GO-2025-3414 vulnerabilities

Vulnerabilities for packages: podman, buildah...

GO-2024-2599 vulnerabilities

Vulnerabilities for packages: gops, k3d, memcached-exporter, velero, nri-prometheus, ytt, kubernetes-dns-node-cache, kubeflow-pipelines, skaffold, nri-discovery-kubernetes, doppler-kubernetes-operator, gomplate, gobuster, kubewatch, smarter-device-manager, hey, timoni, pulumi-kubernetes-operator,...

GO-2023-2383 vulnerabilities

Vulnerabilities for packages: configmap-reload, gops, k3d, go-bindata, go-licenses, mage, aws-flb-firehose, nri-discovery-kubernetes, cass-operator, cortex, gobuster, gke-gcloud-auth-plugin, smarter-device-manager, hey, aactl, metrics-server, go-md2man, nsc, sops, docker-cli, sonobuoy,...

GO-2025-3595 vulnerabilities

Vulnerabilities for packages: memcached-exporter, fulcio, wuzz, grafana-mimir, doppler-kubernetes-operator, crossplane-provider-aws-cloudformation, temporal, amazon-cloudwatch-agent, newrelic-infrastructure-agent, spicedb, dbmate, clickhouse-operator, actions-runner-controller, xeol, kpt, thanos,...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: geoserver, apache-nifi-registry...

CVE-2026-64582

creationtimestamp| type| source ---|---|--- 2026-08-14 01:02:26+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msyxjuqyyo22 2026-08-14 02:20:02+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3msz3unkaek2n 2026-08-17 01:55:23+00:00| seen|...

PT-2026-72037

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

PT-2026-72038

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

PT-2026-72108

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

PT-2026-72075

Name of the Vulnerable Software and Affected Versions LoRaWAN Fragmented Data Block Transport affected versions not specified Description The LoRaWAN Fragmented Data Block Transport service fails to validate the fragment counter in a received DATA FRAGMENT command before forwarding it to the...

PT-2026-72032

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

PT-2026-72033

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

CVE-2026-27871: Use of a Broken or Risky Cryptographic Algorithm

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63...

CVE-2026-12363: Out-of-bounds Write

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

PT-2026-75940

Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ---------------- | ----- | | Repository | ooples/token-optimizer-mcp | | Affected version | 5.0.1 commit 8137147 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | |...

PT-2026-75925

Summary token-optimizer-mcp is vulnerable to OS command injection in the smart user tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/pass...

PT-2026-76576

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0 Description The dashboard HTTP server lacks authentication middleware for the '/api/session-summary' and '/api/session-events' endpoints, allowing any network-accessible client to access them without...

PT-2026-76567

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

PT-2026-76577

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0 Description OS command injection is possible in the smart user tool. An MCP client can execute arbitrary shell commands with the privileges of the user running the server by providing a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-14456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and...