ROOT-APP-GOBINARY-CVE-2026-25681 CVE-2026-25681 in golang.org/x/net - Patched by Root

Root has patched CVE-2026-25681 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-27136 CVE-2026-27136 in golang.org/x/net - Patched by Root

Root has patched CVE-2026-27136 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-42502 CVE-2026-42502 in golang.org/x/net - Patched by Root

Root has patched CVE-2026-42502 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-22870 CVE-2025-22870 in golang.org/x/net - Patched by Root

Root has patched CVE-2025-22870 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-58181 CVE-2025-58181 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2025-58181 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-42508 CVE-2026-42508 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-42508 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39834 CVE-2026-39834 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39834 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39832 CVE-2026-39832 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39832 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39827 CVE-2026-39827 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39827 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39829 CVE-2026-39829 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39829 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

UBUNTU-CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, U...

GO-2026-6238 Integer overflow in BTF parsing in github.com/cilium/ebpf

Integer overflow in BTF parsing in github.com/cilium/ebpf...

GO-2026-6166 WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS...

CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

UBUNTU-CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-49349

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

UBUNTU-CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

Security Bulletin: Sterling Order Management System Software, (On prem)

Summary Multiple vulnerabilities were addressed in Sterling Order Management System Software, On prem : 10.0.2607.0-Sterling-SSFF-All-Major-Update-Installer Vulnerability Details CVEID:CVE-2026-48978 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client...

github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...