GO-2026-5662 vulnerabilities

Vulnerabilities for packages: istio, loki, keda, datadog-agent, tempo, grafana-pyroscope, prometheus-pushgateway, jaeger, aws-otel-collector, cloud-sql-proxy, mcp-grafana, minio-operator, telegraf, minio-object-browser, mc, karma, certificate-transparency, trillian, splunk-otel-collector, minio...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: gitea, fluent-bit-plugin-loki, authservice, falcosidekick, kots, oauth2-proxy, splunk-otel-collector, atlantis...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: qdrant, nushell, shadowsocks-rust, sqlx, wasmcloud, linkerd2-proxy, wasmtime, sdp-k8s-injector, linkerd-extension-init, oranda, uv, buck2, parseable, wash, cargo-audit, pixi, deno, zed, sccache, xh, wasm-pack, zizmor, rye, lychee, atuin, wadm, rustup, zola, samply,...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: metrics-server, istio, loki, k8sgpt, keda, datadog-agent, fluent-bit-plugin-loki, node-problem-detector, tempo, grafana, prometheus-pushgateway, jaeger, aws-otel-collector, cloud-sql-proxy, opentelemetry-collector, prometheus, amazon-cloudwatch-agent-operator,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: kubescape, sops, oauth2-proxy, rekor, tkn, gitsign, flux-source-controller, tekton-chains, dex, cosign, fulcio, terragrunt, flux-kustomize-controller, slsa-verifier, kots, vexctl, argo-workflows, aactl, spire-server, cloudflared...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: flannel, hey, kubernetes-replicator, timoni, whereabouts, kuberlr, paranoia, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe, nri-f5, stakater-reloader, cloud-provider-aws, conjur-cli, secrets-store-csi-driver-provider-aws,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: opa, witness, cloud-provider-gcp-cloud-controller-manager, kuberlr, ipfs-cluster, nri-f5, kpt, cerbos, grafana-rollout-operator, argo-events, ko, tekton-chains, kor, kubernetes-csi-driver-hostpath, kubernetes-csi-external-health-monitor, nri-apache, harbor-registry,...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

RLSA-2026:54485 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...

PT-2026-72006

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

Linux Distros Unpatched Vulnerability : CVE-2026-67990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An...

RockyLinux 9 : freerdp (RLSA-2026:54487)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async messa...

AlmaLinux 9 : freerdp (ALSA-2026:54487)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async messag...

RockyLinux 8 : freerdp (RLSA-2026:54485)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54485 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async messa...

MiracleLinux 8 : freerdp-2.11.7-11.el8_10 (AXSA:2026-1534:25)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1534:25 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async...

UBUNTU-CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...