CGA-376Q-5XRM-229R

Bulletin has no description...

CGA-C3GG-6898-3Q3P

Bulletin has no description...

CGA-HWG8-FG6G-J9CF

Bulletin has no description...

CGA-W6CP-93WJ-63WC

Bulletin has no description...

CGA-CJXQ-2M8X-QR49

Bulletin has no description...

CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CGA-VM6R-X4Q6-44FR

Bulletin has no description...

CGA-G54H-H6W2-FHH7

Bulletin has no description...

CGA-CF5F-737X-76HV

Bulletin has no description...

CGA-G9M3-GV2M-CWF5

Bulletin has no description...

CGA-FMC2-247R-G359

Bulletin has no description...

CGA-4J5R-M4FG-HWMP

Bulletin has no description...

CLEANSTART-2026-NA25366 Security fix for ghsa-xmrv-pmrh-hhx2 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DU50032 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-US79386 Security fix for ghsa-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QC55250 Security fix for ghsa-w8rr-5gcm-pp58 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EI91095 Security fix for ghsa-78h2-9frx-2jm8 applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WW85548 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the loki package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-NH53620 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the loki package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-PN24745 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the loki package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CLEANSTART-2026-WU91498 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the loki package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-ZA34964 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-OJ26404 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the loki package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-UP76614 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the loki package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-UN89941 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the loki package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-HX71601 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the loki package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-SR68419 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

Security vulnerability affects the loki package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...

CLEANSTART-2026-TA77263 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

Security vulnerability affects the loki package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...

CLEANSTART-2026-ZW28198 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Security vulnerability affects the loki package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation...

CLEANSTART-2026-HB43303 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-WS35873 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

Security vulnerability affects the loki package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...

CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

CLEANSTART-2026-PY35354 Security fix for ghsa-wf45-q9ch-q8gh applied in: loki 3.7.1-r1

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MH81237 For certain crafted inputs, a 'ed25519

Security vulnerability affects the loki package. For certain crafted inputs, a 'ed25519...

CLEANSTART-2026-HE86842 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-EE25517 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-WV65132 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the loki package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-VC55522 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-BI76349 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the loki package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-MN47589 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-PR31494 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the loki package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-CG56781 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

Security vulnerability affects the loki package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded...

CLEANSTART-2026-KU01035 (*x509

Security vulnerability affects the loki package. x509...

CLEANSTART-2026-DS50998 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-CQ72737 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the loki package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...