CVE-2026-42508 affecting package packer for versions less than 1.9.5-14

CVE-2026-42508 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-46597 affecting package packer for versions less than 1.9.5-14

CVE-2026-46597 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-25680 affecting package packer for versions less than 1.9.5-14

CVE-2026-25680 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-39821 affecting package packer for versions less than 1.9.5-14

CVE-2026-39821 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-39829 affecting package packer for versions less than 1.9.5-14

CVE-2026-39829 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-25681 affecting package packer for versions less than 1.9.5-14

CVE-2026-25681 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-39834 affecting package packer for versions less than 1.9.5-14

CVE-2026-39834 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-39827 affecting package packer for versions less than 1.9.5-14

CVE-2026-39827 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-42506 affecting package packer for versions less than 1.9.5-14

CVE-2026-42506 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-39835 affecting package packer for versions less than 1.9.5-14

CVE-2026-39835 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

CVE-2026-39830 affecting package packer for versions less than 1.9.5-14

CVE-2026-39830 affecting package packer for versions less than 1.9.5-14. A patched version of the package is available...

AZL-88800 CVE-2026-45570 affecting package packer for versions less than 1.9.5-17

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containin...

AZL-88209 CVE-2026-42502 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88170 CVE-2026-27136 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88173 CVE-2026-39821 affecting package packer for versions less than 1.9.5-15

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-88191 CVE-2026-42506 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88200 CVE-2026-25680 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-88194 CVE-2026-25681 affecting package packer for versions less than 1.9.5-15

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88182 CVE-2026-46597 affecting package packer for versions less than 1.9.5-15

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-88203 CVE-2026-46598 affecting package packer for versions less than 1.9.5-15

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used...