36507 matches found
GO-2026-5925 Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder
Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder...
GO-2026-5921 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder...
GO-2026-5922 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder
Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder...
GO-2026-5918 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder
Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder...
GO-2026-5806 Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus...
GO-2026-5570 Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf
Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf...
awesome-panel-extensions (>=20210326.1.0, <=20210502.1.0), castordashboard (>=2.2.0, <=2.2.2) +6 more potentially affected by CVE-2026-21883 via bokeh (2.3.0)
bokeh PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bokeh and may be impacted: - awesome-panel-extensions =20210326.1.0, =2.2.0, =0.3.0, =0.1.2, =0.0.152, =20210403.1.0, =0.0.25, =0.3.2, =0.4.0 Source cves: CVE-2026-21883 Source...
libsodium has Incomplete List of Disallowed Inputs
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.This advisoory...
PYSEC-2026-1216 BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...
BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
SummaryDue to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. ImpactA user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...
PYSEC-2026-2054 XGrammar affected by Denial of Service by infinite recursion grammars
Summary This issue: http://github.com/mlc-ai/xgrammar/issues/250 should have it's own security advisory. Since several tools accept and pass user supplied grammars to xgrammar, and it is so easy to trigger it seems like a High...
GO-2026-5915 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder...
GO-2026-5899 Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor
Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor...
GO-2026-5869 Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher
Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5895 Casdoor has an authentication bypass in github.com/casdoor/casdoor
Casdoor has an authentication bypass in github.com/casdoor/casdoor...
GO-2026-5866 Concourse login flow has an open redirect issue in github.com/concourse/concourse
Concourse login flow has an open redirect issue in github.com/concourse/concourse...
GO-2026-5867 picoclaw is vulnerable to OS command injection via the ExecTool component in github.com/sipeed/picoclaw
picoclaw is vulnerable to OS command injection via the ExecTool component in github.com/sipeed/picoclaw...
GO-2026-5903 Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon...
GO-2026-5837 DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph
The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language DQL injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to brea...