GO-2024-2937 vulnerabilities

Vulnerabilities for packages: hugo, hugo-extended, chainctl, ollama, gotenberg...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: zot, crossplane-provider-aws-dynamodb, cosign, wolfictl, melange, terragrunt, crossplane, flux-kustomize-controller, crossplane-provider-aws-elasticache, slsa-verifier, crossplane-provider-aws-sns, kubescape, kubevela, pulumi-kubernetes-operator, goreleaser, syft,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: telegraf, atlantis, delve, falco-no-driver, cloud-provider-aws, go, docker-cli, regclient, argo-rollouts, aws-application-networking-k8s, container-object-storage-interface, buf, mongo-tools, fuse-overlayfs-snapshotter, kube-arangodb, nri-mssql, snyk-cli, istio,...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-route53, crossplane-provider-aws-cloudfront, crossplane-provider-aws-kms, crossplane-provider-aws-elasticache, crossplane-provider-azure-sql, nuclei, crossplane-provider-aws-dynamodb,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: tekton-chains, docker-credential-acr-env, gobuster, buf, go-licenses, slsa-verifier, rook, certificate-transparency, protoc-gen-go, crossplane-provider-aws, sbomqs, kubeflow-katib, nfs-subdir-external-provisioner, helm, metacontroller, nsc, oras,...

CVE-2026-19785: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be...

UBUNTU-CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

EUVD-2026-58514

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-73530

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

PT-2026-76037

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

GHSA-2QJV-P2GC-MJG2 Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-47229: Cross-Site Request Forgery (CSRF)

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

CVE-2026-47226: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of modules/documents-files.php evaluates...

CVE-2026-47228: Cross-Site Request Forgery (CSRF)

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47230: Authorization Bypass Through User-Controlled Key

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47232: Cross-Site Request Forgery (CSRF)

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...