GO-2026-6372 vulnerabilities

Vulnerabilities for packages: bento-fips, minio-fips, trufflehog-fips, trufflehog, dapr-fips, keda-fips, argo-events-fips, falcosidekick-fips, telegraf, sftpgo-plugin-pubsub, argo-events, guac, falcosidekick, versitygw, versitygw-fips, bento, keda, nuclio-controller-fips, minio, nuclio-controller...

GO-2026-6441 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent, volcano-fips, helm, ipfs-cluster, kyverno, litestream, commercial-expanso-edge, kubernetes-csi-external-resizer, lvm-driver, spicedb-operator, vcluster, blob-csi, tempo, rancher-agent, calico, dapr-fips, aws-otel-collector,...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-schemas-fips, dex, sigstore-scaffolding, crossplane-provider-aws-applicationinsights, crossplane-provider-aws-opensearchserverless, descheduler, coredns, longhorn-share-manager, keda-http-add-on, envoy-ratelimit-fips, cluster-autoscaler,...

GO-2026-6348 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-schemas-fips, dex, sigstore-scaffolding, crossplane-provider-aws-applicationinsights, crossplane-provider-aws-opensearchserverless, descheduler, coredns, longhorn-share-manager, keda-http-add-on, envoy-ratelimit-fips, cluster-autoscaler,...

GO-2026-6356 vulnerabilities

Vulnerabilities for packages: vitess...

GO-2026-6441 vulnerabilities

Vulnerabilities for packages: cilium, gitlab-runner, istio, kubeflow, vcluster, calico, tempo, falco-exporter, secrets-store-csi-driver-provider-azure, blob-csi, bank-vaults, gitlab-pages, litestream, smarter-device-manager, amazon-cloudwatch-agent, cerbos, hydra, aws-otel-collector, rancher-agen...

GO-2026-6372 vulnerabilities

Vulnerabilities for packages: keda, argo-events, dapr, minio, bento, telegraf, opentelemetry-collector-contrib, guac, sftpgo-plugin-pubsub, falcosidekick, trufflehog...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: authservice, dynamic-localpv-provisioner, temporal-ui-server, cosign, fluent-bit-plugin-loki, victoriametrics-operator, k8ssandra-operator, kwok, cluster-api-azure-controller, cluster-api, redis-operator, k6, crossplane-provider-aws-kinesis, ratify, cert-manager,...

GO-2026-6348 vulnerabilities

Vulnerabilities for packages: azurefile-csi, authservice, dynamic-localpv-provisioner, temporal-ui-server, cosign, fluent-bit-plugin-loki, victoriametrics-operator, k8ssandra-operator, kwok, cluster-api-azure-controller, cluster-api, redis-operator, k6, crossplane-provider-aws-kinesis, ratify,...

CVE-2026-81871

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-81869

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

CVE-2026-92475

A weakness has been identified in GPAC 26.08-DEV. This impacts the function waitforheaderandparse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-81870

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-92474

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

USN-8776-1: python-cryptography vulnerabilities

It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. CVE-2023-23931 It was discovered that...

CVE-2026-81870

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

unbound: Unbound: DNS cache poisoning via UDP source port predictability

A flaw in Unbound's SOREUSEPORT implementation reduces UDP source port entropy by allowing attackers to map ports to specific worker threads. This enables DNS cache poisoning, potentially leading to traffic redirection or unauthorized information disclosure...