GO-2026-5005 vulnerabilities

Vulnerabilities for packages: cilium-cli, rancher-agent, minio, kine, fscrypt, kubernetes, kubernetes-dashboard, kyverno, kaf, docker-cli-buildx, podman, external-dns, kots, nerdctl, gitlab-kas, cloud-provider-aws, helm, mattermost, spire-server, istio, cert-manager, zot, falco-no-driver,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: manifest-tool, yunikorn-k8shim, terraform-docs, cilium-cli, grpcurl, vault-secrets-webhook, aws-signer-notation-plugin, kubernetes-dashboard, gatus, gitness, tfsec, openbao-k8s, hey, minio-object-browser, gptscript, hubble, aws-eks-pod-identity-agent,...

CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CLEANSTART-2026-KT57055 Security fixes in knative-serving 1.20.3-r0

Package knative-serving version 1.20.3-r0 fixes 2 vulnerabilities: ghsa-259r-337f-4rfw, CVE-2026-41178...

CLEANSTART-2026-HP96456 Security fixes in kserve-modelmesh-serving 0.9.0-r1

Package kserve-modelmesh-serving version 0.9.0-r1 fixes 4 vulnerabilities: CVE-2022-1996, ghsa-r48q-9g5r-8q2h, CVE-2023-48713, ghsa-qmvj-4qr9-v547...

PT-2026-71798

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-13717

CVE-2026-13717 describes a misconfiguration in the Red Hat OpenShift AI (RHOAI) MaaS Gateway used in a model-serving context. The flaw permits a standard user with low privileges to intercept, read, log, and alter MaaS model traffic, including sensitive data such as access keys, input prompts, an...

CVE-2026-13717

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the construction of HTTP request URLs due to unescaped variable path components. An attacker can manipulate the URL to access unintended API endpoints or resources by supplying specially crafted repository or...

SUSE CVE-2026-5755

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.2, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service serve...

CLEANSTART-2026-NM43340 Security fixes in knative-serving 1.22.1-r0

Package knative-serving version 1.22.1-r0 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-ZQ57784 Security fixes in knative-serving 1.21.3-r0

Package knative-serving version 1.21.3-r0 fixes 5 vulnerabilities: CVE-2026-33186, CVE-2026-24051, CVE-2026-29181, CVE-2026-39882, CVE-2026-39883...

CLEANSTART-2026-EP65920 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the knative-serving package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-BF01272 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the knative-serving package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

PT-2026-63324

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CLEANSTART-2026-EH11286 Security fixes for CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw applied in versions: 0.12.0-r1, 0.12.0-r2

Multiple security vulnerabilities affect the kserve-modelmesh-serving package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JV36933 Security fixes for CVE-2026-46600, CVE-2026-56852 applied in versions: 1.22.1-r0

Multiple security vulnerabilities affect the knative-serving package. These issues are resolved in later releases. See references for individual vulnerability details...

Cross-site Scripting (XSS)

EasyAdmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient restrictions on uploaded file types and serving uploaded files inline from the public web root, which allows an attacker to upload malicious HTML or SVG files that execute JavaScript in an administrator'...

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via a crafted download request. An attacker can access arbitrary files accessible to the operating system account running the server by exploiting insufficient validation of user-supplied paths. Note: This is only...