GO-2026-5876 Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher

Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2025-3982 Rancher sends sensitive information to external services through the `/meta/proxy` endpoint in github.com/rancher/rancher

Rancher sends sensitive information to external services through the /meta/proxy endpoint in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GHSA-R8F4-HV23-6QP6 Norman API Cross-site Scripting Vulnerability

Impact A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely. The attack vector was identified as a...