TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:9448
Red Hat OpenShift Service Mesh 3.1.7
Released 2026-04-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
Fixes 5 records
TI-2026-26126 CVE-2026-33747 · GHSA-4c29-8rgm-jvjj
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
Priority MEDIUM 43
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-26127 CVE-2026-33748 · GHSA-4vrq-3vrq-g6gg
BuildKit Git URL subdir component can cause access to restricted files
Priority LOW 36
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.