GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, gitea, openbao, teleport, terraform, external-secrets-operator, rancher-webhook, frp, yunikorn-k8shim, minio, gitlab-runner, cert-manager-istio-csr, rancher-agent, flux, percona-server-mongodb-operator, zot, juicefs, k6, rclone, grafana, telegra...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, gitea, openbao, teleport, terraform, external-secrets-operator, rancher-webhook, frp, yunikorn-k8shim, minio, gitlab-runner, cert-manager-istio-csr, rancher-agent, flux, percona-server-mongodb-operator, zot, juicefs, k6, rclone, grafana, telegra...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: hydra-fips, gitlab-kas, sftpgo, commercial-grafana, pgtimetable-fips, pgtimetable, splunk-otel-collector, vault-fips, temporal-server-fips, trillian-fips, gitlab-kas-fips, splunk-otel-collector-fips, juicefs, kine, teleport, grafana-alloy-fips, hydra, gitaly,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, victoriametrics, flux-image-reflector-controller, grafana-rollout-operator, osv-scanner, sftpgo-plugin-eventsearch, envoy-ratelimit, fluxcd-kustomize-mutating-webhook, nodetaint, smokescreen, grafana-operator, malcontent,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: spegel, azure-service-operator, grafana-rollout-operator, kyverno-policy-reporter-ui, neuvector-scanner, contour, kyverno-notation-aws, osv-scanner, prometheus-operator, terraform-provider-pagerduty, rancher-helm, helm-mapkubeapis, falco-no-driver, gcsfuse, redka,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, image-factory-fips, flux-kustomize-controller-fips, vault-env, grafana-mimir, kyverno-fips, rancher, splunk-otel-collector, juicefs, kyverno-policy-reporter-plugins-kyverno, cluster-api-aws-controller-fips, gitlab-workhorse-ce, envconsul, teleport,...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

SUSE CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

SUSE CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

GO-2026-4697 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo...

GO-2026-4699 SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo

SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915

SFTPGo (open source file transfer app) before v2.7.1 is affected by an input validation issue in dynamic group paths, where placeholders like %username% are not strictly sanitized against relative path components. This can allow a crafted username to cause the substituted path for a group’s home ...

CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

CVE-2026-30914 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...