PT-2026-79855

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21611-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21611-1 advisory. Changes in apptainer: - Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106: The tar extraction routines in moby/go-archive do not confine...

SUSE CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

SUSE CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

SUSE CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

FreeBSD : terraform -- exclusion bypass in .terraformignore handling (4496ae0c-9d7d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4496ae0c-9d7d-11f1-a655-3497f65b111b advisory. HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP...

SUSE SLES15 Security Update : rootlesskit (SUSE-SU-2026:3669-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3669-1 advisory. This update for rootlesskit rebuilds it against the current go security release. Tenable has extracted the preceding description block...

SUSE SLES15: kubernetes1.33-client / kubernetes1.33-client-bash-completion / etc (SUSE-SU-2026:3659-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3659-1 advisory. This update for kubernetes-old rebuilds it against the current go security release. Tenable has extracted the preceding description block...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3671-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3671-1 advisory. This update for podman rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

SUSE SLED15 / SLES15 Security Update : containerd (SUSE-SU-2026:3670-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3670-1 advisory. This update for containerd rebuilds it against the current go security release. Tenable has extracted the preceding...

SUSE SLES15: kubernetes1.35-client / kubernetes1.35-client-bash-completion / etc (SUSE-SU-2026:3660-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3660-1 advisory. This update for kubernetes rebuilds it against the current go security release. Tenable has extracted the preceding description block direct...

SUSE SLED15 / SLES15 Security Update : cosign (SUSE-SU-2026:3666-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3666-1 advisory. This update for cosign rebuilds it against the current go security release. Tenable has extracted the preceding...

SUSE SLES15 Security Update : buildah (SUSE-SU-2026:3667-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3667-1 advisory. This update for buildah rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

SUSE SLED15: docker / docker-bash-completion / docker-buildx / etc (SUSE-SU-2026:3668-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3668-1 advisory. This update for docker rebuilds it against the current go security release. Tenable has extracted the preceding...

Security update for apptainer (important)

openSUSE security update: security update for apptainer ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21611-1 Rating: important References: bsc1275248 Cross-References: CVE-2026-17106 CVSS scores: CVE-2026-17106 SUSE : 7.1...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:3661-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3661-1 advisory. This update for helm rebuilds it against the current go security release. Tenable has extracted the preceding description block directly fro...

CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...

DEBIAN-CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

DEBIAN-CVE-2026-55185

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker c...

CVE-2026-77354

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...