A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary …

▾ TwilightRed Hat · Red Hat Edge Manager 1.1EPSS 0.10%via CSAF

CVE-2026-12681Medium· 6.8

3mo ago

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

▾ Sunlitgoogle · github.com/google/go-attestationEPSS 0.27%via OSV

GHSA-9r4w-jg96-92mvMedium· 6.8

3mo ago

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

▾ Sunlitgoogle · github.com/google/go-attestationvia GHSA

GHSA-6vgg-xhvh-38ffLow

3mo ago

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store

▾ Sunlitjuev · github.com/juev/nebula-meshvia GHSA

CVE-2026-53999High· 7.7

3mo ago

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

▾ Twilightradius-project · github.com/radius-project/radiusvia GHSA

CVE-2026-54097High

3mo ago

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

▾ Twilightfilebrowser · github.com/filebrowser/filebrowserEPSS 0.45%via GHSA

Tagged “go”

Caddy: Windows `file_server` path authorization bypass via encoded backslash

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Caddy: stripHTML template function bypass

Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles

Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Gogs: Overwriting critical files results in a denial of service

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw

Gitea: Missing repository-unit authorization on issue-template API endpoints

Gitea: Token scope bypass on web archive download endpoint

Filestash allows attackers to escalate privileges via sending a crafted request

statping-ng allows attackers to escalate privileges to Administrator and access sensitive components

linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST r…

MCP Toolbox for Databases has an Origin Validation Error

Duplicate Advisory: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel

Mattermost doesn't require system-level permission when patching protected default system roles

Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account

github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup (…

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix