Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view. This issue has been patched in version 0.19.5.
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the configured export directory. The export process commonly runs as root (default in Docker / bare-metal admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been patched in version 0.19.5.
GoBGP versions prior to 4.7.0 contain a vulnerability where a zero-length AS_PATH attribute in a BGP UPDATE message causes a panic during validation for confederation eBGP peers. This results in a denial of service by crashing the receive goroutine or potentially the entire process. The flaw arises because the empty AS_PATH is not properly rejected during decoding, leading to an out-of-range index access during validation.
GoBGP versions prior to 4.6.0 contain a vulnerability in the BGP OPEN capability parser where certain capability decoders read beyond the declared capability length boundary. This can cause malformed BGP OPEN messages to be incorrectly parsed, particularly affecting the 4-octet AS capability. The flaw may impact peer AS validation and capability negotiation during BGP session establishment but does not lead to memory corruption or remote code execution.
Sigstore-go versions prior to 1.2.0 contain a vulnerability in multi-log threshold verification where a single compromised transparency log can bypass multi-log threshold defenses by forging multiple entries. This flaw allows the compromised log to satisfy multi-log policy requirements improperly, potentially undermining the integrity of signature verification. Cosign is not affected as it uses a threshold of 1. The issue is fixed in version 1.2.0.
OpenRun versions prior to 0.17.7 contain a vulnerability in their redirect URL validation logic that allows attackers to bypass host and schema checks by using URLs with double slashes in the path (e.g., //host). This leads to an open redirect issue where users can be redirected to external malicious sites despite validation. The vulnerability arises because the validation only checks the host and schema of the redirect URL but uses the path portion for the actual redirect, which browsers interpret as an external URL when starting with //.
Nebula-mesh contains two related authorization flaws that allow hosts that have been blocked or offboarded to obtain new valid certificates. The system does not enforce the blocklist or host status checks at certificate issuance or re-enrollment time, allowing blocked hosts to regain trust by re-enrolling. Additionally, certificate renewal does not verify whether the owning operator or CA is still active, enabling hosts from disabled operators to continue renewing certificates indefinitely. These issues affect versions prior to 0.3.7 and have been fixed in version 0.3.7.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
From versions 1.13.2 through 1.18.0, the oasdiff tool did not enforce the --allow-external-refs=false setting when loading OpenAPI specs from a git revision path. This flaw allowed external references to be resolved even when explicitly disabled, exposing users to server-side request forgery (SSRF) and local file read risks via crafted $ref values. The issue affects CLI commands and Go library consumers using the git-revision load path with external refs disabled. Version 1.18.1 fixes this by enforcing the external refs policy on the git-revision path and returning a dedicated exit code when external refs are blocked.
KEDA versions prior to 2.20.0 have a vulnerability in the PostgreSQL scaler connection string construction where tenant-controlled parameters are insufficiently escaped. This allows injection of additional connection parameters by including unescaped ASCII whitespace characters other than space, such as tabs, which can alter connection behavior. An attacker with the ability to create TriggerAuthentication or ScaledObject resources can downgrade TLS connections, redirect connections to attacker-controlled hosts, and inject arbitrary libpq parameters.
Goploy, an open-source automation deployment system, contains a high-severity path traversal vulnerability in its /deploy/fileDiff endpoint. This flaw allows authenticated users with low privileges to read arbitrary files on both the local host and remote servers managed by Goploy. The vulnerability is due to insufficient validation of the filePath parameter, enabling directory traversal attacks. Exploitation requires only a valid user account and configured projects and servers. The CVSS v3 score is 7.7, indicating high severity.
A critical vulnerability (CVE-2026-53552) in github.com/zhenorzz/goploy versions up to 1.17.5 allows a user with the 'manager' role in their own namespace to perform unauthorized actions on projects across namespaces. The flaw is due to insufficient authorization checks on project and project-file row IDs supplied in request bodies, enabling cross-namespace Insecure Direct Object References (IDOR). This can lead to reading, modifying, or deleting files in any project, and changing a project's git remote URL, which escalates to remote code execution (RCE) on deployment. The issue is fixed in version 1.18.0.
An authenticated user of Kite can bypass cluster Role-Based Access Control (RBAC) restrictions on the /api/v1/overview endpoint by specifying a different cluster name in the x-cluster-name header. This allows the user to retrieve aggregate inventory and capacity data for clusters they are not authorized to access. The vulnerability affects Kite versions prior to 0.12.3 and has been fixed in version 0.12.3. The impact is limited to confidentiality, exposing aggregate cluster resource data without allowing mutation or access to sensitive Kubernetes secrets or tokens.
LocalAI contains an unauthenticated server-side request forgery (SSRF) vulnerability in its POST /models/apply endpoint. Attackers can supply unsanitized gallery URL fields that are used without validation, causing the server to make HTTP GET requests to internal or private network addresses. This may expose partial response data through error messages. No affected versions or patches are currently specified.
A vulnerability in the netfoil Go library allows attacker-controlled domain names to be written to logs without validation of allowed characters. This improper sanitization could lead to issues depending on how logs are processed or consumed. The vulnerability affects versions prior to 0.3.0. The severity is considered low based on the available information.
A resource leak vulnerability exists in the LRU cache implementation of netfoil before version 0.3.0. When entries are removed from the cache, pointers to those elements are not properly cleaned up, causing increased memory usage. This issue can be triggered by a local attacker, potentially causing the netfoil service to consume more memory than intended. By default, systemd limits this memory usage to 100MB, which would lead to service restarts once reached. The vulnerability is classified as low severity.
A vulnerability in netfoil before version 0.3.0 allows a local attacker to bypass domain name filters by crafting DNS requests containing multiple questions, where the first question is legitimate. This bypass depends on the attacker's ability to create such requests and the remote DNS-over-HTTPS (DoH) server's support for multiple questions in a single request. The issue is categorized as a moderate severity vulnerability with no known exploits in the wild and no official patch currently available.