Vulnerability disclosures, CVEs, security advisories, and patched releases.
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI
Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
Coraza: Truncated multipart body bypasses MULTIPART STRICT ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza
Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that cou
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions tha
