SeaweedFS S3 gateway versions prior to 4.34 contain a path traversal vulnerability in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy operations. This flaw allows an attacker authorized on one bucket to read objects from other buckets by exploiting improper validation of path segments in the copy source header. The vulnerability breaks bucket isolation, enabling cross-bucket object reads. The issue was fixed in version 4.34 by validating the copy-source bucket and object key to reject traversal segments.
SeaweedFS versions from 4.08 up to but not including 4.34 contain an authorization flaw in the S3Tables and Iceberg REST management API. This flaw allows a low-privileged authenticated S3 user with only ordinary read permissions to enumerate administrator-owned table buckets, revealing bucket names and ARNs. The vulnerability arises because authorization collapsed account-less S3 identities into a shared admin account and defaulted to allow access. The issue was fixed in version 4.34 by changing the authorization logic to require an explicit ACTION_ADMIN capability and removing the insecure default allow behavior. No configuration workaround exists; upgrading to 4.34 or later is required.
CVE-2026-55764 is an integer overflow vulnerability in klever-io's klever-go blockchain protocol implementation. Before version 1.7.19, a mint-role holder could bypass the finite per-nonce MaxSupply limit on semi-fungible token quantity additions. The flaw occurs because the code increments the circulation count before checking for overflow, allowing a large positive amount to wrap the circulation value negative and bypass the maximum supply check. This leads to crediting approximately MaxInt64 units and corrupting the on-chain counter. The issue is fixed in version 1.7.19.
Arc, a SQL-native time-series database by Basekick-Labs, has an improper access control vulnerability in its Enterprise clustering feature. Versions from 26.02.1 up to but not including 26.06.2 allow unauthenticated cluster join requests when clustering is enabled but no shared secret is configured. This enables an attacker who knows the cluster name and can reach the coordinator port to join the cluster as a trusted node, manipulate cluster membership, intercept forwarded requests including authentication headers, and disrupt cluster operations. The default standalone configuration is not affected as clustering is disabled by default. The issue is fixed in version 26.06.2.
Portainer versions from 2.39.0 up to but not including 2.39.4 and from 2.40.0 up to but not including 2.43.0 contain an unauthenticated restore endpoint (/api/restore) accessible during a five-minute initialization window after startup. This endpoint allows an attacker with network access to an uninitialized instance to replace the Portainer database with attacker-controlled credentials, resulting in full administrative access. The vulnerability also exposes the administrator-account-creation endpoint during this window. The attack requires no credentials but depends on the instance being uninitialized, reachable, and within the setup window. The vulnerability is fixed in Portainer 2.39.4 and 2.43.0. Workarounds include provisioning the admin account at deploy time, restricting network access before setup, and completing setup immediately.
CVE-2026-55763 is a high-severity vulnerability in klever-go, the Go implementation of the Klever blockchain protocol. Prior to version 1.7.19, a logic flaw in the processPercentageRoyaltiesTransfer function allows a 100% royalty split to be processed without debiting the source account, resulting in unbounded off-the-books inflation of the KDA token supply. This occurs because the function returns early when royaltiesToPay reaches zero, before subtracting the amount from the sender's balance. The issue is fixed in version 1.7.19.
ALOS HTTP, a Go web framework and application server, has a vulnerability where a malformed request path starting with a question mark can cause an out-of-bounds panic. This occurs because the code accesses an array element without checking if the array is empty, leading to server process termination. The issue is fixed in version 0.0.0-20260617230736-314b6783e196.
CVE-2026-79921 is a vulnerability in the amqp091-go client library used by RabbitMQ. A malicious AMQP broker can send content body frames larger than the negotiated frame_max limit, causing the client to allocate excessive memory. This bypasses the protocol's framing constraints and can lead to denial of service due to out-of-memory conditions.
CVE-2026-77354 is a high-severity vulnerability in the Go project kin-openapi affecting versions from 0.124.0 up to but not including 0.142.0. The issue involves uncontrolled resource consumption caused by the openapi3filter.sliceMapToSlice function, which allocates large slices based on attacker-controlled sparse indexes in deepObject query parameters before schema validation. This can lead to multi-gigabyte heap allocations, resulting in out-of-memory (OOM) kills or restart loops. The vulnerability is fixed in version 0.142.0.
