Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...

GHSA-GCFJ-64VW-6MP9

creationtimestamp| type| source ---|---|--- 2026-07-21 12:01:32+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mr5r6e6l6b2h 2026-08-12 12:01:29+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msv3gj2nts2t...

RUSTSEC-2026-0213 XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs. Applications that do not...

CVE-2026-63896

A flaw was found in the Linux kernel's USB gadget composite driver. A remote attacker, acting as a malicious USB host, could send a specially crafted GETURL request. This request, with a small wLength value, triggers an integer underflow when calculating the buffer length for a memory copy...

CVE-2026-3182

creationtimestamp| type| source ---|---|--- 2026-07-21 10:20:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5lkaulgz2q...

CVE-2026-3183

creationtimestamp| type| source ---|---|--- 2026-07-21 10:04:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5knjvbvc24...

CVE-2026-63771

creationtimestamp| type| source ---|---|--- 2026-07-21 09:10:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr5hm4swxy2o...

CVE-2026-9341

creationtimestamp| type| source ---|---|--- 2026-07-21 08:49:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5ggei2pt2r...

CVE-2026-15691

creationtimestamp| type| source ---|---|--- 2026-07-21 08:48:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5geceirq2p...

GHSA-9HW9-CH79-4VH6

creationtimestamp| type| source ---|---|--- 2026-07-21 06:31:17+00:00| seen| https://gist.github.com/alon710/c194376028b5fea9d1333b8a7894f724...

CVE-2023-37508

creationtimestamp| type| source ---|---|--- 2026-07-21 06:17:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr55wd6qbu27...

CVE-2026-15156

creationtimestamp| type| source ---|---|--- 2026-07-21 05:53:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr54n2liks2q...

CVE-2026-15927 Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

CVE-2026-57852

creationtimestamp| type| source ---|---|--- 2026-07-21 03:50:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4vqc72kz2e...

CVE-2026-63728

creationtimestamp| type| source ---|---|--- 2026-07-21 02:48:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4scbfod72b...

CVE-2026-16327

creationtimestamp| type| source ---|---|--- 2026-07-21 02:43:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4rzcvi4x2x...

CVE-2026-48349

creationtimestamp| type| source ---|---|--- 2026-07-21 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr4kwieey42l...

GHSA-H95V-H523-3MW8

creationtimestamp| type| source ---|---|--- 2026-07-21 00:31:29+00:00| seen| https://gist.github.com/alon710/07f073f92ce20c0890f37523b73f7af8...

Oracle Linux 10 : python3.12 (ELSA-2026-39183)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39183 advisory. 3.12.13-2.0.1.el102.1 - Remove upstream URL reference 3.12.13-2.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 Tenable has extracted the preceding...

PT-2026-63275

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A blind Server-Side Request Forgery SSRF exists when the oauth2 client UPDATE AVATAR = true setting is enabled. The issue occurs because the server fetches the avatar URL provided by an...