GO-2025-3988 vulnerabilities

Vulnerabilities for packages: gitea, sftpgo...

GO-2024-2476 vulnerabilities

Vulnerabilities for packages: dex...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: karpenter, ingress-nginx-controller, minio, prometheus-operator, opentelemetry-collector, vale, prometheus, kots, step, caddy, k3s, hubble, kubernetes-dashboard, terraform-provider-acme, kubernetes, traefik, snyk-cli, nerdctl, step-issuer,...

GO-2024-2456 vulnerabilities

Vulnerabilities for packages: goreleaser, bom, go-licenses, src-fingerprint, gitsign, gitness, pulumi-kubernetes-operator, scorecard, nuclei...

GO-2026-5668 vulnerabilities

Vulnerabilities for packages: portieris, opentelemetry-operator, kots, rancher-agent, nuclei, trivy-operator, docker-credential-gcr, envoy-gateway, buildah, kpt, nerdctl, podman, undock, amazon-cloudwatch-agent-operator, zot, grafana, trivy, ko, cri-tools, spire-server, aws-otel-collector, skopeo...

GO-2026-5336 vulnerabilities

Vulnerabilities for packages: zarf, cerbos, terragrunt, flux-image-automation-controller, steampipe, gitsign, kubevela, kots, melange, apko, rancher-fleet, guac, pulumi-language-java, scorecard, nuclei, trivy-operator, gitlab-runner, dagger, grype, snyk-cli, act, witness, grafana-alloy,...

OPENSUSE-SU-2026:21580-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

SUSE-SU-2026:23223-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

SUSE-SU-2026:23235-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

SUSE-SU-2026:23157-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

PT-2026-71978

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2026-73421

NextAuth.js vulnerability CVE-2026-73421 affects next-auth v5: when server configuration has an error (e.g., missing issuer/authorization, unset AUTH_SECRET), the auth() wrapper can return a truthy error object in middleware, Route Handlers, React Server Components, etc. As a result, existence-ba...

CVE-2026-73421

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73426 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.3-rails, ruby3.4-rails, ruby3.2-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.4-rails, ruby3.3-rails, pghero, gitlab-rails-ce, ruby3.2-rails, gitlab-rails-ce-fips, pghero-fips...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

EUVD-2026-58246

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...