GO-2026-4770 vulnerabilities

Vulnerabilities for packages: jaeger, jaeger-fips, opencost-fips, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, datadog-agent-fips, ferretdb, flux-operator, glab, livekit-cli, osv-scanner, flux-operator-fips, datadog-agent, opencost...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: hubble-ui, dagger, k8sgpt, pulumi-language-dotnet, spire-server, smarter-device-manager-fips, falcosidekick, fulcio, temporal-fips, external-secrets-fips, cloudnative-pg-fips, trivy, terragrunt, grafana-agent-operator, ferretdb, kaniko, gomplate, step-ca,...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, nemo, gitaly, external-secrets-operator-fips, rclone, syft, kyverno-fips, argo-cd, flux-fips, seaweedfs-rocksdb, terragrunt-fips, grafana-fips, amazon-ssm-agent, teleport, upwind-agent, chainloop-cli, cerbos, skaffold-fips, packer-fips, cerbos-fip...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: cilium-cli, ctop, loki, aactl, dagger, spire-server-fips, buf, conftest-fips, spire-server, syft, grype, zot, melange, kubescape, kargo, ko, docker-compose, wolfictl, conftest, cadvisor-fips, trivy, tkn, up, buildkitd, prometheus, cadvisor, crossplane, kaniko...

GO-2026-5851 vulnerabilities

Vulnerabilities for packages: trivy-fips, neuvector-sigstore-interface, tkn-fips, kyverno-notation-aws-fips, tflint-fips, aactl, chainctl, ratify-fips, spire-server-fips, neuvector-sigstore-interface-fips, teleport-operator-fips, goreleaser, image-factory-fips, spire-server, kyverno-fips,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: vexctl, tkn-fips, aactl, chainctl, spire-server-fips, goreleaser, flux-source-controller, spire-server, tekton-chains-fips, zot, melange, kubescape, skaffold, policy-controller-fips, ko, wolfictl, apko, ko-fips, policy-controller, falcoctl, tkn, tekton-chains, zarf,...

GO-2025-3887 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, linkerd2, envoy-gateway, helm-push, zot, k9s, headlamp, tw, helm-set-status, chart-testing, nova, helm-docs, helm-operator, trivy, istio, rancher-fleet, helm-mapkubeapis, chartmuseum, pluto, zarf, cerbos, k8ssandra-client, kubescape,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: zot, neuvector-sigstore-interface, tekton-chains, ko, tkn, policy-controller, gitsign, aactl, slsa-verifier, spire-server, apko, wolfictl, zarf, kubescape, skaffold, goreleaser, flux-source-controller, vexctl, melange, falcoctl...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-1242:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1242:01 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE:...

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps...

Critical Photon OS Security Update - PHSA-2026-5.0-0869

Updates of 'docker-compose', 'coredns', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2026-5.0-92-0869

Updates of 'go' packages of Photon OS have been released...

ALSA-2026:8841 Important: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url...

ALSA-2026:3669 Important: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: golang: net/url: Memory exhaustion in query parameter parsing i...

Critical Photon OS Security Update - PHSA-2026-4.0-0968

Updates of 'vim', 'linux', 'go' packages of Photon OS have been released...

MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-195:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-195:01 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

Moderate: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: os/exec: Unexpected paths returned from LookPath in os/exec...

CVE-2025-47912

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...

RLSA-2025:13941 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: Go VCS Command Execution Vulnerability CVE-2025-4674 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages...