{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:16:44.829Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "go" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-94603", "url": "https://cveboard.org/i/cve-2026-94603", "urlPt": "https://cveboard.org/pt/i/cve-2026-94603", "json": "https://cveboard.org/i/cve-2026-94603.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation", "summary": "Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox.", "titlePt": "Podman: O comando `podman run` pode ser instruído a desabilitar quase todo o sandboxing por meio de anotação de imagem", "summaryPt": "O Podman v4.4.0 adicionou um recurso onde pontos de verificação de contêineres (do comando podman container checkpoint) poderiam ser distribuídos via registro OCI, e puxados desse registro e executados via o comando podman run. Isso permitiu a transferência fácil de pontos de verificação entre sistemas. No entanto, os pontos de verificação permitem controle total sobre como o contêiner é criado - incluindo controle total do sandbox do contêiner.", "affected": [ { "vendor": "podman-container-tools", "product": "podman", "defaultStatus": "unknown", "versions": [ { "version": ">= 4.4.0, < 5.8.8", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 6.0.0, < 6.1.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-13T20:19:31.021Z" }, "fix": "listed", "tags": [ "podman-container-tools", "go" ], "cves": [ "CVE-2026-94603" ], "ghsa": "GHSA-2cvf-wqm6-wr9g", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00918, "percentile": 0.59887, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/containers/podman", "vulnerable": ">= 4.4.0, < 5.8.8", "fixed": "5.8.8", "advisory": "GHSA-2cvf-wqm6-wr9g" }, { "ecosystem": "go", "name": "go.podman.io/podman/v6", "vulnerable": ">= 6.0.0, < 6.1.3", "fixed": "6.1.3", "advisory": "GHSA-2cvf-wqm6-wr9g" } ], "vendor": "podman-container-tools", "product": "podman", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-2cvf-wqm6-wr9g" } ], "publishedAt": "2026-10-15T20:22:16.000Z", "updatedAt": "2026-10-15T20:22:16.000Z" }, { "id": "cve-2026-77524", "url": "https://cveboard.org/i/cve-2026-77524", "urlPt": "https://cveboard.org/pt/i/cve-2026-77524", "json": "https://cveboard.org/i/cve-2026-77524.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication", "summary": "A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds [\"*\"]/[\"*\"] get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs and horizontalpodautoscalers create/delete cluster-wide, */scale update on any workload,…", "titlePt": "KEDA: escalonamento de privilégios de administrador de namespace para administrador de cluster via KEDA TriggerAuthentication", "summaryPt": "Um administrador de namespace que cria um TriggerAuthentication e um ScaledObject no próprio namespace pode fazer com que o operador KEDA envie seu próprio token de ServiceAccount para uma URL controlada pelo inquilino. Esse token possui [\"*\"]/[\"*\"] get em todo o cluster, então ele lê todo Secret em cada namespace, além de batch/jobs e horizontalpodautoscalers criar/excluir em todo o cluster, */scale atualizar em qualquer carga de trabalho,…", "affected": [ { "vendor": "kedacore", "product": "keda", "defaultStatus": "unknown", "versions": [ { "version": "< 2.21.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management" }, { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-20T01:38:54.426Z" }, "fix": "listed", "tags": [ "kedacore", "go" ], "cves": [ "CVE-2026-77524" ], "ghsa": "GHSA-637c-6jxx-4rwm", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00635, "percentile": 0.49827, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/kedacore/keda", "vulnerable": "<= 1.5.0", "fixed": null, "advisory": "GHSA-637c-6jxx-4rwm" }, { "ecosystem": "go", "name": "github.com/kedacore/keda/v2", "vulnerable": "< 2.21.0", "fixed": "2.21.0", "advisory": "GHSA-637c-6jxx-4rwm" } ], "vendor": "kedacore", "product": "keda", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-637c-6jxx-4rwm" } ], "publishedAt": "2026-10-15T20:19:42.000Z", "updatedAt": "2026-10-15T20:19:42.000Z" }, { "id": "cve-2026-77459", "url": "https://cveboard.org/i/cve-2026-77459", "urlPt": "https://cveboard.org/pt/i/cve-2026-77459", "json": "https://cveboard.org/i/cve-2026-77459.