CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

CVE-2026-53935

### Impact Users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMat

历史摘要 · 未重新核验 · GitHub Advisory

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

CVE-2026-53624

### Summary The `helmet` middleware in gofiber/fiber never sets the `Strict-Transport-Security` (HSTS) response header,

历史摘要 · 未重新核验 · GitHub Advisory

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

CVE-2026-54637

## Summary The Dragonfly **scheduler**'s v1 gRPC service contains an unauthenticated Server-Side Request Forgery (SSRF)

历史摘要 · 未重新核验 · GitHub Advisory

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

CVE-2026-46599

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit

历史摘要 · 未重新核验 · GitHub Advisory

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

CVE-2026-52792

### Summary Algernon selects its file handler from `filepath.Ext()` (engine/handlers.go:134), which does not treat the

历史摘要 · 未重新核验 · GitHub Advisory

goshs: Share-link ?token=… redemption races past download limit

CVE-2026-50139

# Share-link `?token=…` redemption races past download limit **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`githu

历史摘要 · 未重新核验 · GitHub Advisory

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

CVE-2026-50138

# WebDAV listener ignores `--read-only`, `--upload-only`, and `--no-delete` mode flags **Ecosystem:** Go **Package:** `

历史摘要 · 未重新核验 · GitHub Advisory

ORAS Go forwards registry credentials across registry redirects

# ORAS Go forwards registry credentials across registry redirects Reporter / public credit: JUNYI LIU ## Summary ORAS

历史摘要 · 未重新核验 · GitHub Advisory

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

CVE-2026-50163

### Root cause The tar-extraction helper `ensureLinkPath` at [`content/file/utils.go:262-275`](https://github.com/oras-

历史摘要 · 未重新核验 · GitHub Advisory

oras-go has file store write outside workingDir via symlink traversal

CVE-2026-50162

The file content store in `oras-go` attempts to confine writes to `workingDir` when `AllowPathTraversalOnWrite=false`, b

历史摘要 · 未重新核验 · GitHub Advisory

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header

CVE-2026-50151

## Summary oras-go follows a registry-controlled `Location` header during the monolithic blob upload flow and reuses th

历史摘要 · 未重新核验 · GitHub Advisory

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

CVE-2026-48978

## Summary oras-go's `auth.Client` follows the `realm` URL from a registry's `WWW-Authenticate: Bearer` challenge witho

历史摘要 · 未重新核验 · GitHub Advisory

Rancher has Privilege Escalation from Project Owner to Host

CVE-2026-41052

### Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to

历史摘要 · 未重新核验 · GitHub Advisory

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

CVE-2026-48824

### Summary The fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via

历史摘要 · 未重新核验 · GitHub Advisory

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

CVE-2026-41053

### Impact A vulnerability has been identified within Rancher Manager in the GitHub App authentication provider. When ev

历史摘要 · 未重新核验 · GitHub Advisory

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

CVE-2026-44935

### Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share

历史摘要 · 未重新核验 · GitHub Advisory

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

CVE-2026-44936

### Impact A vulnerability has been identified in Fleet when the `helmRepoURLRegex` field isn't set on a `GitRepo` resou

历史摘要 · 未重新核验 · GitHub Advisory

Rancher vulnerable to command injection through unsanitized YAML parameter

CVE-2026-44939

### Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint

历史摘要 · 未重新核验 · GitHub Advisory

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

CVE-2026-44937

### Impact A vulnerability has been identified in Fleet when the webhook endpoint is configured without a secret; an att

历史摘要 · 未重新核验 · GitHub Advisory

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

CVE-2026-44938

### Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive k

历史摘要 · 未重新核验 · GitHub Advisory