48435 matches found
PT-2026-52909
Name of the Vulnerable Software and Affected Versions RustFS version 1.0.0-beta.4 Description Authenticated users with PutObject permission on their own bucket can exploit a path traversal issue in the Snowball auto-extract feature to write arbitrary objects into buckets belonging to other users,...
CVE-2026-39031
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a...
Oracle Linux 9 : coreutils (ELSA-2026-28911)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28911 advisory. 8.32-41.0.1 - clean up empty file if cp is failed Orabug 15973168 9.5-8 - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification RHEL-180331...
CVE-2025-15661
A flaw in libssh2's sftpsymlink function allows a malicious SSH server or man-in-the-middle attacker to trigger an out-of-bounds heap read via a crafted SSHFXPNAME response. This can disclose heap memory contents or crash the application, causing a denial of service DoS. Mitigation Implement stri...
GO-2026-5636 Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg
Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg...
GO-2026-5680 ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check in github.com/shellhub-io/shellhub
ShellHub has cross-tenant IDOR in GET /api/namespaces/:tenant via API Key bypasses membership check in github.com/shellhub-io/shellhub...
GO-2026-5572 Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) in github.com/gotenberg/gotenberg
Gotenberg has ExifTool stdin argument injection via metadata value newlines bypass of key sanitization fix in github.com/gotenberg/gotenberg...
GO-2026-5519 goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs...
GO-2026-5483 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga...
GO-2026-5508 axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go
axonflow-sdk-go: Webhook signing-key HMAC-SHA256 not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go...
GO-2026-5444 mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure
mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure...
GO-2026-5497 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
apko DiscoverKeys has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko...
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
GHSA-X527-X647-Q7GG golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
EUVD-2026-31398
golang.org/x/crypto/ssh: Invoking VerifiedPublicKeyCallback permissions skip enforcement...
GHSA-5CGQ-3RG8-M6CV golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked...
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked...
EUVD-2026-31399
golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status...
GHSA-89GR-R52H-F8RX golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
The Verify method for FIDO/U2F security key types [email protected], [email protected] did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,...