CVE-2026-96770 | | | 2026-09-23 | All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when ski… |
CVE-2026-89139 | | | 2026-09-21 | Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose funct… |
CVE-2026-87858 | | | 2026-09-21 | Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only writ… |
CVE-2026-65654 | | | 2026-09-21 | github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not appl… |
CVE-2026-65652 | | | 2026-09-21 | github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener c… |
CVE-2026-65651 | | | 2026-09-21 | temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an app… |
CVE-2026-16652 | | | 2026-09-21 | Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission cou… |
CVE-2026-16651 | | | 2026-09-21 | temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to fi… |
CVE-2026-65655 | | | 2026-08-11 | When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected… |
CVE-2026-5724 | | | 2026-04-10 | The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary R… |
CVE-2026-5199 | | | 2026-04-01 | A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Explo… |
CVE-2025-1243 | | | 2025-02-12 | The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go modul… |
CVE-2024-2689 | Medium | 4.4 | 2024-04-03 | Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows an… |
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |