EUVD-2026-65535

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

AZL-97649 CVE-2026-17113 affecting package cri-o 1.30.1-1

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

GO-2026-6237 vulnerabilities

Vulnerabilities for packages: cni-plugins, kube-vip...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2024-3042 vulnerabilities

Vulnerabilities for packages: podman...

GO-2023-2042 vulnerabilities

Vulnerabilities for packages: metrics-server...

GO-2023-1897 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3833 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GO-2023-2185 vulnerabilities

Vulnerabilities for packages: go...

GO-2026-5021 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, vitess, mattermost-fips, kubernetes-fips, terragrunt, external-secrets-operator-fips, falco-no-driver, gitsign, etcd, gatekeeper, guac, argo-workflows, keda-fips, grafana, zitadel, external-secrets-operator, nemo, flux, argo-events-fips, mattermost,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-web-fips, prometheus-stackdriver-exporter, cephcsi-fips, aws-iam-authenticator-fips, apisix-ingress-controller, tekton-pipelines-fips, gatekeeper, guac, nsc, blob-csi, grafana, kepler, argo-cd, prometheus-postgres-exporter-fips, mockery,...

GO-2026-5247 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

GO-2026-5757 vulnerabilities

Vulnerabilities for packages: minio...

GO-2025-4043 vulnerabilities

Vulnerabilities for packages: neuvector-scanner...

GO-2023-1897 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3845 vulnerabilities

Vulnerabilities for packages: gatus...

GO-2026-4740 vulnerabilities

Vulnerabilities for packages: flyte...

GO-2025-4181 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2026-4865 vulnerabilities

Vulnerabilities for packages: vault-benchmark, mc, newrelic-infrastructure-agent, sftpgo-plugin-auth, zot, mattermost, filebrowser, rook, prometheus-pushgateway, argo-cd, chartmuseum, crossplane-provider-family-azure, kubernetes-csi-livenessprobe, kwok, secrets-store-csi-driver-provider-azure,...

CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...