29941 matches found
CVE-2026-72837
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
AZL-96689 CVE-2026-72816 affecting package influxdb 2.7.5-21
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
AZL-96692 CVE-2026-72817 affecting package influxdb for versions less than 2.7.5-21
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
freerdp security update
An update is available for freerdp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...
RLSA-2026:54487 Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...
CVE-2026-72837
Summary: CVE-2026-72837 affects File Browser prior to 2.63.20, where createUserDir isolation in proxy and hook authentication auto-provisioning paths is not honored. This allows attackers with valid upstream-auth credentials to read, modify, delete, and share files belonging to other users due to...
CVE-2026-72837
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
EUVD-2026-58651
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
EUVD-2026-58631
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: k3s, prometheus-adapter, kubernetes, kubevela, up, rancher-webhook, caddy, rancher-webhook-fips, kube-oidc-proxy, kubernetes-fips, metrics-server-fips, buildkitd...
GO-2024-2611 vulnerabilities
Vulnerabilities for packages: hubble-ui-backend-fips, doppler-kubernetes-operator, kargo, certificate-transparency, caddy, sops, eksctl, rabbitmq-cluster-operator, helm-operator-fips, buf, tigera-operator, fuse-overlayfs-snapshotter, flux-image-automation-controller, falcoctl, docker, runc,...
GO-2026-4985 vulnerabilities
Vulnerabilities for packages: grafana-image-renderer, kubescape-operator, gitaly-fips, kubo, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, tempo, cloudprober, aactl, kiali, kubernetes-csi-node-driver-registrar, op-geth, fleet-server-fips, docker-cli-buildx, knative-eventing-fips, vault,...
GO-2026-4289 vulnerabilities
Vulnerabilities for packages: cloudflared...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: zarf, cloudnative-pg, pulumi-language-dotnet, k8sgpt, osv-scanner, grafana-agent-operator, kubernetes-csi-driver-hostpath, minio, temporal, k8sgpt-operator, kaniko, fulcio, conftest, k3d, opentelemetry-collector-contrib, vcluster, restic, spegel, spire-server,...
GO-2025-3540 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, atlantis, oauth2-proxy, gitea, authservice, falcosidekick, kots, fluent-bit-plugin-loki...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: jaeger, cloud-sql-proxy, keda, trillian, minio, istio, karma, tempo, loki, minio-operator, aws-otel-collector, minio-object-browser, grafana-pyroscope, mcp-grafana, certificate-transparency, datadog-agent, mc, splunk-otel-collector, telegraf, prometheus-pushgateway...