Every CVE Search/ Get API key

CVE-2026-27136

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

6.1 MediumFix available

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.22%Up 0.2 points since May 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-27136
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
EUVDEUVD-2026-31451 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
EUVD-2026-31451
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m9x8-m34x-fj9q 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree....

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
GHSA-m9x8-m34x-fj9q
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
NVD 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-27136
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
OSVBELL-CVE-2026-27136 6.1
Record
BELL-CVE-2026-27136
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.1

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-27136
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 48 moreShow less
OSVDEBIAN-CVE-2026-27136 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
DEBIAN-CVE-2026-27136
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:37072 8.7

Red Hat Security Advisory: podman security, bug fix, and enhancement update

Record
RHSA-2026:37072
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:37123 8.7

Red Hat Security Advisory: podman security, bug fix, and enhancement update

Record
RHSA-2026:37123
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42078 9.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:42078
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:42079 9.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:42079
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:42080 8.2

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

Record
RHSA-2026:42080
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:51112 8.2

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:51112
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:53412 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53412
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53413 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53413
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53415 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53415
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:59560 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:59560
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59562 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:59562
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61585 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:61585
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:62391 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:62391
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:63134 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:63134
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66432 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66561 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:66561
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67138 8.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:67138
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67139 8.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:67139
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67517 8.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:67517
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:68334 8.8

Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

Record
RHSA-2026:68334
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:69293 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:37072 8.7

Important: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

  • golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

  • golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

  • podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z] (JIRA:Rocky Linux-173842)

  • [FJ10.2 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-10.2.z] (JIRA:Rocky Linux-192440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:37072
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:37123 8.7

Important: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

  • golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

  • golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

  • podman does not clean up all files and leaves orphaned files consuming disk space [rhel-9.8.z] (JIRA:Rocky Linux-173988)

  • [FJ9.8 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-9.8.z] (JIRA:Rocky Linux-192439)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:37123
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:66432 8.2

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67138 8.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67138
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67139 8.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67139
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69293 8.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-27136 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
UBUNTU-CVE-2026-27136
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:37123 No score

Important: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
  • golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
  • golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

  • podman does not clean up all files and leaves orphaned files consuming disk space [almalinux-9.8.z] (JIRA:AlmaLinux-173988)
  • [FJ9.8 Bug]: [REG]The "podman-remote save" command fails for rootless users. [almalinux-9.8.z] (JIRA:AlmaLinux-192439)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:37123
Updated
2026-11-02
OSVALSA-2026:66432 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66432
Updated
2026-11-02
OSVALSA-2026:69293 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69293
Updated
2026-11-02
OSVAZL-111626 No score

CVE-2026-27136 affecting package kubevirt-openvmm 1.9.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-111626
Updated
2026-11-05
OSVAZL-87155 No score

CVE-2026-27136 affecting package azl-otel-collector 0.127.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87155
Updated
2026-11-05
OSVAZL-87257 No score

CVE-2026-27136 affecting package cri-o 1.30.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87257
Updated
2026-11-05
OSVAZL-87290 No score

CVE-2026-27136 affecting package podman 5.6.1-10

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87290
Updated
2026-11-05
OSVAZL-87335 No score

CVE-2026-27136 affecting package yq 4.45.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87335
Updated
2026-11-05
OSVAZL-87375 No score

CVE-2026-27136 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87375
Updated
2026-11-05
OSVAZL-87426 No score

CVE-2026-27136 affecting package cert-manager for versions less than 1.12.15-9

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87426
Updated
2026-11-05
OSVAZL-87471 No score

CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87471
Updated
2026-11-05
OSVAZL-87495 No score

CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87495
Updated
2026-11-05
OSVAZL-87507 No score

CVE-2026-27136 affecting package cni-plugins for versions less than 1.4.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87507
Updated
2026-11-05
OSVAZL-87534 No score

CVE-2026-27136 affecting package containerd2 for versions less than 2.2.4-2

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87534
Updated
2026-11-02
OSVAZL-87558 No score

CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87558
Updated
2026-11-05
OSVAZL-87582 No score

CVE-2026-27136 affecting package cri-tools for versions less than 1.32.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87582
Updated
2026-11-05
OSVAZL-87603 No score

CVE-2026-27136 affecting package dasel for versions less than 2.8.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87603
Updated
2026-11-05
OSVAZL-87615 No score

CVE-2026-27136 affecting package docker-buildx for versions less than 0.14.0-13

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87615
Updated
2026-11-05
OSVAZL-87681 No score

