cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

GHSA-XH87-MX6M-69F3 vulnerabilities

Vulnerabilities for packages: kibana...

CVE-2026-28418

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundar...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-WH2J-26J7-9728 vulnerabilities

Vulnerabilities for packages: airflow...

cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

GHSA-QVHC-9V3J-5RFW vulnerabilities

Vulnerabilities for packages: dotnet...

CVE-2026-2869

A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetcvarset of the file src/core/specials.c of the component handleattr Handler. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment...

GHSA-69X3-G4R3-P962 vulnerabilities

Vulnerabilities for packages: caddy-fips, step-ca, step, step-ca-fips, step-fips, step-issuer-fips, caddy, step-issuer...

GHSA-FPJ8-GQ4V-P354 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-3PPC-4F35-3M26 vulnerabilities

Vulnerabilities for packages: pnpm-stage0, vitess, opensearch-dashboards, renovate, prism, serve, kubeflow-katib, tileserver-gl, rancher-api-ui, saf, npm, lerna, ts-patch, argo-workflows, kubeflow-centraldashboard, langfuse, node-gyp, kubeflow-pipelines, code-server, pulumi, sqlpad, eslint...

GHSA-2G4F-4PWH-QVX6 vulnerabilities

Vulnerabilities for packages: saf, vitess, langfuse-fips, tileserver-gl-fips, gitlab-rails-ce, librechat, kubeflow-pipelines, wazuh-dashboard, argo-workflows, renovate, eslint, kubeflow-centraldashboard, langfuse, prism, opensearch-dashboards, kibana, tileserver-gl, serve, gitlab-rails-ce-fips,...

CVE-2025-14505 vulnerabilities

Vulnerabilities for packages: librechat, opensearch-dashboards, opensearch-dashboards-fips...

freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit a use-after-free vulnerability by enticing a client to connect to it. This can lead to a client-side crash, resulting in a Denial of Service DoS, and potentially allow for arbitrary...

fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow

A flaw was found in FontForge. A remote attacker could exploit a heap-based buffer overflow vulnerability during SFD file parsing. This issue arises from insufficient validation of user-supplied data length before copying it to a buffer. Successful exploitation requires user interaction, such as...

GHSA-PQXR-3G65-P328 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2025-38022 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-38022 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2026-2241

A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function osstrftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is...

CVE-2025-11961 affecting package nmap for versions less than 7.93-4

CVE-2025-11961 affecting package nmap for versions less than 7.93-4. A patched version of the package is available...