GO-2026-5340 Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) in github.com/getarcaneapp/arcane/backend

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content incl. .env secrets in github.com/getarcaneapp/arcane/backend...

GO-2026-5370 SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode in github.com/siyuan-note/siyuan/kernel

SiYuan has broken access control in /api/search/searchAsset,searchTag,searchWidget,searchTemplate publish-mode in github.com/siyuan-note/siyuan/kernel...

GO-2026-5356 Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint in github.com/getarcaneapp/arcane/backend

Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint in github.com/getarcaneapp/arcane/backend...

GO-2026-5333 Portainer missing authorization on custom template file endpoint, which exposes template content in github.com/portainer/portainer

Portainer missing authorization on custom template file endpoint, which exposes template content in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-5216 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination in github.com/OliveTin/OliveTin

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination in github.com/OliveTin/OliveTin...

GO-2026-5207 Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet

Fleet: Helm impersonation bypass of RESTClientGetter retains cluster-admin during template rendering in github.com/rancher/fleet...

GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner

Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...

GO-2026-5081 Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea

Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea...

CVE-2026-48942 Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26

K2 ≤ 2.26 renders the k2users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping...

AZL-90947 CVE-2026-53267 affecting package kernel for versions less than 6.6.143.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

CVE-2026-53267

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

UBUNTU-CVE-2026-53267

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

CVE-2026-53267

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

CVE-2026-53267 netfilter: nft_ct: bail out on template ct in get eval

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

EUVD-2026-39218

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

CVE-2026-53267 netfilter: nft_ct: bail out on template ct in get eval

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

CVE-2026-53267

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

CVE-2026-53267

The CVE-2026-53267 entry concerns a Linux kernel netfilter nft_ct use-after-free style issue where a per-CPU template conntrack entry can be treated as a real ct, causing a 16-byte memcpy path to overflow the kernel stack when using NFT_REG32_15. The root cause is that a template ct is not reject...

CVE-2026-53267

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre type filter hook prerouting...

K000161888: Apache log4j vulnerability CVE-2026-34481

Security Advisory Description Apache Log4j's JsonTemplateLayout https:// logging. apache. org/log4j/2. x/manual/json-template-layout. html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values NaN, Infinity, or -Infinity,...