external_secrets_operator_for_red_hat_openshift vulnerabilities
CVEs whose affected-version data names the external_secrets_operator_for_red_hat_openshift package (go, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
25 CVEsRSS
CVE-2026-56855Medium· 5.3golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)
A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS…
CVE-2026-78662Medium· 5.3golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding (CVE-2026-78662)
A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service (DoS) for…
CVE-2026-82556Medium· 6.3A vulnerability was found in Forgejo up to 15.0.4
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the component Repository Migration Handler. Performing a manipulation resu…
CVE-2026-56854Medium· 6.8golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854)
A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the Se…
CVE-2026-71556High· 7.1go-git is an extensible git implementation library written in pure Go
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resoluti…
CVE-2026-45409Medium· 5.3python-idna: idna: Denial of Service via specially crafted long inputs (CVE-2026-45409)
A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding f…
CVE-2026-44740High· 7.5github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation an…
CVE-2026-25680Medium· 6.5golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)
A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition,…
CVE-2026-46598Medium· 5.3golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input (CVE-2026-46598)
A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cau…
CVE-2026-39833Medium· 5.5⚖ disputedgolang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before u…
CVE-2026-39827Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings (CVE-2026-39827)
A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the ser…
CVE-2026-39831High· 8.1golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardw…
CVE-2026-39834Medium· 6.5⚖ disputedgolang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write (CVE-2026-39834)
A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnera…
CVE-2026-46595High· 7.1PoC⚖ disputedgolang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This…
CVE-2026-41506Medium· 6.5golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects (CVE-2026-41506)
A flaw was found in go-git, an extensible Git implementation library for Go. This vulnerability allows an attacker to potentially obtain sensitive HTTP authentication credentials. This can occur when go-git follows redirects during smart-H…
CVE-2026-39823Medium· 5.4html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper esc…
CVE-2026-39826Medium· 5.4html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block,…
CVE-2026-39825Medium· 6.5net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2…
A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs becaus…
CVE-2026-39836High· 7.5net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)
A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a speci…
CVE-2026-6993Medium· 5.3go-kratos: go-kratos kratos: Information disclosure via unintended HTTP server intermediary (CVE-2026-6993)
A flaw was found in go-kratos kratos. A remote attacker could exploit a vulnerability in the HTTP server's `NewServer` function, specifically within the `http.DefaultServeMux Fallback Handler`. This manipulation creates an unintended inter…
CVE-2026-32289Medium· 5.4html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals (CVE…
A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be inco…
CVE-2026-35536Medium· 5.4tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)
A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the `domain`, `path`, and `samesite` arguments when setting cookies. This could lead to cookie attribute injecti…
CVE-2026-25645Medium· 4.7PoCrequests: Requests: Security bypass due to predictable temporary file creation (CVE-2026-25645)
A flaw was found in the `requests` HTTP library, specifically in the `requests.utils.extract_zipped_paths()` function, which is used to load Certificate Authority (CA) bundles. A local attacker can exploit this vulnerability by pre-creatin…
CVE-2026-25934Medium· 4.3go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files (CVE-2026-25934)
A flaw was found in go-git, a library for Git implementation in Go. This vulnerability allows a remote attacker to provide specially crafted Git pack or index files that are not properly verified for data integrity. Successful exploitation…
CVE-2025-61730Medium· 5.3crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVE-2025-61730)
A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted E…