Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Oct 16, 2026
- Medium4.3Arcane: Environment access token bypasses the admin-required authorization gate onOct 16, 2026
- Low3.7CoreDNS headless AXFR can emit an empty transfer batch that panics the pluginOct 16, 2026
- High7.5sync 2026-10-16T15:41:51ZOct 16, 2026
- High8.2kin-openapi is a Go project for handling OpenAPI files.EPSS 0.4%Oct 15, 2026
- High8.8Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLOct 9, 2026
- High7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.Oct 8, 2026
- UnknownReject malformed ECH outer extension references in crypto/tlsOct 8, 2026
- Medium6.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.Oct 8, 2026
- Medium6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.Oct 8, 2026
- High7.8Checksum database bypass for golang.org/toolchain in cmd/goOct 8, 2026
- High7.8Checksum bypass for golang.org/fips140 in cmd/goEPSS 0.1%Oct 8, 2026
- UnknownMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartOct 8, 2026
- UnknownHTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpOct 8, 2026
- UnknownExcessive CPU consumption from repeated initial window changes in net/httpOct 8, 2026
- UnknownLack of limit on size of parsed Range headers in net/httpOct 8, 2026
- UnknownDouble flow control refund on HTTP/2 server streams in net/httpOct 8, 2026
- HighHTTP/2 transport accepts malformed framing-related headers in net/httpOct 8, 2026
- UnknownHTTP/2 server memory exhaustion due to Trailer headers in net/httpOct 8, 2026
- HighHTTP/1 client connection desynchronization after CONNECT rejection in net/httpOct 8, 2026
- UnknownRoot.Mkdir(All) can follow junctions out of the root on Windows in osOct 8, 2026
- Critical9.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.May 22, 2026
- High7.5Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netEPSS 0.8%May 7, 2026
- High7.5Incorrect parsing of IPv6 host literals in net/urlEPSS 0.8%Mar 6, 2026
24 records · page 1 of 1
PreviousNext