A NULL pointer dereference vulnerability exists in kin-openapi versions from 0.10.0 up to but not including 0.141.0. The issue occurs in the openapi3filter.convertParseError function, which dereferences a nil Parameter field without checking. This can cause applications rendering validation errors to panic when processing malformed multipart/form-data requests. The vulnerability allows unauthenticated clients to cause a denial of service by repeatedly sending such requests. The issue is fixed in version 0.141.0.
CVE-2026-64679 is a path traversal vulnerability in the Atlantis application, a self-hosted Go service for Terraform pull request automation. Versions from 0.19.8 up to but not including 0.45.0 improperly validate user-controlled workspace names, allowing directory traversal outside intended workspace directories. This can lead to unauthorized filesystem operations such as creating or deleting directories with the privileges of the Atlantis process, potentially causing integrity loss or denial of service. The issue is fixed in version 0.45.0.
Incus, a system container and virtual machine manager, has an improper access control vulnerability prior to version 7.2.0. This flaw allows an attacker who knows the name of a project and an instance within that project, without having authorization, to copy the instance to a new project. Exploiting this vulnerability could enable unauthorized access to secrets stored in instances. The issue is patched in version 7.2.0.
CVE-2026-55621 is an improper access control vulnerability in the Incus container and virtual machine manager prior to version 7.2.0. The flaw allows an attacker who knows the name of a project and a custom volume within it, but lacks authorization, to copy that volume to a new project. This can lead to unauthorized access to secrets stored in custom volumes. The issue is patched in version 7.2.0.
CVE-2026-67448 is a vulnerability in axllent mailpit versions 1.29.0 through 1.30.5 involving improper handling of URL encoding in WebSocket origin checks. The origin check relies on the raw request URI prefix, but Go's ServeMux routes on the percent-decoded path, allowing an attacker to bypass origin validation by encoding the path. This leads to unauthorized WebSocket connections that can leak sensitive email data. The issue arises because the upgrader accepts all origins and the middleware origin check is bypassed due to inconsistent handling of encoded URLs.
CVE-2026-67447 is a medium severity vulnerability in axllent mailpit's SMTP DATA reader. The configured maximum message size limit is enforced only after a complete newline-terminated line is buffered, allowing a remote unauthenticated SMTP client to send a single line larger than the limit. This causes excessive memory allocation before the server rejects the message, potentially leading to resource exhaustion. The issue is a partial regression of a previous SMTP DATA body-size limit fix, affecting versions from 1.30.0 up to but not including 1.30.5.
CVE-2026-67446 is an uncontrolled resource consumption vulnerability in axllent mailpit's thumbnail endpoint. The endpoint decodes attacker-supplied image attachments into full raster images before validating their dimensions or memory usage, allowing a remote client to cause excessive CPU and memory consumption. This can be triggered by supplying a compact but high-dimension image attachment and requesting its thumbnail, which forces the server to decode a large image in memory. The vulnerability affects mailpit versions prior to 1.30.4. The CVSS score is 5.3, indicating a medium severity impact primarily on availability.
Mailpit's SMTP server has an uncontrolled resource consumption vulnerability due to unbounded reading of SMTP command lines. The server reads command lines without enforcing the RFC 5321 limit of 512 octets, allowing a remote unauthenticated client to send oversized commands that cause large memory allocations. This can lead to denial of service by exhausting process memory. The issue affects versions prior to 1.30.4.
CVE-2026-71485 is an authentication bypass vulnerability in centrifugal centrifugo before version 6.9.0. It arises because client-supplied headers in the connect request are forwarded to backend services without proper validation, allowing attackers to spoof trusted headers used for authentication and authorization. This can lead to full impersonation of any identity the backend trusts based on these headers. The issue affects all proxy call types and persists for the lifetime of the connection.