EUVD-2024-1387

Malicious code in bioql PyPI...

EUVD-2022-7731

Malicious code in bioql PyPI...

EUVD-2023-2602

Malicious code in bioql PyPI...

Security Bulletin: Vulnerability in go package in nginx-controller affects IBM Db2 Data Management Console

Summary go package in nginx-controller open source library is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2023-24532 DESCRIPTION: An unspecified error with return an incorrect result in the...

Possible private key restoration in go package github.com/ecies/go

...

CVE-2025-58058

CVE-2025-58058 — xz (Go) memory allocation issue : The xz library (Go implementation) prior to 0.5.14 can allocate the full LZMA decoding buffer immediately after reading the header, before detecting improper data prepending to the stream. The LZMA header lacks a mandatory magic/checksum to catch...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the SelectListByPage function in the DictTypeDao.go file when processing the orderByColumn and isAsc arguments. An attacker can execute arbitrary SQL commands by supplying crafted input to these parameters. Remediation...

Malicious code in @zalastax/nolb-go_ (npm)

The package @zalastax/nolb-go was found to contain malicious code...

MAL-2025-39601 Malicious code in xdh-go (npm)

The package xdh-go was found to contain malicious code...

Malicious Package

Overview github.com/wetteepee/hcloud-ip-floater is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate package...

Malicious Package

Overview github.com/cavernouskina/mcp-go is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate packages. Upon...

OPENSUSE-SU-2025:15422-1 go1.23-1.23.12-1.1 on GA media

These are all security issues fixed in the go1.23-1.23.12-1.1 package on the GA media of openSUSE Tumbleweed...

Security Bulletin: IBM Maximo Application Suite uses multiple nodejs and go packages which is vulnerable to " CVE-2025-27152, CVE-2025-32996, CVE-2025-32997, CVE-2025-22871"

Summary IBM Maximo Application Suite uses " axios, http-proxy-middleware and net/http package " which is vulnerable to "CVE-2025-27152, CVE-2025-32996, CVE-2025-32997, CVE-2025-22871". This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details...

CBL Mariner 2.0 Security Update: golang (CVE-2025-25199)

The version of golang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-25199 advisory. - go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to comm...

OPENSUSE-SU-2025:15223-1 go1.23-1.23.10-1.1 on GA media

These are all security issues fixed in the go1.23-1.23.10-1.1 package on the GA media of openSUSE Tumbleweed...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when processing malformed data. An attacker can access sensitive information by submitting specially crafted malformed input that causes error messages to include confidential data in...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

TencentOS Server 3: git-lfs (TSSA-2023:0145)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0145 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

AZL-63735 CVE-2025-4673 affecting package golang for versions less than 1.23.10-1

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...