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks", "summary": "Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it.", "titlePt": "Argo CD: contorno das restrições de destination-namespace e de recursos do AppProject por hooks de recursos PreDelete/PostDelete", "summaryPt": "O Argo CD verifica o AppProject de uma Aplicação antes de criar recursos durante uma sincronização. Essa verificação cobre namespaces e servidores de destino, listas de permissões e negações de recursos em nível de cluster e listas de permissões e negações de recursos em nível de namespace, incluindo nomes de recursos. Os hooks PreDelete e PostDelete pulam essa verificação.", "affected": [ { "vendor": "argoproj", "product": "argo-cd", "defaultStatus": "unknown", "versions": [ { "version": ">= 2.10.0, <= 2.14.21", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 3.0.0, < 3.3.15", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 3.4.0, < 3.4.10", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 3.5.0, < 3.5.4", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 3.6.0-rc1, < 3.6.0-rc2", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-14T15:27:27.557Z" }, "fix": "listed", "tags": [ "argoproj", "go" ], "cves": [ "CVE-2026-77459" ], "ghsa": "GHSA-fmxq-cgp8-87wp", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.0072, "percentile": 0.53411, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v2", "vulnerable": ">= 2.10.0, <= 2.14.21", "fixed": null, "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.0.0, < 3.3.15", "fixed": "3.3.15", "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.4.0, < 3.4.10", "fixed": "3.4.10", "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.5.0, < 3.5.4", "fixed": "3.5.4", "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.6.0-rc1, < 3.6.0-rc2", "fixed": "3.6.0-rc2", "advisory": "GHSA-fmxq-cgp8-87wp" } ], "vendor": "argoproj", "product": "argo-cd", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-fmxq-cgp8-87wp" } ], "publishedAt": "2026-10-15T20:19:31.000Z", "updatedAt": "2026-10-15T20:19:31.000Z" }, { "id": "cve-2026-102748", "url": "https://cveboard.org/i/cve-2026-102748", "urlPt": "https://cveboard.org/pt/i/cve-2026-102748", "json": "https://cveboard.org/i/cve-2026-102748.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service", "summary": "Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable.", "titlePt": "Dgraph: Negação de Serviço via removeNode HTTP Admin sem autenticação", "summaryPt": "Dgraph v25.3.8 expõe uma superfície administrativa HTTP Zero que não é autenticada quando a porta 6080 está acessível.", "affected": [ { "vendor": "dgraph-io", "product": "dgraph", "defaultStatus": "unknown", "versions": [ { "version": "< 25.4.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, { "id": "CWE-862", "name": "Missing Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-15T14:22:41.542Z" }, "fix": "listed", "tags": [ "dgraph-io", "go" ], "cves": [ "CVE-2026-102748" ], "ghsa": "GHSA-qj98-gp63-54xj", "cvss": { "score": 9.2, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00486, "percentile": 0.40934, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/dgraph-io/dgraph/v25", "vulnerable": "<= 25.3.8", "fixed": "25.4.0", "advisory": "GHSA-qj98-gp63-54xj" } ], "vendor": "dgraph-io", "product": "dgraph", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-qj98-gp63-54xj" } ], "publishedAt": "2026-10-15T20:17:22.000Z", "updatedAt": "2026-10-15T20:17:22.000Z" }, { "id": "cve-2026-104252", "url": "https://cveboard.org/i/cve-2026-104252", "urlPt": "https://cveboard.org/pt/i/cve-2026-104252", "json": "https://cveboard.org/i/cve-2026-104252.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Vitess vttablet /twopcz reflected XSS", "summary": "From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800", "titlePt": "Vitess vttablet /twopcz reflected XSS", "summaryPt": "De: xylove21 Para: security@vitess.io Assunto: [Relatório de Segurança] Vitess vttablet /twopcz reflected XSS Data: Ter, 24 Jun 2026 14:30:00 +0800", "affected": [ { "vendor": "vitessio", "product": "vitess", "defaultStatus": "unknown", "versions": [ { "version": "< 23.0.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 24.0.0, < 24.0.