143 matches found
capslock
Capslock is a capability analysis CLI for Go packages that informs users of which privileged operations a given package can access. This works by classifying the capabilities of Go packages by following transitive calls to privileged standard library operations. The recent increase in supply chai...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.57 security and extras update
Red Hat OpenShift Container Platform release 4.17.57 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...
golang-x-text
Go Text يحتوي هذا المستودع على حزم Go تكميلية لمعالجة النصوص، العديد منها يتعلق بـ Unicode. إصدارات CLDR من المهم أن تتطابق نسخة Unicode المستخدمة في x/text مع تلك المستخدمة بواسطة مترجم Go الخاص بك. يدعم مستودع x/text إصدارات متعددة من Unicode وسيطابق نسخة Unicode مع نسخة مترجم Go. في الوقت الحا...
GO-2026-6293 vulnerabilities
Vulnerabilities for packages: temporal-fips, listmonk, kube-metrics-adapter, falcosidekick-ui, temporal-ui-server-fips, falcosidekick-ui-fips, temporal-ui-server, kube-metrics-adapter-fips, temporal...
GO-2026-6255 vulnerabilities
Vulnerabilities for packages: kubescape-server, conftest-fips, podman, cloudbeat, trivy-fips, livekit-cli, kaniko-fips, cloudbeat-fips, kaniko, podman-fips, scorecard, skaffold-fips, kubescape, trivy, guac, conftest, skaffold, kubescape-server-fips, zot, trivy-operator-fips...
RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...
RHEL 9 : osbuild-composer (RHSA-2026:57541)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57541 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...
GO-2026-4770 vulnerabilities
Vulnerabilities for packages: ferretdb, glab, opencost, datadog-agent, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, opencost-fips, jaeger, osv-scanner, flux-operator, flux-operator-fips, jaeger-fips, datadog-agent-fips, livekit-cli...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: hubble-ui-backend-fips, k3s, sigstore-scaffolding-fips, step-ca, step-ca-fips, spire-server-fips, sigstore-scaffolding, ferretdb, guac, grpc-health-probe-fips, k8sgpt, cert-manager-cmctl, spire-server, cloud-sql-proxy-fips, smarter-device-manager-fips, hubble-ui,...
GO-2026-5597 vulnerabilities
Vulnerabilities for packages: flux-fips, cerbos, terragrunt, chainloop-cli, rancher-fleet, chainloop-cli-fips, nemo, cerbos-fips, scorecard, gitlab-rails-ce, telegraf, seaweedfs-rocksdb, argo-cd, flux, gitaly, syft-fips, amazon-ssm-agent, skaffold-fips, external-secrets-operator-fips, grafana,...
GO-2024-2659 vulnerabilities
Vulnerabilities for packages: ko, grype, conftest-fips, loki, up, spire-server-fips, zot, cadvisor, kaniko, kargo, wolfictl, kubescape, crossplane, prometheus, buildkitd, tkn, trivy, aactl, spire-server, cilium-cli, conftest, buf, melange, docker-compose, ctop, syft, dagger, cadvisor-fips...
GO-2026-5851 vulnerabilities
Vulnerabilities for packages: zarf, kubescape-server, tekton-chains, ratify, cloudbeat, falcoctl, falcoctl-fips, trivy-fips, neuvector-sigstore-interface, docker-fips, chainctl-fips, policy-controller-fips, spire-server-fips, kyverno-notation-aws, chainctl, gitsign, kubescape, crossplane,...
GO-2024-2718 vulnerabilities
Vulnerabilities for packages: ko, zarf, apko, tekton-chains, falcoctl, falcoctl-fips, neuvector-sigstore-interface, policy-controller-fips, spire-server-fips, chainctl, wolfictl, gitsign, kubescape, tkn, tkn-fips, tekton-chains-fips, aactl, flux-source-controller, spire-server, slsa-verifier,...
GO-2025-3887 vulnerabilities
Vulnerabilities for packages: helm-mapkubeapis, flux, linkerd2, headlamp, chart-testing, pluto, cerbos, zot, kubescape, envoy-gateway, cilium-cli, cluster-api-helm-controller, helm-push, trivy-operator, zarf, k9s, flux-source-controller, k8sgpt, k8ssandra-client, istio, helm-operator, eksctl,...
GO-2024-2719 vulnerabilities
Vulnerabilities for packages: gitsign, ko, zot, kubescape, tekton-chains, spire-server, neuvector-sigstore-interface, aactl, wolfictl, tkn, melange, zarf, flux-source-controller, skaffold, slsa-verifier, policy-controller, apko, falcoctl, vexctl, goreleaser...
Updated golang packages fix security vulnerabilities
The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...
MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-1242:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1242:01 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE:...
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps...
