CLEANSTART-2026-MB62550 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

Xalgorix Autonomous AI Pentesting Agent 4.6.92

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

PT-2026-97525

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description The native marketplace implementation contains a logic error where the Buy function in core/kapp/market/market.go fails to verify the IsClaimed status of an order. This allows a seller to settle a...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

CVE-2026-82406: Improper Enforcement of Behavioral Workflow

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

PT-2026-97539

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An issue exists in the Elasticsearch indexer component where the serializedDataForUpdateAccounts function in indexer/common.go fails to escape the acc.Name variable when constructing bulk JSON and...

PT-2026-97530

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description The 'GET /subscribe' endpoint accepts unauthenticated WebSocket clients with permissive origin handling and lacks a live-connection cap or a call to SetReadLimit to bound message size. Additionall...

PT-2026-97538

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An issue exists in the KleverUpdateAccountPermission built-in function where the authorization check incorrectly uses the vmInput.RecipientAddr variable instead of the authenticated...

CVE-2026-96770: Improper Following of a Certificate's Chain of Trust

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

CVE-2026-86065: Allocation of Resources Without Limits or Throttling

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

CVE-2026-82409: Improper Encoding or Escaping of Output

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

PT-2026-97526

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description Klever-Go, the Go implementation of the Klever blockchain protocol, fails to perform curve, prime-order subgroup, or nonzero validation on submitted BLSPublicKey during runtime validator...

CVE-2026-82407: Improper Input Validation

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

CVE-2026-82405: Incorrect Authorization

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An...

CVE-2026-86064: Exposure of Sensitive Information to an Unauthorized Actor

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in...

PT-2026-97529

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An unauthenticated remote client can connect to the default-open GET /log WebSocket endpoint. The server parses the first client message as a logger Profile and applies it process-wide using the...

PT-2026-105248

Security vulnerability affects the vault package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

host-metering security update

1.2.0-4.0.3 - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-27145 Orabug: 39863765 1.2.0-4.0.1 - Rebuild with new go-toolset-1.19-golang to fix CVE-2026-32283 Orabug: 39352233...

ALSA-2026:70640 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

ALSA-2026:70641 Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarsha...