CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

EUVD-2026-58651

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

EUVD-2026-58631

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, buildkitd, caddy, rancher-webhook, k3s, kubernetes-fips, kubevela, rancher-webhook-fips, kubernetes, prometheus-adapter, kube-oidc-proxy, up...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: atlantis, nri-kubernetes, fulcio, mc-fips, external-secrets-fips, tigera-operator, mc, terraform-provider-google, prometheus-mongodb-exporter, cortex, crossplane-provider-aws-firehose, kubernetes-csi-livenessprobe-fips, kubeflow-pipelines, conftest-fips, influx, kpt,...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: headlamp-fips, octo-sts, bento-fips, cerbos, k6-fips, kube-conformance, gitlab-cng, frankenphp-8.4, gitaly, commercial-grafana, cert-manager-fips, knative-kafka-broker-fips, frankenphp-8.5, argo-workflows-fips, knative-serving-fips, tekton-pipelines, traefik,...

GO-2026-4289 vulnerabilities

Vulnerabilities for packages: cloudflared...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, grafana-agent-operator, terragrunt, k8sgpt, cilium-cli, dagger, grpc-health-probe, tflint, certificate-transparency, sops, guac, kaniko, dex, cloudnative-pg, smarter-device-manager, gomplate, melange, rqlite, k8sgpt-operator, step-ca,...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, atlantis, authservice, fluent-bit-plugin-loki, kots, falcosidekick, splunk-otel-collector, gitea...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: oranda, wasmcloud, wadm, shadowsocks-rust, xh, qdrant, cargo-audit, parseable, rustls-ffi, pixi, wash, sdp-k8s-injector, lychee, zed, tealdeer, zizmor, sccache, sqlx, atuin, nushell, wasm-pack, uv, samply, buck2, deno, linkerd-extension-init, rustup, wasmtime,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, mcp-grafana, istio, mc, certificate-transparency, prometheus-pushgateway, minio-operator, aws-otel-collector, telegraf, loki, splunk-otel-collector, keda, minio, tempo, trillian, karma, datadog-agent, grafana-pyroscope, minio-object-browser, jaeger...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, istio, k8sgpt, mc, certificate-transparency, prometheus, prometheus-pushgateway, minio-operator, grafana, aws-otel-collector, loki, metrics-server, splunk-otel-collector, node-problem-detector, keda, minio, fluent-bit-plugin-loki, tempo, karma,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: terragrunt, tkn, sops, cosign, dex, fulcio, argo-workflows, vexctl, spire-server, flux-source-controller, slsa-verifier, flux-kustomize-controller, cloudflared, tekton-chains, rekor, kubescape, oauth2-proxy, kots, aactl, gitsign...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, newrelic-nri-statsd, azcopy, crossplane-provider-aws-dynamodb, croc, cilium-cli, mc, nri-postgresql, dockerize, aws-flb-cloudwatch, cri-tools, kubelet-csr-approver, boring-registry, apache-exporter, flux-image-automation-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, docker-cli-buildx, tflint, cilium-cli, kyverno-notation-aws, flux, nri-memcached, emissary, nats-server-config-reloader, envconsul, rabbitmq-messaging-topology-operator, thanos-operator, wait-for-port, migrate, pluto, mongo-tools,...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

RLSA-2026:54485 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...

Linux Distros Unpatched Vulnerability : CVE-2026-67990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An...