GO-2026-5694 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws, trivy, zot, kubescape, policy-controller, slsa-verifier, teleport, trivy-operator, crossplane, aactl, ratify...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws, skopeo, gitsign, flux-source-controller, kubescape, falcoctl, slsa-verifier, zarf, tekton-chains, buildah, falco-no-driver, podman, witness, aactl, kots, ratify, undock...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: kyverno, policy-controller, zarf, teleport, goreleaser, trivy-operator, crossplane, aactl, ratify, kyverno-notation-aws, ko, spire-server, kubescape, neuvector-sigstore-interface, gitsign, tflint, falcoctl, tkn, tekton-chains, slsa-verifier...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: policy-controller, zarf, docker-cli-buildx, teleport, vexctl, goreleaser, zot, aactl, ratify, kyverno-notation-aws, ko, spire-server, flux-source-controller, kubescape, skaffold, witness, neuvector-sigstore-interface, sigstore-scaffolding, gh, gitsign, cosign, tflint...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: goreleaser, kyverno-notation-aws, gitsign, flux-source-controller, zot, policy-controller, falcoctl, teleport, tkn, witness, aactl, ratify...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: kyverno, policy-controller, zarf, docker-cli-buildx, teleport, vexctl, goreleaser, zot, trivy-operator, crossplane, aactl, ratify, kyverno-notation-aws, ko, spire-server, flux-source-controller, buildkitd, kubescape, skaffold, docker, witness,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: pvc-autoresizer, actions-runner-controller, cluster-api-ipam-provider-in-cluster, terraform-provider-time, openbao-k8s, kubo, extism, rabbitmq-cluster-operator, fluxcd-kustomize-mutating-webhook, kubernetes-csi-external-resizer, flux-image-automation-controller,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: policy-controller, zarf, teleport, vexctl, goreleaser, zot, trivy-operator, aactl, ratify, kyverno-notation-aws, ko, spire-server, flux-source-controller, buildkitd, kubescape, skaffold, docker, witness, neuvector-sigstore-interface, sigstore-scaffolding, trivy, gh,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: rabbitmq-cluster-operator, docker-cli-buildx, fzf, rancher-system-upgrade-controller, wal-g, mongo-tools, libnvidia-container, headlamp, mockgen, cilium-cli, ipfs-cluster, cis-operator, nri-mysql, aactl, gobuster, gobump, step-kms-plugin, lazydocker,...

CVE-2026-72819: Improper Control of Generation of Code

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-72749

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

EUVD-2026-56139

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

CVE-2026-72749 n8n before 1.123.67 Prototype Pollution via Edit Fields

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

JLSEC-2026-1235

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations...

Uncontrolled Resource Consumption

github.com/pterodactyl/wings is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded JSON, YAML, and XML configuration file parsers in parser.go processing oversized non-file parser configuration data, which allows an attacker to exhaust the Wings process memory...

CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

CVE-2026-58216 Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...