CVE-2026-27136 affecting package docker-compose for versions less than 2.27.0-11

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87681
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
podman
AlmaLinux:9
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-docker
AlmaLinux:9
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-plugins
AlmaLinux:9
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-remote
AlmaLinux:9
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-tests
AlmaLinux:9
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
osbuild-composer
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-core
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-worker
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer-core
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
Show 290 moreShow less
Affected packages
PackageAffectedFixed
osbuild-composer-worker
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
azl-otel-collector
Azure Linux:3
 through 0.127.0-1 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
yq
Azure Linux:3
 through 4.45.1-1 None known
application-gateway-kubernetes-ingress
Azure Linux:3
 before 1.7.7-5
1.7.7-5
cert-manager
Azure Linux:3
 before 1.12.15-9
1.12.15-9
cf-cli
Azure Linux:3
 before 8.7.11-6
8.7.11-6
cloud-provider-kubevirt
Azure Linux:3
 before 0.5.1-4
0.5.1-4
cni-plugins
Azure Linux:3
 before 1.4.0-6
1.4.0-6
containerd2
Azure Linux:3
 before 2.2.4-2
2.2.4-2
containerized-data-importer
Azure Linux:3
 before 1.62.0-6
1.62.0-6
cri-tools
Azure Linux:3
 before 1.32.0-6
1.32.0-6
dasel
Azure Linux:3
 before 2.8.1-4
2.8.1-4
docker-buildx
Azure Linux:3
 before 0.14.0-13
0.14.0-13
docker-compose
Azure Linux:3
 before 2.27.0-11
2.27.0-11
gh
Azure Linux:3
 before 2.62.0-16
2.62.0-16
influxdb
Azure Linux:3
 before 2.7.5-17
2.7.5-17
keda
Azure Linux:3
 before 2.14.1-13
2.14.1-13
kube-vip-cloud-provider
Azure Linux:3
 before 0.0.10-6
0.0.10-6
kubernetes
Azure Linux:3
 before 1.30.10-25
1.30.10-25
kubevirt
Azure Linux:3
 before 1.7.1-7
1.7.1-7
multus
Azure Linux:3
 before 4.0.2-8
4.0.2-8
packer
Azure Linux:3
 before 1.9.5-15
1.9.5-15
prometheus-adapter
Azure Linux:3
 before 0.12.0-6
0.12.0-6
sriov-network-device-plugin
Azure Linux:3
 before 3.7.0-6
3.7.0-6
telegraf
Azure Linux:3
 before 1.31.0-22
1.31.0-22
buildah
Alpaquita:23
 1.28.0-r1 and later None known
containerd
Alpaquita:23
 1.6.10-r0 and later None known
podman
Alpaquita:23
 4.3.1-r0 and later None known
runc
Alpaquita:23
 1.1.4-r3 and later None known
skopeo
Alpaquita:23
 1.10.0-r2 and later None known
buildah
Alpaquita:25
 1.40.0-r0 and later None known
containerd
Alpaquita:25
 2.1.1-r0 and later None known
docker-cli-buildx
Alpaquita:25
 0.24.0-r0 and later None known
google-guest-agent
Alpaquita:25
 20250521.00-r0 and later None known
osv-scanner
Alpaquita:25
 2.1.0-r4 and later None known
podman
Alpaquita:25
 5.5.0-r0 and later None known
rootlesskit
Alpaquita:25
 2.3.5-r0 and later None known
runc
Alpaquita:25
 1.3.0-r1 and later None known
skopeo
Alpaquita:25
 1.18.0-r2 and later None known
buildah
Alpaquita:stream
 1.31.0-r0 and later None known
calicoctl
Alpaquita:stream
 3.31.3-r0 and later None known
cilium-cli
Alpaquita:stream
 0.19.0-r12 and later None known
cni-plugins
Alpaquita:stream
 1.9.0-r2 and later None known
containerd
Alpaquita:stream
 1.7.2-r1 and later None known
cri-tools
Alpaquita:stream
 1.35.0-r2 and later None known
docker-cli-buildx
Alpaquita:stream
 0.11.0-r0 and later None known
etcd
Alpaquita:stream
 3.6.4-r6 and later None known
google-guest-agent
Alpaquita:stream
 20250214.01-r0 and later None known
grype
Alpaquita:stream
 0.100.0-r0 and later None known
helm
Alpaquita:stream
 3.19.0-r4 and later None known
osv-scanner
Alpaquita:stream
 2.1.0-r2 and later None known
podman
Alpaquita:stream
 4.5.1-r1 and later None known
rootlesskit
Alpaquita:stream
 2.1.0-r0 and later None known
runc
Alpaquita:stream
 1.1.7-r1 and later None known
skopeo
Alpaquita:stream
 1.13.0-r1 and later None known
osbuild-composer
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els7
132.2-3.el9_6.alma.1.tuxcare.els7
osbuild-composer-core
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els7
132.2-3.el9_6.alma.1.tuxcare.els7
osbuild-composer-tests
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els7
132.2-3.el9_6.alma.1.tuxcare.els7
osbuild-composer-worker
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els7
132.2-3.el9_6.alma.1.tuxcare.els7
osbuild-composer
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els8
76-2.el9_2.2.alma.tuxcare.els8
osbuild-composer-core
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els8
76-2.el9_2.2.alma.tuxcare.els8
osbuild-composer-dnf-json
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els8
76-2.el9_2.2.alma.tuxcare.els8
osbuild-composer-tests
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els8
76-2.el9_2.2.alma.tuxcare.els8
osbuild-composer-worker
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els8
76-2.el9_2.2.alma.tuxcare.els8
golang-golang-x-net
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 22 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.7.0+dfsg-1
 None known
golang-golang-x-net
Debian:13
 All versions, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 5 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1
 None known
golang-golang-x-net
Debian:14
 before 1:0.55.0-1, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+1
1:0.55.0-1
golang.org/x/net
Go
 before 0.55.0
0.55.0
podman
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-docker
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-remote
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-remote-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-tests
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-docker
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-plugins
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-plugins-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-remote
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-remote-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-tests
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:3.49.63-2.el8ap
0:3.49.63-2.el8ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:3.49.63-2.el9ap
0:3.49.63-2.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:3.1.50-1.el8ap
0:3.1.50-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:3.1.50-1.el9ap
0:3.1.50-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 1:0.25.6-1.el8ap
1:0.25.6-1.el8ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.19.12-1.el8ap
0:2.19.12-1.el8ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el9ap
0:4.10.16-1.el9ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:4.10.16-1.el9ap
0:4.10.16-1.el9ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 1:0.25.6-1.el9ap
1:0.25.6-1.el9ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.19.12-1.el9ap
0:2.19.12-1.el9ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el9ap
0:2.13.0-1.el9ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.13.0-1.el9ap
0:2.13.0-1.el9ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:0.1.34-1.el9ap
0:0.1.34-1.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 25 CVEs
 before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
 before 0:2.6.11-1.el9ap
0:2.6.11-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 14 CVEs
 before 0:4.7.14-3.el9ap
0:4.7.14-3.el9ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 14 CVEs
 before 2:2.16.19-1.el10ap
2:2.16.19-1.el10ap
ansible-core
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 14 CVEs
 before 2:2.16.19-1.el10ap
2:2.16.19-1.el10ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 14 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 14 CVEs
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
podman
Rocky Linux:10
From an advisory covering 8 CVEs
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman
Rocky Linux:9
From an advisory covering 7 CVEs
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
osbuild-composer
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2.rocky.0.1
0:165.1-5.el10_2.rocky.0.1
image-builder
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:52.1-2.el9_8
0:52.1-2.el9_8
image-builder
Rocky Linux:10
From an advisory covering 4 CVEs
 before 0:52.1-2.el10_2.rocky.0.1
0:52.1-2.el10_2.rocky.0.1
osbuild-composer
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8.rocky.0.1
0:165.1-5.el9_8.rocky.0.1
golang.org/x/net
Root:Go
 before v0.42.0-aikido.3
