CVE-2026-24137

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from...

GO-2026-4308 Shiori is vulnerable to authentication bypass via a brute force attack in github.com/go-shiori/shiori

Shiori is vulnerable to authentication bypass via a brute force attack in github.com/go-shiori/shiori...

GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve

Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve...

CVE-2025-1243

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1386

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream...

GO-2025-4250 Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go

Amazon S3 Encryption Client has a Key Commitment Issue in github.com/aws/amazon-s3-encryption-client-go...

CLSA-2025-1766233299 go-rpm-macros: Fix of CVE-2025-47906

CVE-2025-47906: fix unexpected paths returned from LookPath in os/exec...

CVE-2025-64702 quic-go HTTP/3 QPACK Header Expansion DoS

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section many unique header...

SMTP Command-smuggling

github.com/wneessen/go-mail is vulnerable to SMTP command-smuggling. The vulnerability is due to incorrect handling of mail.Address values when constructing the MAIL FROM and RCPT TO SMTP commands, which allows an attacker to smuggle extra ESMTP parameters or manipulate recipient routing by...

Denial of Service (DoS)

Overview github.com/dvsekhvalnov/jose2go is a Pure Golang GO library for generating, decoding and encrypting JSON Web Tokens. Zero dependency, relies only on standard library. Affected versions of this package are vulnerable to Denial of Service DoS via the processing of crafted JSON Web Encrypti...

CVE-2025-64346 archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

archives is a Go library for extracting archives tar, zip, etc.. Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the...

EUVD-2015-5687

Malware in sbrugna...

EUVD-2024-2999

Malicious code in bioql PyPI...

EUVD-2023-2549

Malicious code in bioql PyPI...

EUVD-2025-10732

Malicious code in bioql PyPI...

EUVD-2025-0090

Malicious code in bioql PyPI...

EUVD-2025-2097

Malicious code in bioql PyPI...

EUVD-2025-10405

Malicious code in bioql PyPI...

EUVD-2025-10404

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2023-50658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value. CVE-2023-50658 No...