2108185 matches found
CLEANSTART-2026-DU50032 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-US79386 Security fix for ghsa-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0
Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-ZA34964 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-WW85548 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
Security vulnerability affects the loki package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...
CLEANSTART-2026-WU91498 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh
Security vulnerability affects the loki package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...
CLEANSTART-2026-UN89941 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...
Security vulnerability affects the loki package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...
CLEANSTART-2026-TA77263 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
Security vulnerability affects the loki package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...
CLEANSTART-2026-SR68419 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh
Security vulnerability affects the loki package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...
CLEANSTART-2026-ZW28198 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation
Security vulnerability affects the loki package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation...
CLEANSTART-2026-MH81237 For certain crafted inputs, a 'ed25519
Security vulnerability affects the loki package. For certain crafted inputs, a 'ed25519...
CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames
Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...
CLEANSTART-2026-HB43303 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-WS35873 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")
Security vulnerability affects the loki package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...
CLEANSTART-2026-PY35354 Security fix for ghsa-wf45-q9ch-q8gh applied in: loki 3.7.1-r1
Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-HE86842 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-WV65132 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0
Security vulnerability affects the loki package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...
CLEANSTART-2026-VC55522 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-EE25517 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-MN47589 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
CLEANSTART-2026-BI76349 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
Security vulnerability affects the loki package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...
CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow
Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...
CLEANSTART-2026-PR31494 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute
Security vulnerability affects the loki package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...
CLEANSTART-2026-CQ72737 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash
Security vulnerability affects the loki package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...
CLEANSTART-2026-KU01035 (*x509
Security vulnerability affects the loki package. x509...
CLEANSTART-2026-DS50998 Prometheus is an open-source monitoring system and time series database
Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...
CLEANSTART-2026-NW24142 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-ES62774 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the loki package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-FK79056 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)
Security vulnerability affects the loki package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...
CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
CLEANSTART-2026-GQ93723 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
Security vulnerability affects the loki package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...
CLEANSTART-2026-FO79285 ReverseProxy can forward queries containing parameters not visible to Rewrite functions
Security vulnerability affects the loki package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...
CLEANSTART-2026-HE08866 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the loki package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CLEANSTART-2026-BY91929 Security fix for ghsa-hrxh-6v49-42gf applied in: loki 3.7.1-r2, secrets-store-csi-driver-provider-aws 3.1.4-r1
ghsa-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-QP25328 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation
Security vulnerability affects the loki package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...
CLEANSTART-2026-FW47694 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
Security vulnerability affects the loki package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
CLEANSTART-2026-PK17685 Prometheus is an open-source monitoring system and time series database
Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...
CLEANSTART-2026-VW95960 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-UV13195 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...
CLEANSTART-2026-YE69466 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-OE88191 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Security vulnerability affects the loki package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...
CLEANSTART-2026-HD45306 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-JK20975 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
ECHO-B10E-5B40-F5BB
Bulletin has no description...
GHSA-Q986-4X7X-GX39 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Summary The AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail...
GHSA-VJ8P-HP9X-GH47 mpp vulnerable to Gas Draining with low gas limit
Vulnerability When the server acts as the fee payer, mpp Elixir 0.4.0 ZenHive/mpp does not validate whether the gaslimit set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying. A transferWithMemo call on Tempo Moderato testnet requires 51,299...
GHSA-QPXH-FF8M-C62V mpp vulnerable to Gas Draining with access list
Details When the server acts as the feepayer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosignfeepayer, the server re-signs the raw basefields index 5 of the 0x76 AASigned envelope without inspecting the access list field...
GHSA-VV77-66RF-PM86 mpp vulnerable to Gas Draining with no limit
Details When the server acts as the feepayer, the mpp Elixir 0.4.0 does not validate gaslimit, maxfeepergas and maxpriorityfeepergas before cosigning the client's fee-payer transaction. A malicious client embeds arbitrarily large maxfeepergas and maxpriorityfeepergas values in the signed envelope...