GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rook, grafana-agent-operator, zot, flux-image-reflector-controller, druid, secrets-store-csi-driver-provider-azure, flux, trino, sops, airflow, falcoctl, kubescape, k8sgpt, rekor, flux-kustomize-controller, py3-cassandra-medusa, prometheus-operator, rclone, thanos,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: podinfo, rancher-webhook, flux-image-reflector-controller, steampipe, frp, cert-manager, kserve, aws-flb-kinesis, kuma, trino, prometheus-adapter, docker-cli-buildx, aws-nuke, percona-server-mongodb-operator, victoriametrics-cluster, gomplate, cert-exporter,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: aactl, dex, sops, kubescape, gitsign, rekor, flux-kustomize-controller, cosign, flux-source-controller, tkn, cloudflared, argo-workflows, terragrunt, fulcio, spire-server, kots, oauth2-proxy, tekton-chains, slsa-verifier, vexctl...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: zot, aactl, ko, dagger, kubescape, wolfictl, melange, conftest, cilium-cli, up, buf, tkn, ctop, crossplane, trivy, cadvisor, buildkitd, syft, docker-compose, spire-server, kargo, grype, kaniko...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: aactl, ko, falcoctl, kubescape, gitsign, policy-controller, goreleaser, zarf, tkn, kyverno, crossplane, ratify, kyverno-notation-aws, spire-server, neuvector-sigstore-interface, tflint, teleport, trivy-operator, tekton-chains, slsa-verifier...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: aactl, skaffold, apko, cosign, policy-controller, flux-source-controller, ko, tekton-chains, slsa-verifier, kubescape, tkn, melange, spire-server...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: steampipe, gptscript, cert-manager, ko, kine, gitea, buildah, scorecard, docker-cli-buildx, gomplate, podman, snyk-cli, crossplane-provider-aws-ec2, cosign, crossplane-provider-azure-storage, cilium, crossplane-provider-aws-cloudformation, crossplane-provider-aws-eks...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: tailscale, cert-manager, mongodb-kubernetes-operator, aws-flb-kinesis, newrelic-infrastructure-agent, cert-exporter, sftpgo, kubernetes-csi-node-driver-registrar, nats-server, grafana-rollout-operator, crossplane-provider-azure-storage, maru, gobuster, cilium, promxy...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: zot, aactl, gh, ko, falcoctl, kubescape, gitsign, docker-cli-buildx, policy-controller, cosign, goreleaser, flux-source-controller, witness, zarf, tkn, ratify, kyverno-notation-aws, spire-server, neuvector-sigstore-interface, tflint, skaffold, teleport, tekton-chains...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, podinfo, postgres-operator, steampipe, frp, gptscript, crossplane-provider-sql, aws-flb-kinesis, kubernetes-dns-node-cache, kuma, kine, mongodb-kubernetes-operator, scorecard, tfsec, percona-server-mongodb-operator, custom-pod-autoscaler,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: zot, aactl, gh, ko, falcoctl, kubescape, gitsign, docker-cli-buildx, policy-controller, cosign, goreleaser, flux-source-controller, witness, zarf, tkn, kyverno, docker, crossplane, trivy, buildkitd, ratify, kyverno-notation-aws, neuvector-sigstore-interface,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: zot, aactl, gh, ko, falcoctl, kubescape, gitsign, rekor, policy-controller, cosign, goreleaser, flux-source-controller, witness, zarf, tkn, docker, trivy, buildkitd, ratify, kyverno-notation-aws, neuvector-sigstore-interface, spire-server, tflint, skaffold, teleport,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: steampipe, gptscript, ko, nri-memcached, fzf, kubernetes-csi-external-health-monitor, docker-cli-buildx, docker-cli, grafana-rollout-operator, ip-masq-agent, controller-gen, emissary, kube-logging-operator, spark-operator, gobuster, terraform-mcp-server, wal-g,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rook, zot, actions-runner-controller, aactl, flux-image-reflector-controller, rabbitmq-messaging-topology-operator, crossplane-provider-azure-sql, flux-notification-controller, flux, gh, sops, terraform, falcoctl, kubescape, crossplane-provider-family-azure, gitsign,...

CLSA-2026-1786693842 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by uncontrolled resource consumption and denial of service CVE-2026-50645, CVE-2026-9322, CVE-2026-9171. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1,...

CVE-2026-73070

A flaw was found in Vim. The socket server backend accepts an unbounded number of client connections, causing file descriptors to overflow internal data structures. A local process able to connect to the server socket can exploit this to corrupt stack memory or terminate the Vim server. This can...

Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...