A vulnerability in github.com/patrickhener/goshs/v2 allows arbitrary file write via a missing CSRF token validation on the PUT upload handler combined with a wildcard CORS policy. This enables any website visited by a victim to write or overwrite files in the goshs webroot through the victim's browser. The issue affects versions prior to 2.0.2 and 1.1.4 and has been assigned CVE-2026-42091.
Nuclei versions from 3.0.0 up to but not including 3.8.0 contain a vulnerability in the expression evaluation engine that allows a malicious target server to inject and execute DSL expressions derived from HTTP response data. When the '-env-vars' ('-ev') option is explicitly enabled, environment variables from the host can be exposed through this injection. This option is off by default, so standard configurations are not affected. The vulnerability is fixed in version 3.8.0.
A server-side request forgery (SSRF) vulnerability exists in monetr's Lunch Flow integration in versions prior to 1.12.5. This flaw allows any authenticated user on a self-hosted instance with default settings to make the server issue HTTP GET requests to arbitrary URLs. The vulnerability arises because the URL validator does not block internal or cloud metadata addresses, and the server reflects response bodies from non-200 HTTP responses in API error messages. This can expose sensitive internal resources, including cloud instance metadata. Additionally, an attacker can cause a denial-of-service by triggering large response bodies to be buffered in memory. The hosted monetr service is not affected as Lunch Flow is disabled by default. The issue is fixed in version 1.12.5.
A command injection vulnerability exists in the inspektor-gadget 'ig' binary's image building subcommand due to unsafe inclusion of user-controlled build options in Makefile commands without proper escaping. This allows an attacker who can control the buildOptions structure (via the gadget manifest YAML) to execute arbitrary commands during the image build process. The impact includes arbitrary command execution on the Linux host if the build is local, or inside the build container if not local. The vulnerability affects versions prior to 0.51.1 and has been assigned CVE-2026-24905 with a high severity rating.
A SQL injection vulnerability exists in Daptin's /aggregate/:typename API endpoint where user-supplied column and group parameters are passed directly to goqu.L() without validation. This allows authenticated users with any valid session to inject arbitrary SQL expressions. The flaw enables data extraction from any table, disclosure of database internals, and cross-table data exfiltration. The issue is fixed in version 0.11.4 by removing unsafe goqu.L() calls and adding strict schema validation and allowlists for functions.
The SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks allowing an attacker to read and write arbitrary files outside the configured root directory. This occurs because the path sanitization logic fails to properly confine file operations within the root directory, enabling crafted filenames with '../' sequences to escape the root. The vulnerability affects all versions through commit 72d67e6 (current main) and likely all v1 versions of github.com/charmbracelet/wish. The flaw allows arbitrary file write, read, and directory creation on the server filesystem via SCP protocol manipulation.
CVE-2026-41413 is a Server-Side Request Forgery (SSRF) vulnerability in Istio's RequestAuthentication resource. When a RequestAuthentication resource is configured with a jwksUri pointing to an internal service, istiod performs an unauthenticated HTTP GET request to that URL without filtering out localhost or link-local IP addresses. This can lead to sensitive data exposure to Envoy proxies via xDS configuration. Partial mitigations were released in versions 1.29.1, 1.28.5, and 1.27.8, but a more complete fix is included in versions 1.29.2 and 1.28.6. Users can also deploy a ValidatingAdmissionPolicy to block suspicious jwksUri values as a workaround.
An authentication bypass vulnerability in MinIO's STREAMING-UNSIGNED-PAYLOAD-TRAILER code path allows any user with a valid access key to write arbitrary objects to any bucket without needing the secret key or a valid signature. This affects all MinIO releases from RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-02-12T20-18-48Z. The flaw arises because signature verification is bypassed when credentials are supplied via query string without the Authorization header. A fix is available in MinIO AIStor RELEASE.2026-04-11T03-20-12Z. Users unable to upgrade immediately should block unsigned-trailer requests at the load balancer.
MinIO contains two authentication bypass vulnerabilities in its STREAMING-UNSIGNED-PAYLOAD-TRAILER code path that allow an attacker with a valid access key to write arbitrary objects to any bucket without a valid cryptographic signature. The first vulnerability is due to missing signature verification in the PutObjectExtractHandler, and the second is a signature verification bypass via query-string credentials. These issues affect all MinIO releases starting from RELEASE.2023-05-18T00-05-36Z through the final open-source release. A fix is available in MinIO AIStor RELEASE.2026-04-11T03-20-12Z.
Prometheus versions prior to 3.5.2 and between 3.6.0 and 3.11.1 have stored cross-site scripting (XSS) vulnerabilities in their web UI. These arise from improper escaping of metric names and label values injected into innerHTML in UI components like chart tooltips and the Metric Explorer fuzzy search. An attacker who can inject metrics via compromised scrape targets or receivers may execute arbitrary JavaScript in users' browsers. This could lead to configuration exfiltration, data deletion, or service shutdown depending on enabled features. The vulnerabilities are fixed in versions 3.5.2 and 3.11.2. Mitigations include restricting exposure of remote write and OTLP receivers, trusting scrape targets, disabling admin or mutating API endpoints in untrusted environments, and avoiding untrusted links that generate poisoned labels.
