GO-2026-5013 vulnerabilities

Vulnerabilities for packages: podman, crossplane-provider-aws-kms, tkn, docker, pulumi-language-java, crossplane-provider-aws-rds, kargo, k9s, kubescape, nerdctl, nuclei, melange, crossplane-provider-aws-sqs, gatus, cosign, crossplane-provider-azure-storage, crossplane-provider-aws-iam, trivy,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: eksctl, conftest, redis-operator, bento, flux-kustomize-controller, mc, spire-server, goreleaser, traefik, dask-gateway, xeol, nerdctl, terraform-provider-pagerduty, helm-set-status, k3s, falco-no-driver, telegraf, opentofu, bom, aws-flb-cloudwatch, kine, kubo, cosig...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: bento, gogatekeeper, dask-gateway, nginx-prometheus-exporter, crossplane-provider-aws-rds, nerdctl, kyverno-policy-reporter-ui, minio-operator, helm-set-status, podinfo, lazygit, cloud-provider-vsphere, boring-registry, bom, ratify, kserve-modelmesh-serving, blobfuse...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: delve, tkn, nginx-prometheus-exporter, cerbos, aws-application-networking-k8s, helm-set-status, nuclei, cloud-provider-vsphere, ratify, bom, yunikorn-k8shim, rancher-system-upgrade-controller, ipfs-cluster, harbor-registry, opa, envconsul, trivy, kind, nri-apache, ko...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, buf, k9s, kubescape, lazygit, nuclei, opentelemetry-collector-contrib, kratos, yunikorn-k8shim, mkcert, k6, restic, crossplane-provider-azure-storage, configmap-reload, sftpgo-plugin-eventsearch, paranoia, dbmate, wolfictl, seaweedfs,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: buf, k9s, kubescape, kyverno-policy-reporter-ui, lazygit, nuclei, opentelemetry-collector-contrib, crossplane-provider-aws-sqs, mkcert, k6, octo-sts, crossplane-provider-azure-storage, restic, nsc, tfsec, minify, protoc-gen-go-grpc, configmap-reload, paranoia, dbmate...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, k3d, flux-kustomize-controller, flux, rabbitmq-messaging-topology-operator, goreleaser, spire-server, tkn, vexctl, kargo, kubescape, neuvector-sigstore-interface, k3s, timestamp-authority, nuclei, opentelemetry-collector-contrib, guac,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: buf, k9s, kubescape, kyverno-policy-reporter-ui, lazygit, nuclei, opentelemetry-collector-contrib, crossplane-provider-aws-sqs, mkcert, restic, crossplane-provider-azure-storage, nsc, tfsec, minify, protoc-gen-go-grpc, configmap-reload, paranoia, crane,...

CVE-2026-73683: Authentication Bypass by Capture-replay

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

CVE-2026-73304

Summary: Budibase prior to 3.39.25 exposed OAuth2 tokens (oauth2.accessToken, oauth2.refreshToken) in user metadata responses. The list endpoint (/api/users/metadata) and the single-user endpoint (/api/users/metadata/:id) return full user profiles without removing these fields, enabling any user ...

EUVD-2026-58525

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840

OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-18511

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary cod...

EUVD-2026-58470

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary cod...