CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

GHSA-657C-G7QC-R9J2 Redocly CLI: Path traversal when using `split` command

Impact An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sampl...

EUVD-2026-81013

Redocly CLI: Path traversal when using split command...

Redocly CLI: Path traversal when using `split` command

Impact An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sampl...

SUSE-SU-2026:23745-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260264. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass an...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

PT-2026-94384

Name of the Vulnerable Software and Affected Versions Steeltoe versions prior to 4.3.0 Description Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate provided in the X-Client-Cert request header without...

CVE-2026-81868: Authentication Bypass Using an Alternate Path or Channel

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-54355: Improper Neutralization of Input During Web Page Generation

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

PT-2026-95102

Name of the Vulnerable Software and Affected Versions MapServer versions 6.0 through 8.6.3 Description MapServer's OpenLayers HTML output for the endpoint SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP X FORWARDED...

SUSE SLED15: openvpn / openvpn-auth-pam-plugin / openvpn-dco / openvpn-dco-devel / etc (SUSE-SU-2026:4213-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4213-1 advisory. - CVE-2026-63650: OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be...

Security update for gh (important)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21861-1 Rating: important References: bsc1278604 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE : 8.1...

SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4210-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4210-1 advisory. - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an...

CVE-2026-63225

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-63225 Redocly CLI: Path traversal when using `split` command

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-63225

Redocly CLI prior to @redocly/cli 2.33.2 is vulnerable to a path traversal in the split command. The command constructs output file paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying the resolved target remains inside the select...

CVE-2026-63225 Redocly CLI: Path traversal when using `split` command

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

Important: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

Red Hat Edge Manager Version 1.1.4 Security Update Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a...