CVE-2026-52856 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

GHSA-GHRQ-5WPP-HXX5 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic. Impact All wings users with an open SFTP port. Workarounds Close SFTP port...

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic. Impact All wings users with an open SFTP port. Workarounds Close SFTP port...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

pipelock v3.3.0

Pipelock Open-source AI agent firewall forVerifiable Egress Control. !pipelock...

Security Bulletin: Sterling Order Management System Software, (On prem)

Summary Multiple vulnerabilities were addressed in Sterling Order Management System Software, On prem : 10.0.2607.0-Sterling-SSFF-All-Major-Update-Installer Vulnerability Details CVEID:CVE-2026-48978 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client...

CVE-2026-15381

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-15381 WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-15381

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-15381 WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

[SECURITY] Fedora 43 Update: lego-5.3.1-2.fc43

Let's Encrypt/ACME client written in Go...

openSUSE 16 Security Update : hawk-apiserver (openSUSE-SU-2026:21457-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21457-1 advisory. Changes in hawk-apiserver: - Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 bsc1267454 Version 0.1.0+git.1773234993.db3c82f: handle...

Fedora 43 : pack (2026-e6e0368149)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e6e0368149 advisory. Security update to pack 0.40.8 Fixes CVE-2024-25621: containerd - local privilege escalation Fixes CVE-2025-47913: golang.org/x/crypto/ssh/agent - S...

PT-2026-66717

Name of the Vulnerable Software and Affected Versions WP Go Maps versions prior to 10.1.04 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query. SQL injection is a techniqu...

CVE-2026-67822

The Tenda W6-S wireless access point (firmware v1.0.0.4(510) ) is vulnerable to a stack-based buffer overflow in the formwrlSSIDset() function, which handles the /goform/wifiSSIDset endpoint. The root cause is the use of sprintf to copy user-controlled GO and index parameters into a fixed 64-byte...

CVE-2026-52856: Uncaught Exception

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

PT-2026-66873

Name of the Vulnerable Software and Affected Versions sigstore-go versions prior to 1.2.1 Description The library fails to verify the bundle signing timestamp against the validity window of an ExpiringKey when using a self-managed long-lived signing key without a certificate. This allows an...