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-15T13:23:55.916Z" }, "fix": "listed", "tags": [ "vitessio", "go" ], "cves": [ "CVE-2026-104252" ], "ghsa": "GHSA-v75v-6fpf-gvw8", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00885, "percentile": 0.58883, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "vitess.io/vitess", "vulnerable": "< 0.23.5", "fixed": "0.23.5", "advisory": "GHSA-v75v-6fpf-gvw8" }, { "ecosystem": "go", "name": "vitess.io/vitess", "vulnerable": ">= 0.24.0, < 0.24.2", "fixed": "0.24.2", "advisory": "GHSA-v75v-6fpf-gvw8" } ], "vendor": "vitessio", "product": "vitess", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-v75v-6fpf-gvw8" } ], "publishedAt": "2026-10-15T20:16:29.000Z", "updatedAt": "2026-10-15T20:16:29.000Z" }, { "id": "cve-2026-107806", "url": "https://cveboard.org/i/cve-2026-107806", "urlPt": "https://cveboard.org/pt/i/cve-2026-107806", "json": "https://cveboard.org/i/cve-2026-107806.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite", "summary": "An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test.", "titlePt": "Nginx UI: execução remota de código autenticada via sobrescrita de configuração de app no restore de backup", "summaryPt": "Um usuário autenticado do nginx-ui pode chamar POST /api/restore, enviar um backup criptografado forjado, restaurar app.ini, definir configurações de comando nginx como TestConfigCmd e, em seguida, acionar a execução do comando com POST /api/nginx/test.", "affected": [ { "vendor": "0xJacky", "product": "nginx-ui", "defaultStatus": "unknown", "versions": [ { "version": ">= 2.3.8, < 2.5.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr", "tag": "exploit" } ], "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-10-14T01:52:14.582Z" }, "fix": "listed", "tags": [ "0xjacky", "go" ], "cves": [ "CVE-2026-107806" ], "ghsa": "GHSA-p393-cf76-4jmr", "cvss": { "score": 9, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00405, "percentile": 0.33612, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/0xJacky/Nginx-UI", "vulnerable": ">= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591", "fixed": "1.9.10-0.20260728074146-a467ed652591", "advisory": "GHSA-p393-cf76-4jmr" } ], "vendor": "0xJacky", "product": "nginx-ui", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-p393-cf76-4jmr" } ], "publishedAt": "2026-10-09T20:45:02.000Z", "updatedAt": "2026-10-09T20:45:02.000Z" }, { "id": "cve-2026-68582", "url": "https://cveboard.org/i/cve-2026-68582", "urlPt": "https://cveboard.org/pt/i/cve-2026-68582", "json": "https://cveboard.org/i/cve-2026-68582.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)", "summary": "The task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the *view* is taken from the attacker-controlled path and never re-validated against the share.", "titlePt": "Vikunja: token de compartilhamento de link lê os buckets kanban de qualquer inquilino e enumera nomes de usuário/IDs em toda a instância (BOLA)", "summaryPt": "O endpoint de coleção de tarefas GET /api/v1/projects/{project}/views/{view}/tasks carrega a visualização do projeto solicitada diretamente do caminho da URL sem verificar se o chamador está autorizado para isso. Para um token de compartilhamento de link, a consulta de tarefas é corretamente fixada no projeto próprio do compartilhamento, mas a *visualização* é obtida do caminho controlado pelo atacante e nunca revalidada contra o compartilhamento.", "affected": [ { "vendor": "go-vikunja", "product": "vikunja", "defaultStatus": "unaffected", "versions": [ { "version": "0.24.0", "status": "affected", "lessThan": "2.4.0", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "2.4.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj9j-8772-4h6c", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "partial", "at": "2026-08-03T19:56:15.850Z" }, "fix": "listed", "tags": [ "go-vikunja", "go" ], "cves": [ "CVE-2026-68582" ], "ghsa": "GHSA-rj9j-8772-4h6c", "cvss": { "score": 9.3, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00267, "percentile": 0.17793, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "code.vikunja.io/api", "vulnerable": ">= 0.24.0, <= 2.3.0", "fixed": "2.4.0", "advisory": "GHSA-rj9j-8772-4h6c" } ], "vendor": "go-vikunja", "product": "vikunja", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rj9j-8772-4h6c" } ], "publishedAt": "2026-10-09T20:42:33.000Z", "updatedAt": "2026-10-09T20:42:33.000Z" }, { "id": "cve-2026-62252", "url": "https://cveboard.org/i/cve-2026-62252", "urlPt": "https://cveboard.org/pt/i/cve-2026-62252", "json": "https://cveboard.org/i/cve-2026-62252.