GO-2025-4192 vulnerabilities

Vulnerabilities for packages: gitsign, skaffold, kubescape, zot, kyverno-notation-aws, cosign, gh, witness, tflint, falcoctl, teleport, vexctl, zarf, spire-server, neuvector-sigstore-interface, flux-source-controller, aactl, docker-cli-buildx, sigstore-scaffolding, policy-controller, tkn,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: gitsign, trivy-operator, trivy, skaffold, kubescape, zot, docker, kyverno-notation-aws, cosign, crossplane, gh, ko, witness, tflint, falcoctl, teleport, vexctl, zarf, spire-server, neuvector-sigstore-interface, flux-source-controller, buildkitd, aactl, slsa-verifier,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: harbor-registry, dbmate, manifest-tool, s5cmd, tfsec, nri-f5, kubeflow, osv-scanner, k3s, headlamp, http-echo, x509-certificate-exporter, nri-haproxy, src, ingress-nginx-controller, kubelet-csr-approver, crossplane-provider-aws-ec2, wave, pgtimetable, steampipe,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: gitsign, trivy-operator, trivy, skaffold, kubescape, zot, docker, rekor, kyverno-notation-aws, cosign, gh, witness, tflint, falcoctl, teleport, vexctl, zarf, spire-server, neuvector-sigstore-interface, flux-source-controller, buildkitd, aactl, slsa-verifier,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: harbor-registry, k8sgpt, nri-f5, trivy, terraform-provider-azapi, k3s, headlamp, polaris, prometheus, nri-haproxy, nri-consul, src, render-template, rclone, steampipe, tflint, aws-privateca-issuer, docker-machine-driver-harvester, cni-plugins, undock, nri-memcached,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, gitsign, scorecard, kubescape, crossplane-provider-azure-sql, k3s, snyk-cli, crossplane-provider-azure, flux-helm-controller, flux-notification-controller, rekor, k3d, timestamp-authority, kubevela, zot, flux-image-automation-controller,...

CLSA-2026-1786693842 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4...

Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by uncontrolled resource consumption and denial of service CVE-2026-50645, CVE-2026-9322, CVE-2026-9171. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1,...

CVE-2026-73070

A flaw was found in Vim. The socket server backend accepts an unbounded number of client connections, causing file descriptors to overflow internal data structures. A local process able to connect to the server socket can exploit this to corrupt stack memory or terminate the Vim server. This can...

Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...

RLSA-2026:54509 Important: bind9.16 security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Host Servers

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17223, CVE-2026-17206, CVE-2026-17208, CVE-2026-16929, CVE-2026-17004, CVE-2026-18846, CVE-2026-17197, CVE-2026-17217, CVE-2026-17199, CVE-2026-17229, CVE-2026-16982 in host servers, and a buffer overflow CVE-2026-17220 in host,...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-19770

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770

The CVE-2026-19770 entry affects feedmob fm-mcp-servers 0.0.3, specifically the Download Endpoint’s Download Report function (src/smadex-reporting/src/index.ts). The vulnerability arises from manipulation of the downloadUrl argument, enabling server-side request forgery (SSRF). Exploitation is de...

CVE-2026-19770 feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

EUVD-2026-58563

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...