Most recent entries from all

BELL-CVE-2026-46600

Affected: Alpaquita:23: containerd, Alpaquita:23: go, Alpaquita:25: calicoctl, Alpaquita:25: cilium-cli, Alpaquita:25: containerd, Alpaquita:25: cri-tools, Alpaquita:25: etcd, Alpaquita:25: go, Alpaquita:25: osv-scanner, Alpaquita:stream: buildah and 15 more

BIT-golang-2026-46600 — Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Affected: Bitnami: golang

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

certfr-2026-avi-1125 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-1125

Withdrawn: CLEANSTART-2026-AB16903 — Security fixes in fluent-operator-fips 3.10.0-r2

Withdrawn by the publisher.

Affected: CleanStart: fluent-operator-fips

Package fluent-operator-fips version 3.10.0-r2 fixes 10 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

EUVD-2026-352477

fkie_cve-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

GHSA-gg3m-vvp2-p2c5

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

msrc_CVE-2026-46600 — Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

msrc_CVE-2026-46600

OESA-2026-3879 — git-lfs security update

Affected: openEuler:24.03-LTS-SP1: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

openSUSE-SU-2026:11392-1 — kubevirt1.8-container-disk-1.8.4-3.1 on GA media

kubevirt1.8-container-disk-1.8.4-3.1 on GA media

RHSA-2026:54773 — Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.2 release

golang: Go os.Root: Symlink following vulnerability allows directory traversal github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

UBUNTU-CVE-2026-46600

Affected: Ubuntu:22.04:LTS: golang-1.23, Ubuntu:24.04:LTS: golang-1.23, Ubuntu:26.04:LTS: golang-1.23

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

WID-SEC-W-2026-2850 — Golang Go: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service zu verursachen, ein Cross Site Scripting durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren.