Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper verification of x-amz- headers in the request. An attacker can gain unauthorized read access to objects by adding the x-amz-copy-source header to a presigned PUT URL,...

Improper Verification of Cryptographic Signature

Overview github.com/minio/minio/cmd is an open source object storage server compatible with Amazon S3 APIs. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper verification of x-amz- headers in the request. An attacker can gain...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21884-1 Rating: important References: bsc1276981 bsc1276994 bsc1278681 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-71556...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

Incorrect Authorization

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

ROOT-APP-GOBINARY-CVE-2026-77412 CVE-2026-77412 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77412 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77410 CVE-2026-77410 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77410 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77404 CVE-2026-77404 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77404 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77403 CVE-2026-77403 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77403 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77407 CVE-2026-77407 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77407 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77411 CVE-2026-77411 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77411 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77405 CVE-2026-77405 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77405 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77406 CVE-2026-77406 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77406 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77408 CVE-2026-77408 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77408 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

GHSA-328G-JX67-V94G Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

Timing Attack

Overview github.com/hashicorp/vault/http is an a tool for securely accessing secrets. Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...