CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: ldap2pg, gitaly-fips, falcosidekick-fips, pgtimetable, jitsucom-bulker, certificate-transparency, gitlab-cng, teleport, rke2-cloud-provider-fips, openbao-fips, wal-g, kuma, kine, spire-server-fips, grafana-fips, sftpgo-plugin-eventsearch, spicedb, argo-workflows-fips...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: trufflehog, dex, cert-manager, yunikorn-k8shim, terraform, cert-manager-istio-csr, seaweedfs, gitea, percona-server-mongodb-operator, rancher, kyverno-notation-aws, grafana, rancher-agent, minio, spqr, telegraf, zot, ratify, xeol, rclone, sftpgo-plugin-auth,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: trufflehog, dex, cert-manager, yunikorn-k8shim, terraform, cert-manager-istio-csr, seaweedfs, gitea, percona-server-mongodb-operator, rancher, kyverno-notation-aws, grafana, rancher-agent, minio, spqr, telegraf, zot, ratify, xeol, rclone, sftpgo-plugin-auth,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: ldap2pg, gitaly-fips, falcosidekick-fips, pgtimetable, jitsucom-bulker, certificate-transparency, gitlab-cng, teleport, rke2-cloud-provider-fips, openbao-fips, wal-g, kuma, kine, spire-server-fips, grafana-fips, sftpgo-plugin-eventsearch, spicedb, argo-workflows-fips...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, spire-server, newrelic-k8s-metadata-injection, dbmate, goreleaser, oras, polaris, dgraph, temporal, stakater-reloader, envoy-ratelimit, flux-image-automation-controller, malcontent, tailscale, kubewatch, nova, grafana-rollout-operator,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: spire-server, verticadb-operator, dbmate, temporal-ui-server, secrets-store-csi-driver-provider-azure, step-kms-plugin, cert-manager, modelmesh-runtime-adapter, polaris, cosign, policy-controller, helm-mapkubeapis, envoy-ratelimit, rancher, aws-flb-cloudwatch,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: cloudflared-fips, kubescape-operator-fips, cerbos-fips, jitsucom-bulker, rancher-agent, elastic-agent, velero-plugin-for-gcp-fips, tfsec, apko-fips, argo-cd-fips, chainloop-cli-fips, traefik-fips, packer-fips, buildah-fips, google-guest-agent, podman-fips,...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

SUSE CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

SUSE CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

GO-2026-4697 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo...

GO-2026-4699 SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo

SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo...

CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915

SFTPGo (open source file transfer app) before v2.7.1 is affected by an input validation issue in dynamic group paths, where placeholders like %username% are not strictly sanitized against relative path components. This can allow a crafted username to cause the substituted path for a group’s home ...

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

CVE-2026-30914 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths...