OpenBao EUVD-2026-85520

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there

Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by

Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and

Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re

Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a

Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa

Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash

Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker

Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r