GO-2026-5853 vulnerabilities

Vulnerabilities for packages: podman, ratify, witness, kyverno, skopeo, kots, buildah, aactl, undock, gitsign, slsa-verifier, tekton-chains, kyverno-notation-aws, kubescape, flux-source-controller, falco-no-driver, falcoctl, zarf...

GO-2026-5694 vulnerabilities

Vulnerabilities for packages: ratify, kyverno, zot, teleport, aactl, policy-controller, slsa-verifier, kyverno-notation-aws, kubescape, crossplane, trivy, trivy-operator...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: ko, kyverno, teleport, spire-server, tkn, goreleaser, neuvector-sigstore-interface, kubescape, trivy-operator, ratify, aactl, gitsign, slsa-verifier, tekton-chains, falcoctl, policy-controller, kyverno-notation-aws, crossplane, zarf, tflint...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: ko, teleport, spire-server, tkn, goreleaser, vexctl, neuvector-sigstore-interface, kubescape, skaffold, docker-cli-buildx, gh, ratify, zot, sigstore-scaffolding, cosign, aactl, gitsign, tekton-chains, flux-source-controller, falcoctl, policy-controller,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: bento, gogatekeeper, dask-gateway, nginx-prometheus-exporter, crossplane-provider-aws-rds, nerdctl, kyverno-policy-reporter-ui, minio-operator, helm-set-status, podinfo, lazygit, cloud-provider-vsphere, boring-registry, bom, ratify, kserve-modelmesh-serving, blobfuse...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: witness, ratify, zot, teleport, tkn, aactl, goreleaser, policy-controller, gitsign, kyverno-notation-aws, flux-source-controller, falcoctl...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: ko, kyverno, teleport, spire-server, tkn, goreleaser, docker, vexctl, neuvector-sigstore-interface, kubescape, skaffold, trivy-operator, docker-cli-buildx, gh, ratify, zot, sigstore-scaffolding, cosign, aactl, buildkitd, gitsign, slsa-verifier, tekton-chains,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: ko, teleport, spire-server, tkn, goreleaser, docker, vexctl, neuvector-sigstore-interface, kubescape, skaffold, trivy-operator, gh, ratify, zot, sigstore-scaffolding, cosign, aactl, buildkitd, gitsign, slsa-verifier, tekton-chains, rekor, flux-source-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: delve, tkn, nginx-prometheus-exporter, cerbos, aws-application-networking-k8s, helm-set-status, nuclei, cloud-provider-vsphere, ratify, bom, yunikorn-k8shim, rancher-system-upgrade-controller, ipfs-cluster, harbor-registry, opa, envconsul, trivy, kind, nri-apache, ko...

CVE-2026-72819: Improper Control of Generation of Code

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-72749

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

EUVD-2026-56139

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

CVE-2026-72749 n8n before 1.123.67 Prototype Pollution via Edit Fields

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

JLSEC-2026-1235

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations...

Uncontrolled Resource Consumption

github.com/pterodactyl/wings is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded JSON, YAML, and XML configuration file parsers in parser.go processing oversized non-file parser configuration data, which allows an attacker to exhaust the Wings process memory...

CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

CVE-2026-58216 Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...