opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0

Vulnerabilities (1,722)

• CVE-2026-41131MedApr 22, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlie

• CVE-2026-41059HigApr 22, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authentication bypass. Deployments are affected when all of the following are true: Use of `skip_auth_routes` or the legacy `skip_auth

• CVE-2026-40575CriApr 22, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route` is configured. An attacker can

• CVE-2026-40343MedApr 22, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST

• CVE-2026-40946CriApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens

• CVE-2026-40945HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation

• CVE-2026-40944MedApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first cer

• CVE-2026-40943HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and u

• CVE-2026-40938HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch withou

• CVE-2026-40924MedApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size

• CVE-2026-40923MedApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tek

• CVE-2026-40910MedApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the rou

• CVE-2026-40885HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is

• CVE-2026-40884CriApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not

• CVE-2026-40883HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete an

• CVE-2026-40876HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail bou

• CVE-2026-33813HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

• CVE-2026-33812MedApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Parsing a malicious font file can cause excessive memory allocation.

• CVE-2026-40868HigApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authoriza

• CVE-2026-40574MedApr 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization bypass exists in OAuth2 Proxy as part of the email_domain enforcement option. An attacker may be able to authenticate with an email claim such as [email protected]