go-mal-pkgs

go-mal-pkgs Go Module Proxy キャッシュをバイパスし、go.sum のチェックサムを元のソースコードと照合して、悪意のある Go パッケージを検出するセキュリティツールです。 概要 このツールは、最近悪意のある github.com/boltdb-go/bolt パッケージで実証されたように、Go Module Proxy キャッシュを悪用したサプライチェーン攻撃から保護するのに役立ちます。 これらの攻撃は、Go Module Proxy の無期限キャッシュ機構を悪用し、ソースリポジトリが浄化された後でも悪意のあるコードを配信します。...

CVE-2022-44877

使用 go-exploit 模块 当模块模式关闭时 root@kitploit: go get github.com/vulncheck-oss/go-exploit 当模块模式开启时 root@kitploit: go mod init example.com/myapp go get github.com/vulncheck-oss/go-exploit 构建 root@kitploit: go build -o cve-2022-44877 main.go...

ROOT-APP-GOBINARY-CVE-2026-56865 CVE-2026-56865 in golang.org/x/mod - Patched by Root

Root has patched CVE-2026-56865 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available...

BIT-GOLANG-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

SUSE CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

GO-2024-2907 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2020-0015 vulnerabilities

Vulnerabilities for packages: k3d, vt-cli...

GO-2023-1795 vulnerabilities

Vulnerabilities for packages: aactl, skaffold...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: flux-source-controller, flux-kustomize-controller, argo-workflows, tkn, aactl, tekton-chains, cosign, sops, bank-vaults-fips, slsa-verifier, cloudflared, kots, terragrunt, fulcio, vexctl, rekor, gitsign, fulcio-fips, kubescape, oauth2-proxy, falcoctl-fips,...

GO-2025-3848 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

Linux Distros Unpatched Vulnerability : CVE-2026-56864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and...

AZL-96647 CVE-2026-56865 affecting package golang 1.25.12-1

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

UBUNTU-CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

EUVD-2026-58513

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint

Private Repository Existence Disclosure via go-get Meta Endpoint...

PT-2026-71900

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A malicious GOSUMDB can serve arbitrary module content that is not present in the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client,...

SUSE-SU-2026:3480-1 Security update for kubevirt

This update for kubevirt fixes the following issues: - Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: CVE-2026-39821 bsc1266575: the previous entry claimed this fixed by the golang.org/x/net v0.55.0...

GO-2026-5891 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico

Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...

GO-2026-5821 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...

ROOT-APP-GOBINARY-CVE-2026-53488 CVE-2026-53488 in rootio-github.com/containerd/containerd/v2 - Patched by Root

Root has patched CVE-2026-53488 in the rootio-github.com/containerd/containerd/v2 package for Root:Go. Multiple fixed versions available...