TI-2026-25883 CVE-2026-33487 · GHSA-479m-364c-43vc
goxmldsig has validateSignature Loop Variable Capture Signature Bypass
Priority HIGH 72
goxmlsig provides XML Digital Signatures implemented in Go.
RHSA-2026:20946
Red Hat OpenShift GitOps v1.18.6 security update
Released 2026-05-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/console-plugin-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8
Fixes 5 records
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm
Inefficient policy validation in crypto/x509
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.