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login", "summary": "On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.", "titlePt": "Homer: Senha de administrador padrão hardcoded 'sipcapture' sem alteração forçada na primeira entrada", "summaryPt": "Em toda nova implantação do Homer usando autenticação interna, o processo de inicialização cria automaticamente uma conta de administrador com a senha sipcapture (armazenada como um hash hexadecimal SHA-256 legado). Não há um mecanismo de alteração forçada na primeira entrada. Qualquer atacante que alcançar o ponto de entrada de login ganha imediatamente acesso administrativo total.", "affected": [ { "vendor": "sipcapture", "product": "homer", "defaultStatus": "unknown", "versions": [ { "version": "< 11.0.283", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx", "tag": "exploit" } ], "cwes": [ { "id": "CWE-798", "name": "Use of Hard-coded Credentials" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-10-07T17:43:45.414Z" }, "fix": "listed", "tags": [ "sipcapture", "go" ], "cves": [ "CVE-2026-62252" ], "ghsa": "GHSA-6xp5-7rcx-xfgx", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00653, "percentile": 0.50667, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/sipcapture/homer-app", "vulnerable": "< 0.0.0-20260625091610-b2e942031ff8", "fixed": "0.0.0-20260625091610-b2e942031ff8", "advisory": "GHSA-6xp5-7rcx-xfgx" } ], "vendor": "sipcapture", "product": "homer", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-6xp5-7rcx-xfgx" } ], "publishedAt": "2026-10-07T16:12:02.000Z", "updatedAt": "2026-10-07T16:12:02.000Z" }, { "id": "cve-2026-62253", "url": "https://cveboard.org/i/cve-2026-62253", "urlPt": "https://cveboard.org/pt/i/cve-2026-62253", "json": "https://cveboard.org/i/cve-2026-62253.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)", "summary": "Both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == \"\". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated.", "titlePt": "Homer: Contorno completo de autenticação quando coordinator.jwt.secret está vazio (padrão)", "summaryPt": "Ambas as funções de middleware JWT (JWTMiddleware e JWTMiddlewareV4) retornam imediatamente next(c) quando jwtSecret == \"\". O segredo JWT padrão é uma string vazia. Em uma instalação padrão, todos os endpoints de API protegidos sob /api/v1, /api/v3 e /api/v4 estão completamente sem autenticação.", "affected": [ { "vendor": "sipcapture", "product": "homer", "defaultStatus": "unknown", "versions": [ { "version": "< 11.0.283", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9", "tag": "exploit" } ], "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-10-10T02:35:55.234Z" }, "fix": "listed", "tags": [ "sipcapture", "go" ], "cves": [ "CVE-2026-62253" ], "ghsa": "GHSA-rqcc-94gv-wjm9", "cvss": { "score": 9.8, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00423, "percentile": 0.35543, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/sipcapture/homer-app", "vulnerable": "< 0.0.0-20260625093330-5e90809657c9", "fixed": "0.0.0-20260625093330-5e90809657c9", "advisory": "GHSA-rqcc-94gv-wjm9" } ], "vendor": "sipcapture", "product": "homer", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rqcc-94gv-wjm9" } ], "publishedAt": "2026-10-07T16:11:58.000Z", "updatedAt": "2026-10-07T16:11:58.000Z" }, { "id": "cve-2026-73802", "url": "https://cveboard.org/i/cve-2026-73802", "urlPt": "https://cveboard.org/pt/i/cve-2026-73802", "json": "https://cveboard.org/i/cve-2026-73802.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled", "summary": "act_runner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig.", "titlePt": "gitea-runner: container.options do workflow passa namespaces e flags de capacidade do host para o container do job quando o modo privilegiado está desabilitado", "summaryPt": "act_runner anexa workflow-controlled jobs..container.options diretamente ao Docker HostConfig para o container do job. Quando o modo privilegiado do runner está desabilitado, apenas Privileged é forçado como falso. As flags de namespace do host, a expansão de capacidades e as sobreposições de perfil de segurança do YAML do workflow são preservadas no HostConfig final.", "affected": [ { "vendor": "Gitea", "product": "Gitea Runner", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "3.0.0", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "3.0.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-18T13:34:45.738Z" }, "fix": "listed", "tags": [ "gitea", "go" ], "cves": [ "CVE-2026-73802" ], "ghsa": "GHSA-x4q3-gcj3-m6cf", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00472, "percentile": 0.39868, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "gitea.com/gitea/runner", "vulnerable": "< 1.0.9-0.20260731160927-34bfa1915022", "fixed": "1.0.9-0.20260731160927-34bfa1915022", "advisory": "GHSA-x4q3-gcj3-m6cf" } ], "vendor": "Gitea", "product": "Gitea Runner", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-x4q3-gcj3-m6cf" } ], "publishedAt": "2026-10-02T23:18:12.000Z", "updatedAt": "2026-10-02T23:18:12.000Z" }, { "id": "cve-2026-69085", "url": "https://cveboard.org/i/cve-2026-69085", "urlPt": "https://cveboard.org/pt/i/cve-2026-69085", "json": "https://cveboard.org/i/cve-2026-69085.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking", "summary": "The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when Publish.Auth.Enable is false.", "titlePt": "SiYuan: Injeção de SQL não autenticada em searchDocs via palavra-chave não escapada (modo de publicação): leitura/escrita entre cadernos com empilhamento de instruções", "summaryPt": "O endpoint /api/filetree/searchDocs concatena a palavra-chave de busca fornecida pelo chamador diretamente em uma instrução SQL sem escape e sem vinculação de parâmetros. O endpoint é protegido por CheckAuth, acessível apenas pelo token RoleReader de publicação, e pela conta anônima quando Publish.Auth.Enable é falso.", "affected": [ { "vendor": "siyuan-note", "product": "siyuan", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "3.7.3", "lessThanOrEqual": null }, { "version": "3.7.3", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "3.7.3" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-08-03T14:15:16.173Z" }, "fix": "listed", "tags": [ "siyuan-note", "go" ], "cves": [ "CVE-2026-69085" ], "ghsa": "GHSA-33jq-p8c2-q3q4", "cvss": { "score": 10, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.01488, "percentile": 0.73879, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/siyuan-note/siyuan/kernel", "vulnerable": "< 0.0.0-20260721043339-eef10568384e", "fixed": "0.0.0-20260721043339-eef10568384e", "advisory": "GHSA-33jq-p8c2-q3q4" } ], "vendor": "siyuan-note", "product": "siyuan", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-33jq-p8c2-q3q4" } ], "publishedAt": "2026-10-01T14:38:48.000Z", "updatedAt": "2026-10-01T14:38:48.000Z" }, { "id": "cve-2026-61604", "url": "https://cveboard.org/i/cve-2026-61604", "urlPt": "https://cveboard.org/pt/i/cve-2026-61604", "json": "https://cveboard.org/i/cve-2026-61604.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass", "summary": "Type: Improper authorization leading to unauthorized movement of user funds.", "titlePt": "ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass", "summaryPt": "Tipo: Autorização inadequada levando ao movimento não autorizado de fundos do usuário.", "affected": [ { "vendor": "ixofoundation", "product": "ixo-blockchain", "defaultStatus": "unknown", "versions": [ { "version": "< 8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-285", "name": "Improper Authorization" }, { "id": "CWE-862", "name": "Missing Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-09-24T18:02:22.273Z" }, "fix": "listed", "tags": [ "ixofoundation", "go" ], "cves": [ "CVE-2026-61604" ], "ghsa": "GHSA-w3rp-4cm2-4wgc", "cvss": { "score": 9.3, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00266, "percentile": 0.17561, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain/v8", "vulnerable": "< 8.0.0", "fixed": "8.0.0", "advisory": "GHSA-w3rp-4cm2-4wgc" }, { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain/v7", "vulnerable": "<= 7.0.0", "fixed": null, "advisory": "GHSA-w3rp-4cm2-4wgc" }, { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain/v6", "vulnerable": "<= 6.0.1", "fixed": null, "advisory": "GHSA-w3rp-4cm2-4wgc" }, { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain/v5", "vulnerable": "<= 5.0.0", "fixed": null, "advisory": "GHSA-w3rp-4cm2-4wgc" }, { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain/v4", "vulnerable": "<= 4.0.0", "fixed": null, "advisory": "GHSA-w3rp-4cm2-4wgc" }, { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain/v3", "vulnerable": "<= 3.0.0", "fixed": null, "advisory": "GHSA-w3rp-4cm2-4wgc" }, { "ecosystem": "go", "name": "github.com/ixofoundation/ixo-blockchain", "vulnerable": "<= 1.6.0", "fixed": null, "advisory": "GHSA-w3rp-4cm2-4wgc" } ], "vendor": "ixofoundation", "product": "ixo-blockchain", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w3rp-4cm2-4wgc" } ], "publishedAt": "2026-09-24T19:22:53.000Z", "updatedAt": "2026-09-24T19:22:53.000Z" } ], "tag": { "tag": "go", "name": "Go", "kev": null } }