GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, argo-workflows-fips, clickhouse-backup-fips, knative-serving, knative-eventing-fips, prometheus, opentofu-fips, gomplate-fips, gitlab-rails-ce, flux-fips, kots, kube-conformance, podman-fips, amazon-ssm-agent, teleport-operator-fips, loki,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cognitoidentity, knative-serving, steampipe, gomplate-fips, crossplane-aws-provider, crossplane-provider-family-aws-fips, crossplane-provider-aws-cloudtrail, loki, pulumi-language-java, crossplane-provider-keycloak,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, argo-workflows-fips, knative-serving, knative-eventing-fips, prometheus, opentofu-fips, gomplate-fips, gitlab-rails-ce, flux-fips, kots, kube-conformance, podman-fips, amazon-ssm-agent, teleport-operator-fips, loki, pulumi-language-java,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: rancher-machine, gh, syft, buildkitd, opentelemetry-collector, teleport, aactl, knative-serving, pulumi-language-yaml, atlantis, fulcio, gomplate, pulumi-language-dotnet, podman, terraform-provider-azurerm, tflint, gptscript, falco-no-driver, apko, external-dns,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: external-secrets-operator, nerdctl, containerd, minio, prometheus-operator, mattermost, trivy-operator, opentelemetry-collector, flux, skaffold, aactl, cilium-cli, kine, rancher, zot, knative-serving, prometheus, istio, k3s, flux-image-automation-controller, kaf,...

CVE-2026-46601

A flaw was found in the golang.org/x/image/webp library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service DoS for...

CVE-2026-44696

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text markdown rendering pipeline uses Sanitize::Config::RELAXED:css for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML...

libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations,...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict via the downloadImage process. An attacker can execute arbitrary scripts in the context of the application by tricking a user into visiting a crafted link that proxies malicious content through the image proxy...

GHSA-4C8J-MGM4-QQVP Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...

EUVD-2026-37511

Remark42: Cross-Site Scripting XSS on /api/v1/img via content-type spoofing...

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a crafted Incus-Image-Hash header containing directory...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a crafted Incus-Image-Hash header containing directory...

Incus has an arbitrary file write on its client due to trusted image hash

Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details - cmd/incusd/images.go:611-684 handles source.type=url by HEADing the user-supplied URL,...

GHSA-F6M5-XW2G-XC4X Incus has an arbitrary file write on its client due to trusted image hash

Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details - cmd/incusd/images.go:611-684 handles source.type=url by HEADing the user-supplied URL,...

Improper Input Validation

Overview github.com/lxc/incus/v6/shared/validate is a None Affected versions of this package are vulnerable to Improper Input Validation. via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a...