GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoverycontrolconfig-fips, helmfile, apm-server-fips, nifikop-fips, k8sgateway-fips, cloud-provider-azure-fips, crossplane-function-go-templating-fips, kubevela, juicefs, crossplane-provider-aws-organizations-fips, sops-fips,...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: hugo-extended, chainctl, ollama, gotenberg, hugo...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: gomplate, crossplane-provider-aws-lambda, policy-controller, gitness, gitsign, kubevela, pulumi-kubernetes-operator, pulumi, pulumi-language-yaml, flux-kustomize-controller, crossplane-provider-aws-cloudformation, flux-notification-controller,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: karpenter, envoy-gateway, renovate, vault-k8s, datadog-agent, coredns, atlantis, apisix-ingress-controller, kube-arangodb, regclient, gitlab-kas, opencost, osv-scanner, cadvisor, go, secrets-store-csi-driver-provider-azure, tigera-operator, spire-server, wireguard-go...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, crossplane-provider-aws-firehose, datadog-agent, crossplane-provider-aws-cloudfront, nuclei, tempo, crossplane-provider-family-aws, crossplane-provider-aws-dynamodb, crossplane-provider-azure-sql, crossplane-provider-aws-sns,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: nri-redis, argo-workflows, trivy, nri-haproxy, shfmt, scorecard, rabbitmq-cluster-operator, slsa-verifier, kaf, redka, ghaudit, tekton-chains, ksops, rclone, docker-credential-gcr, mkcert, mockery, ollama, kubernetes-ingress-defaultbackend, vault-k8s,...

UBUNTU-CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content no...

EUVD-2026-58514

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

JetBrains GoLand < 2026.2 Multiple Vulnerabilities

The version of JetBrains GoLand installed on the remote host is prior to 2026.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration CVE-2026-64802 - In...

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

EUVD-2026-48227

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-64802

Technical details about CVE-2026-64802 are not publicly provided in the supplied documents. Monitor for updates from JetBrains and NVD; no specifics on affected versions, vectors, or fixes are available here.

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

PT-2026-63956

Name of the Vulnerable Software and Affected Versions JetBrains GoLand versions prior to 2026.2 Description Arbitrary code execution is possible within the Go Modules integration before the user grants project trust. Recommendations Update JetBrains GoLand to version 2026.2...

GO-2026-5953 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

DEBIAN-CVE-2026-50135

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat follows symlinks instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount e.g. a...

SUSE-SU-2026:2765-1 Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Security issue fixed: - CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-lusitaniae-apacheexporter: - Non customer facing changes...

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...

SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:2493-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2493-1 advisory. - Security: re-vendor Go dependencies to address CVEs tracked against containerized-data-importer backport of upstream PR 4110,...

GO-2026-5708 Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana

Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...