CVE-2026-45287 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it...

Cross site scripting

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting XSS bug. We recommend upgrading to version 0.0.20 of the extension...

PT-2019-17703 · Gitlab · Gitlabhook

Name of the Vulnerable Software and Affected Versions: gitlabhook versions 0.0.17 and earlier gitlabhook all versions Description: The issue concerns a Command Injection vulnerability. It allows arbitrary commands to be injected through the repository name. The package does not validate input in...