CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, gatekeeper, nri-couchbase, manifest-tool, aws-otel-collector, opa, traefik, pulumi-language-java, k3d, terraform-provider-tls, trillian, gostatsd, k8s-device-plugin, kubernetes-csi-external-resizer, kine,...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, gatekeeper, nri-couchbase, manifest-tool, aws-otel-collector, opa, traefik, pulumi-language-java, k3d, terraform-provider-tls, trillian, gostatsd, k8s-device-plugin, kubernetes-csi-external-resizer, kine,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, gatekeeper, nri-couchbase, manifest-tool, aws-otel-collector, opa, traefik, pulumi-language-java, k3d, terraform-provider-tls, trillian, gostatsd, k8s-device-plugin, kubernetes-csi-external-resizer, kine,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, gatekeeper, nri-couchbase, manifest-tool, aws-otel-collector, opa, traefik, pulumi-language-java, k3d, terraform-provider-tls, trillian, gostatsd, k8s-device-plugin, kubernetes-csi-external-resizer, kine,...

CVE-2026-56853 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, spegel, sqlexporter, kubernetes, kubernetes-replicator, frp, vcluster, cosign, opa, flyte, argocd-image-updater, traefik, docker-machine-driver-harvester, ko, kubernetes-csi-external-snapshotter, postgres-operator,...

github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation

A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...

CVE-2026-33818

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-56860

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-56858

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-56853

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

MAL-2026-14040 Malicious code in @workoscalifant/sudoku-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint wi...

AZL-96635 CVE-2026-72816 affecting package gh for versions less than 2.97.0-1

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

AZL-96689 CVE-2026-72816 affecting package influxdb 2.7.5-21

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

AZL-96692 CVE-2026-72817 affecting package influxdb for versions less than 2.7.5-21

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

UBUNTU-CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

UBUNTU-CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...