Open Source Vulnerabilities

gdb, gdb, gdb, gdb, gdb, gdb, gdb

openssh, openssh, openssh, openssh, openssh, openssh-ssh1, openssh, openssh, openssh, openssh-ssh1, openssh, openssh, openssh, openssh-ssh1, openssh, openssh, openssh, openssh-ssh1, openssh, openssh, openssh-gssapi, openssh-ssh1, openssh, openssh-ssh1

ebook-speaker, ebook-speaker, ebook-speaker, ebook-speaker, ebook-speaker, ebook-speaker, ebook-speaker

libnxml, libnxml, libnxml, libnxml, libnxml, libnxml, libnxml

libvmdk, libvmdk, libvmdk, libvmdk, libvmdk, libvmdk, libvmdk

libvmdk, libvmdk, libvmdk, libvmdk, libvmdk, libvmdk, libvmdk

imagemagick, imagemagick, imagemagick, imagemagick, imagemagick, imagemagick, imagemagick, imagemagick

freedombox, freedombox, freedombox, freedombox

check-mk, check-mk

python-oauthlib, python-oauthlib, python-oauthlib, python-oauthlib, python-oauthlib, python-oauthlib, python-oauthlib

caddy, caddy, caddy

gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0

gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0

gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0, gst-plugins-good1.0

libreoffice, libreoffice, libreoffice, libreoffice, libreoffice

golang-github-dlclark-regexp2, golang-github-dlclark-regexp2, golang-github-dlclark-regexp2, golang-github-dlclark-regexp2, golang-github-dlclark-regexp2, golang-github-dlclark-regexp2

ntopng, ntopng, ntopng, ntopng, ntopng

nut, nut, nut, nut, nut, nut, nut, nut

fastnetmon, fastnetmon, fastnetmon, fastnetmon, fastnetmon

@angular/bazel, @angular/benchpress, @angular/language-service

TuxCare security update for @angular (4 CVEs)

github.com/mattermost/mattermost/server/public

Path traversal in API route construction in github.com/mattermost/mattermost/server/public

github.com/canonical/lxd

LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd

@angular/bazel, @angular/benchpress, @angular/language-service

TuxCare security update for @angular (4 CVEs)

libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption

@angular/language-service

TuxCare security update for @angular/language-service (4 CVEs)

fastnetmon, fastnetmon, fastnetmon

fastnetmon, fastnetmon, fastnetmon

fastnetmon, fastnetmon, fastnetmon

fastnetmon, fastnetmon, fastnetmon

fastnetmon, fastnetmon, fastnetmon

fastnetmon, fastnetmon, fastnetmon

nut, nut, nut

NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg

github.com/andybalholm/brotli

Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

github.com/google/go-eventlog

Event type spoofing via UntrustedType in github.com/google/go-eventlog

github.com/blakesmith/ar

Panic on negative member size in Reader.Read in github.com/blakesmith/ar

github.com/crewjam/saml

Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

github.com/mark3labs/mcp-go

SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go

github.com/chainguard-dev/kaniko

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko

github.com/tinfoil-factory/netfoil

Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoil

github.com/basekick-labs/arc

Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arc

github.com/mtzanidakis/praktor

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) in github.com/mtzanidakis/praktor

kubevirt.io/kubevirt

KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption in kubevirt.io/kubevirt

github.com/basekick-labs/arc

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc

kubevirt.io/kubevirt

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite in kubevirt.io/kubevirt

github.com/cert-manager/cert-manager

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials in github.com/cert-manager/cert-manager

github.com/anacrolix/torrent

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in github.com/anacrolix/torrent

github.com/gofiber/fiber/v2

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber

github.com/daptin/daptin

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware in github.com/daptin/daptin

github.com/charmbracelet/soft-serve

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve