Most recent entries from all

bdu:2026-04597

certfr-2026-avi-0268 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer un déni de s…

certfr-2026-avi-0268

Withdrawn: CLEANSTART-2026-AC04649 — Security fixes in argo-workflows-fips 3.7.10-r1

Withdrawn by the publisher.

Affected: CleanStart: argo-workflows-fips

Package argo-workflows-fips version 3.7.10-r1 fixes 3 vulnerabilities: ghsa-9h8m-3fm2-qjrq, CVE-2026-24051, CVE-2026-27141

EUVD-2026-273752

fkie_cve-2026-27141

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

GHSA-8fj7-8h3w-xwfm

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

msrc_CVE-2026-27141 — Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

msrc_CVE-2026-27141

OESA-2026-3879 — git-lfs security update

Affected: openEuler:24.03-LTS-SP1: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

openSUSE-SU-2026:10294-1 — telemetrygen-0.147.0-1.1 on GA media

telemetrygen-0.147.0-1.1 on GA media

RHSA-2026:26519 — Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2

golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/tektoncd/pipeline: Tekton Pipelines: Arbitrary code execution and secret exfiltration via malicious git commands

UBUNTU-CVE-2026-27141

Affected: Ubuntu:26.04:LTS: adsys

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

WID-SEC-W-2026-1618 — Splunk Splunk Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.