v0.42.0-aikido.3v0.39.0-aikido.4v0.34.0-aikido.3v0.33.0-aikido.7v0.38.0-aikido.1v0.35.0-aikido.3v0.38.0-aikido.2v0.35.0-aikido.2v0.50.0-aikido.1v0.40.0-aikido.1v0.26.0-aikido.2v0.50.0-aikido.2v0.38.0-aikido.3v0.41.0-aikido.1v0.42.0-aikido.1v0.48.0-aikido.1v0.33.0-aikido.5v0.39.0-aikido.1v0.52.0-aikido.1v0.47.0-aikido.1v0.39.0-aikido.2v0.35.0-aikido.1v0.33.0-aikido.6v0.39.0-aikido.3v0.42.0-aikido.2v0.48.0-aikido.2v0.34.0-aikido.1v0.52.0-aikido.2v0.34.0-aikido.2v0.37.0-aikido.1v0.47.0-aikido.2v0.43.0-aikido.1v0.41.0-aikido.2v0.40.0-aikido.2v0.38.0-aikido.4v0.54.0-aikido.1v0.23.0-aikido.1v0.29.0-aikido.2v0.29.0-aikido.3v0.47.0-aikido.3v0.35.0-aikido.4v0.54.0-aikido.2v0.38.0-aikido.5v0.40.0-aikido.3v0.35.0-aikido.5v0.41.0-aikido.3v0.47.0-aikido.4v0.49.0-aikido.1v0.52.0-aikido.3v0.52.0-aikido.4v0.29.0-aikido.4v0.38.0-aikido.6v0.41.0-aikido.4v0.40.0-aikido.4v0.47.0-aikido.5v0.54.0-aikido.3v0.52.0-aikido.5v0.29.0-aikido.5v0.43.0-aikido.2v0.54.0-aikido.4v0.23.0-aikido.2v0.23.0-aikido.3v0.29.0-aikido.6v0.39.0-aikido.5v0.42.0-aikido.4v0.39.0-aikido.6
rootio-golang.org/x/net
Root:Go
 before v0.42.0-root.io.3
v0.42.0-root.io.3v0.39.0-root.io.4v0.38.0-root.io.1v0.34.0-root.io.3v0.33.0-root.io.7v0.35.0-root.io.3v0.38.0-root.io.2v0.41.0-root.io.1v0.35.0-root.io.2v0.50.0-root.io.1v0.40.0-root.io.1v0.26.0-root.io.2v0.38.0-root.io.3v0.50.0-root.io.2v0.42.0-root.io.1v0.48.0-root.io.1v0.33.0-root.io.5v0.39.0-root.io.1v0.52.0-root.io.1v0.47.0-root.io.1v0.39.0-root.io.2v0.35.0-root.io.1v0.33.0-root.io.6v0.39.0-root.io.3v0.42.0-root.io.2v0.48.0-root.io.2v0.34.0-root.io.1v0.52.0-root.io.2v0.34.0-root.io.2v0.37.0-root.io.1v0.47.0-root.io.2v0.43.0-root.io.1v0.41.0-root.io.2v0.40.0-root.io.2v0.38.0-root.io.4v0.54.0-root.io.1v0.23.0-root.io.1v0.29.0-root.io.2v0.29.0-root.io.3v0.47.0-root.io.3v0.35.0-root.io.4v0.54.0-root.io.2v0.38.0-root.io.5v0.40.0-root.io.3v0.35.0-root.io.5v0.41.0-root.io.3v0.47.0-root.io.4v0.49.0-root.io.1v0.52.0-root.io.3v0.52.0-root.io.4v0.29.0-root.io.4v0.38.0-root.io.6v0.41.0-root.io.4v0.40.0-root.io.4v0.47.0-root.io.5v0.54.0-root.io.3v0.52.0-root.io.5v0.29.0-root.io.5v0.43.0-root.io.2v0.54.0-root.io.4v0.23.0-root.io.2v0.23.0-root.io.3v0.29.0-root.io.6v0.39.0-root.io.5v0.42.0-root.io.4v0.39.0-root.io.6
elemental-toolkit
SUSE:Linux Micro 6.0
From an advisory covering 19 CVEs
 before 2.1.6-1.1
2.1.6-1.1
elemental-operator
SUSE:Linux Micro 6.0
From an advisory covering 9 CVEs
 before 1.6.11-1.1
1.6.11-1.1
elemental-toolkit
SUSE:Linux Micro 6.1
From an advisory covering 19 CVEs
 before 2.2.9-slfo.1.1_1.1
2.2.9-slfo.1.1_1.1
elemental-operator
SUSE:Linux Micro 6.1
From an advisory covering 9 CVEs
 before 1.7.5-slfo.1.1_1.1
1.7.5-slfo.1.1_1.1
mcphost
SUSE:Linux Enterprise Server 16.0
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
mcphost
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
mcphost
SUSE:Linux Micro 6.2
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
alloy
SUSE:Linux Enterprise Server 16.0
From an advisory covering 26 CVEs
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 26 CVEs
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
cosign
SUSE:Linux Enterprise Server 16.0
From an advisory covering 19 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
cosign
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 19 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 25 CVEs
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 25 CVEs
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-QubitProducts-exporter_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.4.0-150002.3.6.2
0.4.0-150002.3.6.2
golang-github-boynux-squid_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.13.0-150002.3.6.2
1.13.0-150002.3.6.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.0.10-150002.3.9.2
1.0.10-150002.3.9.2
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.28.1-150002.4.11.1
0.28.1-150002.4.11.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 3.5.3-150002.3.13.1
3.5.3-150002.3.13.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 11.6.14+security04-150002.4.21.1
11.6.14+security04-150002.4.21.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.4-150002.3.9.1
5.2.4-150002.3.9.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.26.0-150002.3.11.1
0.26.0-150002.3.11.1
prometheus-postgres_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.10.1-150002.3.3.2
0.10.1-150002.3.3.2
python-defusedxml-sle15
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 0.7.1-150002.1.3.1
0.7.1-150002.1.3.1
