capslock

Capslock is a capability analysis CLI for Go packages that informs users of which privileged operations a given package can access. This works by classifying the capabilities of Go packages by following transitive calls to privileged standard library operations. The recent increase in supply chai...

golang-x-text

Go Text This repository holds supplementary Go packages for text processing, many involving Unicode. CLDR Versioning It is important that the Unicode version used in x/text matches the one used by your Go compiler. The x/text repository supports multiple versions of Unicode and will match the...

RHEL 8 : osbuild-composer (RHSA-2026:67148)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67148 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

AlmaLinux 10 : git-lfs (ALSA-2026:64788)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:64788 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-39883 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin iore...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.57 security and extras update

Red Hat OpenShift Container Platform release 4.17.57 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...

RHCOS 4 : OpenShift Container Platform 4.17.57 (RHSA-2026:60018)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60018 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

GO-2026-6293 vulnerabilities

Vulnerabilities for packages: listmonk, temporal-fips, falcosidekick-ui-fips, kube-metrics-adapter, temporal-ui-server-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter-fips...

GO-2026-6255 vulnerabilities

Vulnerabilities for packages: skaffold, kubescape-server-fips, trivy-fips, scorecard, trivy-operator-fips, conftest, cloudbeat, livekit-cli, docker-fips, conftest-fips, cloudbeat-fips, kubescape-server, trivy, kaniko-fips, kubescape, podman, podman-fips, zot, guac, skaffold-fips, kaniko...

RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

RHEL 9 : osbuild-composer (RHSA-2026:57541)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57541 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: glab, livekit-cli, opencost-fips, flux-operator, ferretdb, gitlab-workhorse-ce-fips, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, gitlab-workhorse-ce, opencost, datadog-agent, jaeger-fips...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: terraform-docs, k3d, gomplate, vcluster, conftest, dex, certificate-transparency-fips, falcosidekick, spire-server-fips, spegel, conftest-fips, cloudnative-pg, osv-scanner, trivy, falcosidekick-fips, dbmate, smarter-device-manager-fips, sigstore-scaffolding-fips,...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, nemo, chainloop-cli, packer-fips, terragrunt-fips, rclone, gitlab-rails-ce-fips, scorecard, external-secrets-operator, grafana, seaweedfs-rocksdb-fips, telegraf, gitlab-rails-ce, syft-fips, cerbos, rancher-fleet-fips, flux-fips, terragrunt,...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: spire-server, wolfictl, dagger, buf, aactl, conftest, ctop, cadvisor-fips, loki, up, prometheus, cilium-cli, spire-server-fips, melange, grype, conftest-fips, ko, trivy, docker-compose, cadvisor, syft, kubescape, buildkitd, kargo, zot, tkn, crossplane, kaniko...

GO-2026-5851 vulnerabilities

Vulnerabilities for packages: spire-server, tflint-fips, neuvector-sigstore-interface, ratify-fips, aactl, kubescape-server-fips, image-factory-fips, tbot, policy-controller, trivy-fips, kyverno-notation-aws-fips, falcoctl-fips, kyverno-notation-aws, falcoctl, trivy-operator-fips, zarf-fips,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: skaffold, spire-server, wolfictl, neuvector-sigstore-interface, slsa-verifier, aactl, apko, policy-controller, falcoctl-fips, falcoctl, flux-source-controller, vexctl, gitsign, spire-server-fips, ko-fips, tekton-chains-fips, melange, tkn-fips, ko, tekton-chains,...

GO-2025-3887 vulnerabilities

Vulnerabilities for packages: k8sgpt, kots, k8ssandra-client, eksctl, flux-helm-controller, rancher-fleet, chartmuseum, helm-set-status, helm-mapkubeapis, helm-push, flux-source-controller, envoy-gateway, cert-manager-cmctl, pluto, trivy, helm-operator, zarf, flux, linkerd2,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: apko, policy-controller, neuvector-sigstore-interface, slsa-verifier, vexctl, ko, flux-source-controller, tkn, falcoctl, zarf, aactl, spire-server, tekton-chains, goreleaser, kubescape, wolfictl, skaffold, zot, melange, gitsign...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...