CLEANSTART-2026-KB59270 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...

CLEANSTART-2026-NF29170 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-24051 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-XR21896 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-UX70251 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-41178 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-UJ30602 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-DX35599 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-HZ96521 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-HL09755 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the temporal-server-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-QF95955 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the kube-state-metrics-fips package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-XR03943 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the gotenberg package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-SJ52043 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the external-dns package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-LW29584 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-XM93571 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-34986 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerability...

CLEANSTART-2026-SS30538 Echo is a Go web framework

CVE-2026-55677 affects multiple packages. Echo is a Go web framework. See references for individual vulnerability details...

PT-2026-108040

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

PT-2026-108317

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A flaw exists where a user working within a malicious project that defines a fake golang.org/fips140 module and utilizes a malicious GOMODPROXY could be served an arbitrary module in place of the...

PT-2026-108318

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A flaw exists where a user working within a malicious project can bypass the intended checksum verification. This occurs when the project defines a bogus golang.org/toolchain entry in the go.sum...

RHEL 9 : opentelemetry-collector (RHSA-2026:76744)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76744 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: google.golang.org/grpc: gRPC-Go: Denial of Service via...

PT-2026-108144

Name of the Vulnerable Software and Affected Versions MongoDB Go Driver affected versions not specified Description Improper validation of a BSON array length can lead to an out-of-bounds index and runtime panic. This occurs when an application invokes the bson.RawArray.Validate or...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:76744)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:76744 advisory. google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 Tenable has extracted the preceding description block directly from...