GO-2026-4340 vulnerabilities

Vulnerabilities for packages: aws-flb-cloudwatch, bento, crossplane-provider-aws-ec2, crossplane-provider-sql, influx, kubescape-operator, spire-server, whereabouts, amass, nri-redis, boring-registry, kubernetes-csi-external-attacher, nri-postgresql, vault-k8s, sftpgo-plugin-kms,...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.2 (AXSA:2026-1500:11)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1500:11 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.1 (AXSA:2026-1441:10)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1441:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

CLEANSTART-2026-CS42741 Security fixes in git-lfs 3.7.0-r1

Package git-lfs version 3.7.0-r1 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2025-61732, CVE-2022-3219...

CLEANSTART-2026-QB92274 Security fixes in git-lfs 3.7.0-r3

Package git-lfs version 3.7.0-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CLEANSTART-2026-QQ25603 Security fixes in git-lfs 3.1.2-r3

Package git-lfs version 3.1.2-r3 fixes 1 vulnerabilities: CVE-2021-38561...

CLEANSTART-2026-XM62269 Security fixes in git-lfs-fips 3.7.0-r2

Package git-lfs-fips version 3.7.0-r2 fixes 11 vulnerabilities: CVE-2025-47911, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2025-61730...

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5. A patched version of the package is available...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

Oracle Linux 10 : git-lfs (ELSA-2026-19133)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19133 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 10 : git-lfs (ELSA-2026-30855)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30855 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

AZL-93186 CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be caused by...

Oracle Linux 10 : git-lfs (ELSA-2026-39272)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39272 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

MiracleLinux 8 : git-lfs-3.4.1-12.el8_10 (AXSA:2026-1269:09)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1269:09 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

Oracle Linux 8 : git-lfs (ELSA-2026-39266)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39266 advisory. 3.4.1-12 - Rebuild with new Golang - Resolves: RHEL-187191 Tenable has extracted the preceding description block directly from the Oracle Linux security...

RockyLinux 8 : git-lfs (RLSA-2026:39266)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39266 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

AlmaLinux 10 : git-lfs (ALSA-2026:39272)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39272 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...