GO-2026-6601 Checksum bypass for golang.org/fips140 in cmd/go

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...

CVE-2026-80811

A flaw was found in the Linux kernel's iouring/cmd component. This vulnerability allows for a memory leak due to iovec arrays not being properly freed when asynchronous commands are not recycled. An attacker could potentially exploit this by triggering specific workloads, such as NVMe passthrough...

CLEANSTART-2026-IF00623 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

Security vulnerability affects the go1.27 package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...

PT-2026-106550

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2 load cmd boundary check tpm2 load cmd does boundary checks against the ASN.1 size i.e., payload-blob len. Address this by passing the decoded blob size to tpm2 load cmd, and use it for the boundary checks...

GHSA-X6JW-M9V5-85VH simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...

simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...

EUVD-2026-89334

simple-git unsafe-operation guard does not block trailer command configuration...

CVE-2026-105389

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

EUVD-2026-92774

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

PT-2026-106203

Name of the Vulnerable Software and Affected Versions feelec-yishu feelcrm-os version 1.0.0 Description An issue in the UploadTicketFile endpoint within the file App/Feelcrm/Crm/Controller/UploadController.class.php allows for unrestricted file upload. This occurs when the cmd argument is...

CVE-2026-105389: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (crlsa-2025_13935)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202513935 advisory. cmd/go: Go VCS Command Execution Vulnerability CVE-2025-4674 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note th...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2025_13940)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202513940 advisory. cmd/go: Go VCS Command Execution Vulnerability CVE-2025-4674 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note th...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl (CENTOS6:CLSA-2026:1781253209)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781253209 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

Rocky Linux 10.1 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_5941)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20265941 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1767970357)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1767970357 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

Rocky Linux 10.1 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_2706)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262706 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1775040432)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775040432 advisory. - Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...