21467 matches found
GO-2026-6209 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik
Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik...
GO-2026-6108 Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh
Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh...
GO-2026-6242 New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
New API: Integer overflow in quota billing yields negative charges self-crediting in github.com/QuantumNous/new-api...
GO-2026-6198 Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-6099 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules in github.com/quic-go/webtransport-go
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules in github.com/quic-go/webtransport-go...
GO-2026-6123 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server
Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server...
GO-2026-6111 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data in github.com/jandedobbeleer/oh-my-posh
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data in github.com/jandedobbeleer/oh-my-posh...
GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings
Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...
SUSE-SU-2026:23211-1 Security update for suseconnect-ng
This update for suseconnect-ng fixes the following issue: - Build against outdated go1.24-openssl bsc1268900. Changes for suseconnect-ng: - Update version to 1.23.0: - Use product identifier for product migrations bsc1268596. - Switch to using go1.26-openssl as the default Go version to install t...
Security update for go1.26
This update for go1.26 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...
Security update for go1.25
This update for go1.25 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.29 security and extras update
Red Hat OpenShift Container Platform release 4.21.29 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.34 security and extras update
Red Hat OpenShift Container Platform release 4.20.34 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...
SUSE CVE-2026-17106
The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...
PT-2026-80278
Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...
ROS-20260818-73-0006
The vulnerability of the HTTP/2 implementation in the Go programming language is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...
ROS-20260818-73-0008
The vulnerability of adding additional tools and integration libraries for the Go language-based OpenTelemetry framework is related to the use of an unreliable search path. Exploiting this vulnerability allows an attacker to execute arbitrary code...