CVE-2026-72837

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

EUVD-2026-58631

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: kubernetes-fips, rancher-webhook-fips, kube-oidc-proxy, metrics-server-fips, k3s, kubernetes, prometheus-adapter, up, buildkitd, rancher-webhook, caddy, kubevela...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: policy-controller-fips, weaviate, ollama, temporal-ui-server-fips, mc, docker-compose, falcosidekick, helm-operator-fips, kubernetes-csi-driver-hostpath, secrets-store-csi-driver-provider-azure, atlantis, prometheus-adapter-fips, cluster-proportional-autoscaler,...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, knative-serving, grafana-rollout-operator-fips, cert-manager-fips, grafana-rollout-operator, gotenberg, bento-fips, weaviate, containerd-fips, docker-compose, terragrunt-fips, external-secrets-operator, opentelemetry-operator-fips,...

GO-2026-4289 vulnerabilities

Vulnerabilities for packages: cloudflared...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: tflint, kargo, k8sgpt-operator, opa, smarter-device-manager, opentelemetry-collector, grafana-mimir, step-ca, hubble-ui, kots, cloudnative-pg, ferretdb, conftest, kube-rbac-proxy, terragrunt, rqlite, dex, dbmate, guac, k3s, pulumi-language-dotnet, minio, trivy, zarf,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: jaeger, trillian, prometheus-pushgateway, mc, tempo, telegraf, minio, datadog-agent, aws-otel-collector, istio, mcp-grafana, karma, cloud-sql-proxy, minio-operator, minio-object-browser, splunk-otel-collector, keda, certificate-transparency, loki, grafana-pyroscope...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: authservice, atlantis, gitea, fluent-bit-plugin-loki, kots, oauth2-proxy, splunk-otel-collector, falcosidekick...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: sqlx, oranda, linkerd-extension-init, zola, parseable, shadowsocks-rust, deno, wasm-pack, tealdeer, lychee, linkerd2-proxy, xh, samply, uv, wasmtime, buck2, ntpd-rs, atuin, wash, zizmor, pixi, nushell, zed, cargo-audit, rye, wadm, wasmcloud, kdash, rustls-ffi, qdrant...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, jaeger, trillian, prometheus-pushgateway, grafana, mc, metrics-server, tempo, minio, datadog-agent, aws-otel-collector, istio, prometheus-operator, karma, k8sgpt, cloud-sql-proxy, minio-operator, fluent-bit-plugin-loki,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: argo-workflows, tekton-chains, kots, vexctl, terragrunt, cosign, dex, slsa-verifier, tkn, kubescape, spire-server, rekor, flux-source-controller, flux-kustomize-controller, gitsign, oauth2-proxy, aactl, fulcio, cloudflared, sops...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kapp-controller, azcopy, thanos-operator, crossplane-provider-aws-elasticache, paranoia, mods, kine, crossplane-provider-aws-sns, tofu-controller, sftpgo-plugin-pubsub, hubble-ui, sealed-secrets, kustomize, amass, gke-gcloud-auth-plugin, goreleaser,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kapp-controller, thanos-operator, libnvidia-container, src, terraform, kor, nri-redis, dex, cluster-api-provider-vsphere, headlamp, portieris, k3s, kpt, nri-mysql, render-template, nodetaint, hubble, prometheus-operator, ratify, k8sgpt, polaris, harbor-registry,...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

RLSA-2026:54485 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...

MiracleLinux 8 : freerdp-2.11.7-11.el8_10 (AXSA:2026-1534:25)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1534:25 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async...

AlmaLinux 9 : freerdp (ALSA-2026:54487)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async messag...

PT-2026-72006

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...