CVE-2025-4664

🔒 Vulnerability CVE-2025-4664 The CVE-2025-4664 vulnerability is a high-severity security flaw identified in the Loader component of Google Chrome, present in versions prior to 136.0.7103.113. This issue allows a remote attacker to leak cross-origin data via a specially crafted HTML page,...

cve-2025-4664

CVE-2025-4664 This repository contains a PoC for exploiting CVE-2025-4664, a vulnerability where Chromium-based browsers leak sensitive URL parameters through Link header preload requests. Resources For a detailed explanation of how this exploit works, read the blog post:...

SUSE-SU-2026:24120-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283642. - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporte...

CVE-2026-88881

A flaw was found in Renovate that leads to information disclosure. When processing paginated responses from a configured repository or datasource server, Renovate fails to validate pagination URLs provided in the HTTP Link header against the originating host before transmitting credentials. A...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4417-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4417-1 advisory. - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction...

Security update for helm

This update for helm fixes the following issues: CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal...

GO-2026-6497 Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go...

PT-2026-105561

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go...

CVE-2026-88887

A flaw was found in Renovate, a dependency update automation tool. When Renovate lists tags or digests for a container image, it follows pagination links provided by the remote registry in the HTTP Link header. However, it fails to verify that the pagination URL has the same origin as the origina...

CVE-2026-88882

A flaw was found in Renovate, a dependency update automation tool. When listing new package versions from a NuGet registry, Renovate follows pagination URLs provided in the HTTP Link header without verifying the target's origin. A malicious or compromised NuGet registry can exploit this by...

CVE-2026-88880

A flaw was found in Renovate. The application fails to validate Link header destinations when processing GitLab server pagination, which allows malicious servers to redirect requests containing credentials. An attacker controlling a compromised GitLab server can specify a crafted Link header to...

Linux Distros Unpatched Vulnerability : CVE-2026-85732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a...

EUVD-2026-80871

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing...

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

GHSA-H7VF-4X9W-H99V oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

CVE-2026-85732

A flaw was found in oras-go, a Go library for managing OCI artifacts. This vulnerability allows a remote attacker to perform blind Server-Side Request Forgery SSRF against internal services by providing a specially crafted Link header URL during pagination operations. Although the response body i...

CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

DEBIAN-CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

CVE-2026-85732

oras-go (a Go library for managing OCI artifacts) prior to 2.6.2 contains a blind SSRF vulnerability in the parseLink function within registry/remote/utils.go. The function accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port, causin...

CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...