CVE-2026-34992 is a vulnerability in Antrea affecting dual-stack clusters configured with IPsec encryption. Specifically, IPv6 Pod traffic between nodes is not encrypted, while IPv4 traffic is properly encrypted. This occurs because IPv6 packets bypass the IPsec encryption layer despite being encapsulated. Single-stack IPv4 or IPv6 clusters are not impacted. The issue has been patched in Antrea versions 2.6.0 and later, 2.5.2, and 2.4.5. No configuration workaround exists for affected versions, but users may use WireGuard as an alternative encryption method. Antrea provides a validation tool to verify correct IPsec encryption after upgrading.
A vulnerability in go-git's index decoder for Git index format version 4 allows a specially crafted index file to cause a runtime panic due to an out-of-bounds slice operation. This can lead to denial-of-service if the application using go-git does not handle panics. The issue requires write access to the local .git directory to inject the malicious index file. Versions prior to 5.17.1 are affected.
Traefik's Basic and Digest authentication middlewares are vulnerable to identity spoofing when the 'headerField' is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject a canonical header version to impersonate any user identity to backend services. This occurs because Traefik writes the authenticated username using a non-canonical header key, creating a separate header entry that does not overwrite the attacker-injected canonical header. The vulnerability enables privilege escalation if backends rely on this header for authorization decisions. Patches fixing this issue are available in Traefik versions 2.11.42, 3.6.12, and 3.7.0-ea.3.
SiYuan kernel WebSocket server allows unauthenticated connections when a specific 'auth keepalive' query parameter is present. Incoming JSON messages from these connections are parsed with unsafe type assertions, leading to runtime panics on malformed input. This can crash the kernel process, causing denial of service. The vulnerability affects versions prior to 3.6.2 and is fixed in 3.6.2.
The SiYuan kernel's IsSensitivePath function uses an incomplete denylist to block access to sensitive filesystem paths. Several important directories such as /opt, /usr, /home, /mnt, and /media are not blocked, allowing unauthorized reading of files from these locations via the globalCopyFiles API endpoint. This flaw enables reading application source code, configuration files, and mounted secrets, especially in Docker deployments. The vulnerability is fixed in version 3.6.2 by switching to an allowlist approach restricting file access to the workspace and explicitly approved paths.
CVE-2026-30405 is a high-severity vulnerability in GoBGP gobgpd version 4.2.0 that allows a remote attacker to cause a denial of service (DoS) by exploiting the NEXT_HOP path attribute. The vulnerability requires no authentication or user interaction and can be triggered remotely over the network. It impacts availability by crashing or disrupting the BGP daemon, potentially affecting network routing stability. No known exploits are currently in the wild, and no patches have been published yet. Organizations relying on GoBGP for BGP routing should prioritize monitoring and mitigation to prevent service disruption. The vulnerability is classified under CWE-400, indicating a resource exhaustion or DoS condition. Countries with significant internet infrastructure and use of GoBGP are at higher risk. Immediate mitigation involves network-level filtering and limiting exposure of BGP sessions to untrusted sources.
A missing administrative role check in SiYuan's renderSprig API endpoint allows any authenticated user to execute arbitrary SQL SELECT queries against the workspace database. This vulnerability enables exfiltration of all note content, metadata, and custom attributes. The flaw exists because renderSprig requires only authentication but not admin privileges, unlike other sensitive endpoints. The issue affects versions prior to 3.6.1 and was fixed in 3.6.1.
The SiYuan kernel contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/network/forwardProxy endpoint that allows authenticated users to make arbitrary HTTP requests from the server. The endpoint does not validate the destination URL beyond basic format checks, enabling requests to internal networks, localhost, or cloud metadata services. This can lead to internal network reconnaissance, cloud credential theft, data exfiltration, and firewall bypass. Versions prior to 3.6.0 are affected, with a fix available in version 3.6.0.
A path traversal vulnerability in the SiYuan kernel's /export endpoint allows attackers to read arbitrary files on the server by exploiting double-encoded traversal sequences. Sensitive files such as conf/conf.json, containing API tokens and authentication secrets, can be accessed. The vulnerability also enables administrative API access via leaked tokens and allows cross-origin data exfiltration due to permissive CORS headers. This flaw is fixed in version 3.5.10.
A vulnerability in Traefik prior to version 3.6.8 allows an unauthenticated remote client to bypass the readTimeout setting on TCP entrypoints by sending a Postgres SSLRequest (STARTTLS) prelude and then stalling. This causes connections to remain open indefinitely, leading to resource exhaustion and denial of service.