Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-19585

Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Shared Library
CVE-2026-88922

Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Shared Library
CVE-2026-14362

Denial of service via crafted push/pull gossip message in memberlist

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Shared Library
CVE-2026-8052

Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack

HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Shared Library
CVE-2026-0969

Arbitrary code execution in React server-side rendering of untrusted MDX content

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Shared Library