rhnlib
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.9.1
5.2.5-150002.3.9.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.8-150002.3.12.1
5.2.8-150002.3.12.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.6-150002.3.9.1
5.2.6-150002.3.9.1
supportutils-plugin-salt
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 1.2.3-150002.3.3.1
1.2.3-150002.3.3.1
supportutils-plugin-susemanager-client
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.3-150002.3.9.1
5.2.3-150002.3.9.1
uyuni-common-libs
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.5-150002.3.6.1
5.2.5-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 22 CVEs
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 27 CVEs
 before 1.17.1-150700.15.23.1
1.17.1-150700.15.23.1
cosign
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 19 CVEs
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 21 CVEs
 before 1.7.4-150700.3.30.1
1.7.4-150700.3.30.1
kubevirt-1.6
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 16 CVEs
 before 1.6.6-150700.15.17.1
1.6.6-150700.15.17.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 22 CVEs
 before 12.4.5-150200.3.91.1
12.4.5-150200.3.91.1
containerized-data-importer
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 27 CVEs
 before 1.64.0-150700.9.14.1
1.64.0-150700.9.14.1
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
 None known
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
 None known
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
 None known
rclone
openSUSE:Tumbleweed
From an advisory covering 23 CVEs
 before 1.74.2-1.1
1.74.2-1.1
mcphost
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.34.0-8.1
0.34.0-8.1
yq
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 4.53.2-2.1
4.53.2-2.1
trivy
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 0.71.0-1.1
0.71.0-1.1
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
cosign
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 3.1.1-1.1
3.1.1-1.1
gomuks
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 26.03+git.1780250926.564a8707-1.1
26.03+git.1780250926.564a8707-1.1
containerized-data-importer1.65
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 1.65.0-2.1
1.65.0-2.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 1.8.4-2.1
1.8.4-2.1
containerized-data-importer1.66
openSUSE:Tumbleweed
From an advisory covering 12 CVEs
 before 1.66.0-1.1
1.66.0-1.1
kubevirt1.9
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 1.9.0-1.1
1.9.0-1.1
trivy
openSUSE:Leap 16.0
From an advisory covering 21 CVEs
 before 0.71.0-160000.1.1
0.71.0-160000.1.1
neonmodem
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.0.7+git0.346d1d3-bp160.1.1
1.0.7+git0.346d1d3-bp160.1.1
grafana
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 11.6.14+security04-bp160.2.1
11.6.14+security04-bp160.2.1
mcphost
openSUSE:Leap 16.0
From an advisory covering 20 CVEs
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
alloy
openSUSE:Leap 16.0
From an advisory covering 26 CVEs
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
hauler
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 2.0.1-bp160.1.1
2.0.1-bp160.1.1
cosign
openSUSE:Leap 16.0
From an advisory covering 19 CVEs
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
lux
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 0.24.1-bp160.1.1
0.24.1-bp160.1.1
rclone
openSUSE:Leap 16.0
From an advisory covering 37 CVEs
 before 1.74.4-bp160.1.1
1.74.4-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1
kubevirt1.8
openSUSE:Leap 16.0
From an advisory covering 25 CVEs
 before 1.8.4-160000.1.1
1.8.4-160000.1.1
glab
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 1.114.0-bp160.1.1
1.114.0-bp160.1.1
containerized-data-importer1.65
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 1.65.0-160000.3.1
1.65.0-160000.3.1

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27136 is a medium vulnerability (CVSS 6.1) in Golang Net, published May 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in application-gateway-kubernetes-ingress 1.7.7-5.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 102 package rows and 2,324 references. The JSON record has them. Also not on the record: 10 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 59 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open