PT-2026-72054

Name of the Vulnerable Software and Affected Versions golang.org/x/image/vp8l affected versions not specified Description VP8L decoding in the golang.org/x/image/vp8l package can allocate an excessive amount of memory when processing a specially crafted VP8L image that contains numerous unused...

CVE-2026-72817: Insufficient Verification of Data Authenticity

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72815: Authentication Bypass by Spoofing

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-46603: Memory Allocation with Excessive Size Value

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion...

CVE-2026-46603: Memory Allocation with Excessive Size Value

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion...

PT-2026-76039

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion...

UBUNTU-CVE-2026-73260

Built-in TLS X.509 DER parsing bounds check...

CVE-2026-73260

Built-in TLS X.509 DER parsing bounds check...

PT-2026-72124

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7.5 Description When using mbedTLS, remote authenticated users can be misidentified because the system ignores the configured X.509 username identity lookup field. X.509 is a standard for public key...

MiracleLinux 9 : libreswan-4.15-10.el9_8 (AXSA:2026-1536:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1536:02 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Servi...

Linux Distros Unpatched Vulnerability : CVE-2026-72817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr...

Linux Distros Unpatched Vulnerability : CVE-2026-72815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-56865

A vulnerability in x/mod/sumdb/tlog allows a malicious GOPROXY to forge up to two sumdb tiles. This enables an attacker to bypass GOSUMDB checks and persist attacker-controlled module content to a local Go module cache. This attack allows for the distribution of malicious module content that cann...

CVE-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-56864

The golang package is affected by a vulnerability where a malicious GOSUMDB could serve arbitrary module content not contained within the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client that cannot be detected by evaluating the tran...