Skip to content

Commit 6b837cb

Browse files
jitsu-netgopherbot
jitsu-net
authored and
gopherbot
committed
data/reports: add 6 reports
 - data/reports/GO-2026-6296.yaml - data/reports/GO-2026-6297.yaml - data/reports/GO-2026-6298.yaml - data/reports/GO-2026-6299.yaml - data/reports/GO-2026-6300.yaml - data/reports/GO-2026-6301.yaml Fixes #6296 Fixes #6297 Fixes #6298 Fixes #6299 Fixes #6300 Fixes #6301 Change-Id: I2146be46353395fb4cf7adcdff553cddbcdcdcb5 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/823164 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ian Alexander <jitsu@google.com> Reviewed-by: Ethan Lee <ethanalee@google.com>
1 parent 9089e97 commit 6b837cb

12 files changed

Lines changed: 547 additions & 0 deletions

‎data/osv/GO-2026-6296.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2026-6296",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2026-54523",
8+
"GHSA-79gf-7frw-68m9"
9+
],
10+
"summary": "Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno",
11+
"details": "Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/kyverno/kyverno",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.18.0"
24+
},
25+
{
26+
"fixed": "1.18.2"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"
38+
},
39+
{
40+
"type": "FIX",
41+
"url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"
46+
},
47+
{
48+
"type": "FIX",
49+
"url": "https://github.com/kyverno/kyverno/pull/16238"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"
58+
}
59+
],
60+
"database_specific": {
61+
"url": "https://pkg.go.dev/vuln/GO-2026-6296",
62+
"review_status": "UNREVIEWED"
63+
}
64+
}

‎data/osv/GO-2026-6297.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2026-6297",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2026-50879",
8+
"GHSA-g743-m6x3-v6wm"
9+
],
10+
"summary": "linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request in github.com/andreimarcu/linx-server",
11+
"details": "linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request in github.com/andreimarcu/linx-server",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/andreimarcu/linx-server",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-g743-m6x3-v6wm"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50879"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://gist.github.com/pyuysig/807d92e6d8e7648d140d004f3b54b08b"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2026-6297",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2026-6298.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2026-6298",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2026-54563",
8+
"GHSA-w5fv-7x5q-g8qp"
9+
],
10+
"summary": "Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve",
11+
"details": "Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/cloudreve/Cloudreve",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/cloudreve/Cloudreve/v3",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {}
46+
},
47+
{
48+
"package": {
49+
"name": "github.com/cloudreve/Cloudreve/v4",
50+
"ecosystem": "Go"
51+
},
52+
"ranges": [
53+
{
54+
"type": "SEMVER",
55+
"events": [
56+
{
57+
"introduced": "0"
58+
},
59+
{
60+
"fixed": "4.0.0-20260606032813-26b6b1044b02"
61+
}
62+
]
63+
}
64+
],
65+
"ecosystem_specific": {}
66+
}
67+
],
68+
"references": [
69+
{
70+
"type": "ADVISORY",
71+
"url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp"
72+
},
73+
{
74+
"type": "ADVISORY",
75+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54563"
76+
},
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/cloudreve/cloudreve/releases/tag/4.16.1"
80+
}
81+
],
82+
"database_specific": {
83+
"url": "https://pkg.go.dev/vuln/GO-2026-6298",
84+
"review_status": "UNREVIEWED"
85+
}
86+
}

‎data/osv/GO-2026-6299.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2026-6299",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2026-50884",
8+
"GHSA-5442-mh7f-72px"
9+
],
10+
"summary": "statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng",
11+
"details": "statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/statping-ng/statping-ng",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-5442-mh7f-72px"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50884"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://gist.github.com/pyuysig/72acb62a9973fa394581f662c0f12704"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2026-6299",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2026-6300.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2026-6300",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2026-50891",
8+
"GHSA-rcqf-cpv9-g5jf"
9+
],
10+
"summary": "Filestash allows attackers to escalate privileges via sending a crafted request in github.com/mickael-kerjean/filestash",
11+
"details": "Filestash allows attackers to escalate privileges via sending a crafted request in github.com/mickael-kerjean/filestash",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mickael-kerjean/filestash",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-rcqf-cpv9-g5jf"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50891"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://gist.github.com/pyuysig/50dc365f54f95396bb67532f02b34bb0"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2026-6300",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

0 commit comments

Comments
 (0)