GO-2025-3368 vulnerabilities

Vulnerabilities for packages: apko, flux-source-controller, argo-workflows, kaniko, timoni, syft, argo-events, pulumi-language-dotnet, snyk-cli, trivy, skaffold, nuclei, kubescape, bom, go-licenses, kargo, src-fingerprint, goreleaser, crossplane, k8sgpt, wolfictl, gitea, pulumi, tfsec, k9s,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: apko, flux-source-controller, argo-workflows, trivy-operator, kaniko, syft, rancher-fleet, argo-events, pulumi-language-dotnet, snyk-cli, trufflehog, kyverno, argo-cd, external-secrets-operator, skaffold, trivy, witness, nuclei, kubescape, bom, cerbos, kargo,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: pgpool2exporter, hcloud, haproxy-ingress, cis-operator, tekton-chains, cloud-provider-aws, docker-credential-acr-env, kserve, podinfo, kapp-controller, crossplane-provider-aws-kms, argo-rollouts, aws-node-termination-handler, ksops, kubernetes-csi-livenessprobe,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: tekton-chains, hcloud, apko, cloud-provider-aws, crossplane-provider-aws-kms, ksops, syft, docker, external-secrets-operator, witness, nuclei, kubescape, slsa-verifier, mods, k8sgpt, docker-machine-driver-linode, gitea, k9s, kine, melange, prometheus-operator, src,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: pgpool2exporter, yunikorn-k8shim, k8sgateway, cloud-provider-vsphere, cloud-provider-aws, kubernetes-csi-driver-nfs, gobuster, mongodb-kubernetes-operator, podinfo, kapp-controller, kubernetes-csi-livenessprobe, kubernetes-dashboard-metrics-scraper, ksops, sonobuoy,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: tekton-chains, yunikorn-k8shim, cis-operator, cluster-api-provider-vsphere, k8sgateway, cloud-provider-vsphere, kubernetes-csi-driver-nfs, gobuster, kapp-controller, headlamp, oauth2-proxy, witness, nuclei, cerbos, k8sgpt, docker-credential-gcr, envconsul,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: tekton-chains, cosign, flux-source-controller, bank-vaults, crossplane-provider-azure, falcoctl, ksops, flux-notification-controller, argo-events, glab, actions-runner-controller, grafana-mimir, snyk-cli, policy-controller, k3s, rekor, aactl,...

CVE-2026-72832: Improper Neutralization of Input During Web Page Generation

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-73845: Improper Input Validation

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...

CVE-2026-73846: Insufficient Verification of Data Authenticity

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-19751: Server-Side Request Forgery (SSRF)

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-73647: Improperly Controlled Modification of Object Prototype Attributes

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-73649: Improper Control of Generation of Code

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...

CVE-2026-73505: Improper Control of Generation of Code

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name...

CVE-2026-73506: Improper Neutralization of Escape, Meta, or Control Sequences

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

CVE-2026-73408: Improper Neutralization of Special Elements used in an SQL Command

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73305: Improper Privilege Management

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...

CVE-2026-73565: Missing Release of Memory after Effective Lifetime

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-50544: Creation of Temporary File in Directory with Insecure Permissions

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under...

CVE-2026-73566: Uncontrolled Resource Consumption

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname and no segment cap when tar.t... or tar.x... receives a non-empty member-selection list. A...