EUVD-2026-20002

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-27140

CVE-2026-27140 affects Go toolchain components (Go golang and related tooling) via SWIG file name handling. The issue arises when SWIG file names containing 'cgo' enable code smuggling and arbitrary code execution at build time due to a trust-layer bypass. Connected advisories (Red Hat RHSA advis...

Directory Traversal

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal in the toSSG function when handling dynamic route parameters provided via ssgParams. An attacker can cause files to be written outside the intended output directory by...

Linux Distros Unpatched Vulnerability : CVE-2026-39860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix...

Google Go 安全漏洞

Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from SWIG filenames marked with the "go" label and containing carefully crafted malicious...

Red Hat Web Terminal 安全漏洞

Red Hat Web Terminal is a browser-based terminal tool developed by the American company Red Hat. There is a security vulnerability in Red Hat Web Terminal, which stems from the fact that the /etc/passwd file was set with writeable group permissions during the build process. This vulnerability cou...

PT-2026-32542

Name of the Vulnerable Software and Affected Versions jq affected versions not specified Description The strindices builtin in src/builtin.c passes arguments to jv string indexes in src/jv.c without verifying they are strings. Because jv string indexes relies on assert checks that are removed in...

PT-2026-31407

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX53 v1.0 versions prior to 1.7.1 Build 20260213 Description A stack-based buffer overflow occurs in the tmpServer module. An authenticated adjacent attacker can trigger a segmentation fault and potentially execute arbitrary cod...

git-lfs security update

3.6.1-8 - Rebuild with new Golang...

PT-2026-31282

Summary A path traversal issue in toSSG allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. Details The...

GO-2026-4871 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...

EUVD-2026-19918

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...

PT-2026-31058

Name of the Vulnerable Software and Affected Versions SWIG affected versions not specified Description SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. Recommendations At the moment, there...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +215 more potentially affected by CVE-2026-39365 via vite (>=6.0.0, <=6.4.1)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =4.4.4-beta.0 and more Source cves: CVE-2026-39365 Source advisory: OSV:GHSA-4W7W-66W2-5VF9...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +215 more potentially affected by CVE-2026-39365 via vite (>=6.0.0, <=6.4.1)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =4.4.4-beta.0 and more Source cves: CVE-2026-39365 Source advisory: SNYK:JS-VITE-15922213...

@ablehi/automation-app-build (>=0.1.0, <=0.1.22), @ablehi/automation-app-cli (>=0.1.0, <=0.1.22) +144 more potentially affected by CVE-2026-39365 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.1.0, =0.1.0, =0.0.0-experimental-04f2240-20260306-7fcde375, =0.0.0-experimental-fd6d426-20260301-87c73ec5 and more Source cves: CVE-2026-39365 Source advisory:...