Advisory Catalog

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Authorization bypass via double-encoded paths in github.com/valyala/fasthttp

Cross-forge account takeover on login in codefloe.com/crowci/crow/v6

Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

uniget CLI has an EDITOR Command Injection

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API: Admin can reset passkeys for same-level or higher-privileged users

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Excessive memory allocation during VP8L decoding in golang.org/x/image

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

Enforce maximum recursion depth in encoding/asn1

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Fix Javascript regexp context tracking in html/template

Add recursion depth guard during decode in encoding/xml

Avoid quadratic complexity in resolvePath in net/url

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

go-git: Malicious reference names may modify files outside the reference storage

go-git: Worktree operations may follow symlinks

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

rclone: Local Encoding Path Traversal

rclone archive extract allows S3 destination prefix escape via crafted archive paths

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect