21479 matches found
PT-2026-80441
Path traversal via crafted reference names in github.com/go-git/go-git...
PT-2026-80440
Worktree operations may follow symlinks in github.com/go-git/go-git...
CVE-2026-17106: Improper Link Resolution Before File Access
The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...
CVE-2026-17106: Improper Link Resolution Before File Access
The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...
PT-2026-80584
These are all security issues fixed in the go1.27-1.27rc3-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-80341
JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go...
PT-2026-80340
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk...
PT-2026-80403
sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go...
PT-2026-80345
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules in github.com/quic-go/webtransport-go...
CVE-2026-73502: NULL Pointer Dereference
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...
ANT-2026-KC1Y51NF · openmeterio/openmeter · sql_injection
sql-injection medium CVE-2026-8462 GHSA-wc3v-3457-c8cm Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-KC1Y51NF: SQL...
CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
SUSE-SU-2026:23186-1 Security update for suseconnect-ng
This update for suseconnect-ng fixes the following issue: - Build against outdated go1.24-openssl bsc1268900. Changes for suseconnect-ng: - Update version to 1.23.0: - Use product identifier for product migrations bsc1268596. - Switch to using go1.26-openssl as the default Go version to install t...
CVE-2026-74799 SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider...
Unity Linux 20.1070a Security Update: osbuild-composer (UTSA-2026-101351)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101351 advisory. gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :pat...
Unity Linux 20.1070a Security Update: osbuild-composer (UTSA-2026-101489)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101489 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web...
PT-2026-73369
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
Unity Linux 20.1070a Security Update: osbuild-composer (UTSA-2026-100894)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100894 advisory. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is us...
