54908

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHEPSK ServerKeyExchange message. This issue has been fixed in version 3.1.4...

SUSE CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

grafana-pcp security update

An update is available for grafana-pcp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Grafana plugin for Performance Co-Pilot includes datasources for...

AlmaLinux 10 : grafana (ALSA-2026:63022)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63022 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Oracle Linux 8 : ELSA-2026-63163-0: / container-tools:ol8 (ELSA-2026-631630)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-631630 advisory. - rebuild with updated Go to fix CVE-2026-42499 - rebuild with updated Go to fix CVE-2026-42499 - rebuild with Go 1.25.11 to fix CVE-2026-33818,...

AlmaLinux 10 : go-fdo-client (ALSA-2026:62577)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:62577 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 encoding/asn1: golang: Go...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-33997 DESCRIPTION: Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed...

buildah security update

An update is available for buildah. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The buildah package provides a tool for facilitating building OCI container...

opentaint go-server/latest

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...