GO-2024-2888 vulnerabilities

Vulnerabilities for packages: nodetaint, buildkitd, go-md2man, bom, helm-docs, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, fluent-bit-plugin-loki, terraform-docs, kubernetes-dns-node-cache, smarter-device-manager, thanos, grafana-agent-operator, ghaudit, kustomize,...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: nodetaint, buildkitd, go-md2man, bom, helm-docs, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, fluent-bit-plugin-loki, terraform-docs, kubernetes-dns-node-cache, smarter-device-manager, crossplane-provider-aws-firehose, thanos,...

GO-2024-3005 vulnerabilities

Vulnerabilities for packages: kubescape, skopeo, buildkitd, up, helm-operator, docker, bom, zarf, cri-tools, ko, crossplane, zot, gitsign, dive, flux-helm-controller, gh, dagdotdev, helm, k3d, vexctl, neuvector-sigstore-interface, skaffold, syft, k9s, timoni, tkn, newrelic-infrastructure-agent,...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: buildkitd, nri-mssql, dynamic-localpv-provisioner, bom, helm-docs, zarf, fscrypt, tflint, gitleaks, kiali, restic, crossplane-provider-aws-s3, spegel, step-issuer, atlantis, src-fingerprint, temporal-ui-server, conftest, nri-kafka, falcosidekick, litestream,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: kubescape, skopeo, buildkitd, rabbitmq-messaging-topology-operator, rekor, crossplane-provider-azure-storage, zarf, crossplane-provider-azure-authorization, zot, kubevela, gitsign, flux-helm-controller, gh, vexctl, k3d, src-fingerprint, argo-events, bank-vaults,...

GO-2024-2963 vulnerabilities

Vulnerabilities for packages: nodetaint, go-md2man, bom, helm-docs, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, fluent-bit-plugin-loki, terraform-docs, kubernetes-dns-node-cache, smarter-device-manager, thanos, grafana-agent-operator, ghaudit, kustomize, shfmt, gops,...

GO-2025-3373 vulnerabilities

Vulnerabilities for packages: nodetaint, go-md2man, bom, helm-docs, cni-plugins, restic, src-fingerprint, temporal-ui-server, linkerd2-proxy-init, falcosidekick, fluent-bit-plugin-loki, terraform-docs, smarter-device-manager, thanos, ghaudit, kustomize, descheduler, shfmt, gops,...

GO-2025-3420 vulnerabilities

Vulnerabilities for packages: nodetaint, go-md2man, bom, helm-docs, cni-plugins, restic, src-fingerprint, temporal-ui-server, linkerd2-proxy-init, falcosidekick, fluent-bit-plugin-loki, terraform-docs, smarter-device-manager, thanos, ghaudit, kustomize, descheduler, shfmt, gops,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: buildkitd, nri-mssql, dynamic-localpv-provisioner, bom, helm-docs, fscrypt, tflint, gitleaks, kiali, restic, crossplane-provider-aws-s3, spegel, step-issuer, atlantis, src-fingerprint, temporal-ui-server, conftest, nri-kafka, falcosidekick, litestream,...

GO-2024-3105 vulnerabilities

Vulnerabilities for packages: nodetaint, buildkitd, go-md2man, bom, helm-docs, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, fluent-bit-plugin-loki, terraform-docs, kubernetes-dns-node-cache, smarter-device-manager, crossplane-provider-aws-firehose, thanos,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: buildkitd, go-md2man, dynamic-localpv-provisioner, bom, fuse-overlayfs-snapshotter, vertical-pod-autoscaler, gitleaks, wave, grafana-operator, spegel, atlantis, src-fingerprint, conftest, falcosidekick, litestream, terraform-docs, kubernetes-dns-node-cache,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: nodetaint, buildkitd, go-md2man, bom, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, terraform-docs, kubernetes-dns-node-cache, smarter-device-manager, crossplane-provider-aws-firehose, kubeflow, thanos, grafana-agent-operator, ghaudit,...

ReconTitan

A security-hardened platform for external reconnaissance, OSIN...

Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

nanoclaw v2.2.0

An AI assistant that runs agents securely in their own containers. Lightweight, built to be easily understood and completely customized for your needs. nanoclaw.dev • docs • 中文 • 日本語 • 한국어 • • Why I Built NanoClaw OpenClaw is an impressive project, but I wouldn't have been able to sleep if I had...

CVE-2026-12743

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...