EUVD-2026-58651

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...

CVE-2026-72837

Summary: CVE-2026-72837 affects File Browser prior to 2.63.20, where createUserDir isolation in proxy and hook authentication auto-provisioning paths is not honored. This allows attackers with valid upstream-auth credentials to read, modify, delete, and share files belonging to other users due to...

EUVD-2026-58631

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: buildkitd, prometheus-adapter, kube-oidc-proxy, kubernetes-fips, metrics-server-fips, caddy, kubernetes, kubevela, rancher-webhook-fips, up, rancher-webhook, k3s...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: sonobuoy, hubble-fips, kyverno-policy-reporter-ui, metrics-server-fips, prometheus-node-exporter, argo-workflows-fips, kube-rbac-proxy-fips, helm-operator-fips, crossplane-provider-azure-authorization, dynamic-localpv-provisioner-fips, golangci-lint, dagger,...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: bento, splunk-otel-collector, kiali-fips, vault-fips, dgraph, envoy-gateway-fips, kubescape-operator, hydra-fips, grafana, cert-manager-fips, grafana-rollout-operator, amazon-cloudwatch-agent-fips, docker-fips, keda-fips, gitlab-cng, argo-workflows-fips, caddy,...

GO-2026-4289 vulnerabilities

Vulnerabilities for packages: cloudflared...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: ferretdb, cilium-cli, kaniko, step, terraform-docs, rqlite, kargo, tempo, opa, grafana-agent-operator, pulumi-language-dotnet, fulcio, sops, ksops, kubernetes-csi-external-provisioner, spicedb, terraform-provider-google, melange, restic, zot, spegel, trivy, dagger,...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: authservice, gitea, atlantis, kots, oauth2-proxy, splunk-otel-collector, falcosidekick, fluent-bit-plugin-loki...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: xh, zed, ntpd-rs, cargo-audit, oranda, buck2, zizmor, linkerd-extension-init, zola, rustls-ffi, uv, wadm, sqlx, samply, kdash, lychee, sccache, wasmtime, deno, pixi, rye, wash, qdrant, tealdeer, atuin, rustup, nushell, shadowsocks-rust, wasm-pack, linkerd2-proxy,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: tempo, mcp-grafana, minio-operator, prometheus-pushgateway, splunk-otel-collector, minio-object-browser, istio, cloud-sql-proxy, datadog-agent, loki, grafana-pyroscope, aws-otel-collector, keda, certificate-transparency, mc, trillian, minio, jaeger, karma, telegraf...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: tempo, minio-operator, prometheus-pushgateway, splunk-otel-collector, amazon-cloudwatch-agent-operator, istio, cloud-sql-proxy, datadog-agent, loki, opentelemetry-collector, aws-otel-collector, node-problem-detector, keda, k8sgpt, certificate-transparency, mc,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: cosign, tekton-chains, oauth2-proxy, kubescape, sops, fulcio, argo-workflows, rekor, flux-kustomize-controller, vexctl, flux-source-controller, aactl, cloudflared, kots, slsa-verifier, spire-server, dex, gitsign, terragrunt, tkn...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: ferretdb, cluster-api-gcp-controller, custom-pod-autoscaler, terraform-docs, cloud-provider-vsphere, falco-no-driver, grafana-rollout-operator, boring-registry, crossplane-provider-aws-cloudfront, ghaudit, temporal-ui-server, kubernetes-csi-external-attacher, ksops,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: tekton-chains, cloud-provider-vsphere, grafana-rollout-operator, fulcio, kubeflow-katib, controller-gen, zot, kpt, kubecolor, buildkitd, ko, thanos-operator, envconsul, neuvector-sigstore-interface, wait-for-port, kind, nginx-prometheus-exporter, nri-memcached,...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

PT-2026-71987

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...