CVE-2026-15381 WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

[SECURITY] Fedora 43 Update: lego-5.3.1-2.fc43

Let's Encrypt/ACME client written in Go...

CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

PT-2026-66873

Name of the Vulnerable Software and Affected Versions sigstore-go versions prior to 1.2.1 Description The library fails to verify the bundle signing timestamp against the validity window of an ExpiringKey when using a self-managed long-lived signing key without a certificate. This allows an...

Fedora 43 : pack (2026-e6e0368149)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e6e0368149 advisory. Security update to pack 0.40.8 Fixes CVE-2024-25621: containerd - local privilege escalation Fixes CVE-2025-47913: golang.org/x/crypto/ssh/agent - S...

CVE-2026-67822

CVE-2026-67822 affects Tenda W6-S 1.0.0.4(510). The vulnerability is a stack-based buffer overflow in the /goform/wifiSSIDset endpoint, where the function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length checks, leading to ...

Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

SUSE CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

CVE-2026-41186 affects Calico components (kube-controllers and Goldmane) where an opt-in Go pprof debug listener, if enabled, binds to 0.0.0.0 and allows unauthenticated access. This exposes the process heap, goroutine stacks (including function arguments), and command-line arguments to any pod w...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

OPENSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2 Use proper obs time forma...

SUSE-SU-2026:3421-1 Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: - Release 1.4.2 Use proper obs time...

CLEANSTART-2026-QJ68889 Security fixes in go1.24 1.24.11-r0

Package go1.24 version 1.24.11-r0 fixes 7 vulnerabilities: ghsa-v778-237x-gjrc, ghsa-hcg3-q754-cr77, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-p782-xgp4-8hr8...

CLEANSTART-2026-TB77865 Security fixes in go-discover-fips 0_git20250325-r0

Package go-discover-fips version 0git20250325-r0 fixes 14 vulnerabilities: CVE-2025-22871, CVE-2025-4674, CVE-2025-58187, CVE-2025-58188, CVE-2025-61723...

CLEANSTART-2026-JM58207 Security fixes in go-discover 0_git20250325-r1

Package go-discover version 0git20250325-r1 fixes 8 vulnerabilities: CVE-2026-42505, CVE-2026-39822, CVE-2026-42504, CVE-2026-42507, CVE-2026-42506...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...