GO-2026-6354 vulnerabilities

Vulnerabilities for packages: trivy, nuclio-controller, trivy-operator-fips, terraform, wolfictl, commercial-gitlab-workhorse-ee, seaweedfs-rocksdb-fips, gptscript, gatus, apko, rootlesskit-fips, frankenphp-8.5, grafana, scc, gitlab-rails-ce-fips, k9s-fips, zarf-fips,...

GO-2026-6355 vulnerabilities

Vulnerabilities for packages: trivy-operator, opentelemetry-collector, spire-server, nuclei, k9s, kubernetes-dashboard, trufflehog, docker-cli-buildx, argo-cd, kubescape, gomplate, external-dns, osv-scanner, gptscript, podman, nfpm, gitness, flux-image-automation-controller, bento, cerbos, loki,...

CVE-2026-56855 vulnerabilities

Vulnerabilities for packages: trivy-operator, opentelemetry-collector, spire-server, nuclei, k9s, kubernetes-dashboard, trufflehog, docker-cli-buildx, argo-cd, kubescape, gomplate, external-dns, osv-scanner, gptscript, podman, nfpm, gitness, flux-image-automation-controller, bento, cerbos, loki,...

CVE-2026-78662 vulnerabilities

Vulnerabilities for packages: trivy-operator, opentelemetry-collector, spire-server, nuclei, k9s, kubernetes-dashboard, trufflehog, docker-cli-buildx, argo-cd, kubescape, gomplate, external-dns, osv-scanner, gptscript, podman, nfpm, gitness, flux-image-automation-controller, bento, cerbos, loki,...

GO-2026-6354 vulnerabilities

Vulnerabilities for packages: trivy-operator, opentelemetry-collector, spire-server, nuclei, k9s, kubernetes-dashboard, trufflehog, docker-cli-buildx, argo-cd, kubescape, gomplate, external-dns, osv-scanner, gptscript, podman, nfpm, gitness, flux-image-automation-controller, bento, cerbos, loki,...

EUVD-2026-70793

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

CVE-2026-75170: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

EUVD-2026-71443

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

Joern 4.0.618

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-85503

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.10.55 Description A path traversal issue exists in the admin plugin's Save As action due to improper validation of the language code parameter. An authenticated admin user with admin.pages.create permission can use...

CVE-2026-70352

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability

...

CVE-2026-70352

Azure AI Language is affected by a missing authentication vulnerability in a critical function, allowing an unauthorized attacker to elevate privileges over a network . The vulnerability is rated CVSS 10.0 (CRITICAL) with low complexity, no privileges required, no user interaction, and changed sc...

CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability

...

pphack v0.1.5

pphack Advanced Client-Side Prototype Pollution Scanner Coded with 💙 by edoardottt Share on Twitter! Install • Get Started • Examples • Changelog • Contributing • License Install 📡 Using Go go install github.com/edoardottt/pphack/cmd/pphack@latest pphack relies on chromedp, so you need Chrome or...

wrongsecrets-binaries v0.3.0

wrongsecrets-binaries This is a supportive repository for OWASP WrongSecrets. Here we create our binaries which are included in the official project. Want to add a challenge related to secrets hiding in binary? Open a ticket at WrongSecrets issues. Want to fix something you found in one of the...

skillscript v0.40.1

Safe, reusable automation authored by agents. skillscript.ai • docs TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. See Quickstart. What is Skillscript? Skillscript came from asking: what would a Makefile look like if it built skills instead of binaries? The...

RLSA-2026:62577 Important: go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fixes: crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to...