EUVD-2026-95418

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...

CVE-2026-94447

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...

CVE-2026-94447

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...

CVE-2026-94444

The Go toolchain (specifically cmd/go ) is vulnerable to a checksum bypass regarding the golang.org/fips140 module. A user operating within a malicious Go project that defines a bogus golang.org/fips140 dependency and utilizes a malicious GOMODPROXY could serve an arbitrary module in its place. T...

IOBitUnlockerUnlocker

概要 0day 任意のファイルを移動またはコピーします。チェックサムのトリックにより、以前のパッチを回避します。 解説: https://nathan2.com/files/iobit.pdf 全体情報: https://nathan2.com/posts/iobit/ 私は、この脆弱性が以前に別のエクスプロイトとして発見されていたことを知らずに発見しました。ただし、これはIObitが施したパッチを回避するものです。バージョン1.3.0で動作します。 使用方法:...

CVE-2025-66676

CVE-2025-66676 IOBit Unlocker 1.3.0.11 및 이전 버전에서, 애플리케이션이 파일 잠금 해제를 시도함으로써 임의의 프로세스를 종료할 수 있습니다. 배경 이 애플리케이션은 잠금 해제된 파일의 잠금을 해제하는 데 사용됩니다. 실행 중인 프로세스의 프로세스 이미지 파일을 잠긴 파일로 지정하면, IOBit Unlocker는 커널 모드에서 해당 실행 중인 프로세스프로세스 이미지 파일을 '잠근' 프로세스를 종료하려고 시도합니다. 체크섬을 사용하여 임의의 프로세스가 드라이버와 상호작용하는 것을 방지하는 간단한 제...

CLEANSTART-2026-QP25328 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the loki package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

Astra Linux - Vulnerability in Golang-1.23

A malicious module proxy can exploit a flaw in the go command’s validation of module checksums to bypass the checksum database validation process. This vulnerability affects any user who uses a trusted module proxy GOMODPROXY or a checksum database GOSUMDB. A malicious module proxy can serve...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

EUVD-2026-58684

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2885)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-46353

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-46353

BigBlueButton vulnerability CVE-2026-46353 affects the bbb-web component. Before version 3.0.21, checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send vali...

EUVD-2026-44998

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

PT-2026-60543

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...