TI-2026-51613 CVE-2026-73501
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
Priority HIGH 80
kin-openapi is a Go project for handling OpenAPI files.
RHSA-2026:95517
Multicluster Global Hub 1.7.4 security update
Released 2026-11-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Fixes 16 records
TI-2026-53976 CVE-2026-77354 · GHSA-xhj3-7xw9-vr34
kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
Priority HIGH 77
kin-openapi is a Go project for handling OpenAPI files.
TI-2026-53730 CVE-2026-76905 · GHSA-mmfr-pmjx-hw9w
NULL pointer dereference in getkin kin-openapi
Priority HIGH 72
kin-openapi is a Go project for handling OpenAPI files.
TI-2026-51614 CVE-2026-73502 · GHSA-jpcw-4wr7-c3vq
NULL pointer dereference in getkin kin-openapi
Priority MEDIUM 57
kin-openapi is a Go project for handling OpenAPI files.
TI-2026-53995 CVE-2026-77405 · GHSA-33mj-cw25-m34h
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
Priority MEDIUM 48
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-28716 CVE-2026-39834 · GHSA-rm3j-f69w-wqmq
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
Priority MEDIUM 46
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making pr…
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-54001 CVE-2026-77411 · GHSA-c5pq-fr2g-9jpf
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
Priority MEDIUM 43
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-13303 CVE-2026-15815 · GHSA-xp8x-3q7w-cpqr
CVE-2026-15815 CVE Record
Priority MEDIUM 41
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives.
TI-2026-45095 CVE-2026-63209 · GHSA-259r-337f-4rfw
Integer Overflow or Wraparound and Out-of-bounds Write in compress
Priority MEDIUM 40
compress provides various compression algorithms.
TI-2026-30467 CVE-2026-42127 · GHSA-3w66-95m3-8jxg
Pre-authentication denial of service in the public dashboard query endpoint
Priority LOW 39
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.
TI-2026-12030 CVE-2026-14199 · GHSA-9758-8g25-vw94
Session takeover via Auth Proxy cache key collision
Priority LOW 37
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected.
Priority LOW 34
Docker Engine classifies a registry hostname as insecure using an any-match DNS check.
TI-2026-14269 CVE-2026-17183 · GHSA-f74r-h7qj-c63f
CVE-2026-17183 CVE Record
Priority LOW 31
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect…
Priority LOW 29
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes.
TI-2026-60056 CVE-2026-88031 · GHSA-gf3f-xg7m-h8wp
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Priority LOW 28
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…