PT-2026-72600

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 memory management where the PAGE UNUSED softbit is not consistently cleared when new page table entries ptes are set. This bit is used to signal try to unmap...

CVE-2026-73630

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, kyverno, tigera-operator-fips, xeol, crossplane-fips, trivy-fips, tw, k8ssandra-client-fips, opentofu, ocm-cli-fips, kgateway, kgateway-fips, rancher-fleet, headlamp, helm-operator, kubescape, k9s, cilium-cli, chaos-mesh, ocm-kubernetes-controller-fips...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: helm-push, zot, zarf, helm-operator, kots, pluto, cilium-cli, chartmuseum, linkerd2, helm-mapkubeapis, rancher-fleet, flux, k8ssandra-client, eksctl, cerbos, chart-testing, cert-manager-cmctl, istio, flux-source-controller, headlamp, cluster-api-helm-controller, triv...

GO-2026-5338 vulnerabilities

Vulnerabilities for packages: tigera-operator, helm, fuse-overlayfs-snapshotter, falco-no-driver, zot, zarf, helm-operator, rancher-agent, kots, kubevela, newrelic-infrastructure-agent, kaniko, spegel, containerd, k3s, ctop, syft, kubescape-operator, tw, docker-compose, wolfictl, chartmuseum,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: helm, fuse-overlayfs-snapshotter, falco-no-driver, zot, zarf, helm-operator, kots, kubevela, newrelic-infrastructure-agent, kaniko, opa, cilium-cli, spegel, containerd, k3s, melange, ctop, syft, kubescape-operator, tw, docker-compose, wolfictl, trivy-operator,...

GO-2026-5475 vulnerabilities

Vulnerabilities for packages: tigera-operator, helm, fuse-overlayfs-snapshotter, falco-no-driver, zot, zarf, helm-operator, rancher-agent, kots, kubevela, newrelic-infrastructure-agent, kaniko, spegel, k3s, ctop, syft, kubescape-operator, tw, docker-compose, wolfictl, chartmuseum, linkerd2,...

GO-2026-5879 vulnerabilities

Vulnerabilities for packages: tigera-operator, helm, zarf, helm-operator, rancher-agent, kots, trivy-operator, argo-cd, cilium-cli, tw, falcoctl, oras, kyverno, chartmuseum, linkerd2, helm-mapkubeapis, gatekeeper, rancher-fleet, xeol, eksctl, kyverno-notation-aws, rancher-helm, cert-manager-cmctl...

GO-2026-5884 vulnerabilities

Vulnerabilities for packages: tigera-operator, helm, zarf, helm-operator, rancher-agent, kots, trivy-operator, argo-cd, cilium-cli, tw, falcoctl, oras, kyverno, chartmuseum, linkerd2, helm-mapkubeapis, gatekeeper, rancher-fleet, xeol, k8ssandra-client, eksctl, kyverno-notation-aws, rancher-helm,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-api, traefik, vale, aws-flb-cloudwatch, helm, fuse-overlayfs-snapshotter, flux-image-automation-controller, falco-no-driver, bento, helm-operator, ingress-nginx-controller, hubble, cilium-cli, k3s, newrelic-fluent-bit-output, croc, goreleaser, bo...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-api, nri-memcached, neuvector-sigstore-interface, ipfs-cluster, regclient, gcsfuse, clickhouse-operator, docker-machine-driver-harvester, ip-masq-agent, timescaledb-tune, dgraph, k3s, wal-g, gobuster, terraform-mcp-server, controller-gen, falcoct...

PT-2026-122445

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4pjg-x8qj-33j5. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess...

CVE-2026-73630: Observable Discrepancy

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

CVE-2026-73562

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

EUVD-2026-58176

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

CVE-2026-73562

CVE-2026-73562 describes a prototype-pollution vulnerability in Mongoose (MongoDB object modeling tool) via update casting that can occur when a user-controlled update uses a proto -prefixed dotted path under $set. Prior to versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2, schema logic can treat inher...

undici: undici: Cross-user cookie disclosure via Set-Cookie caching

A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

SUSE CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

EUVD-2026-57310

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...