21448 matches found
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...
CVE-2026-79777
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
UBUNTU-CVE-2026-79777
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
EUVD-2026-65535
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
CVE-2026-79775
rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...
EUVD-2026-65533
rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...
CVE-2026-79775 rclone Archive Backend SquashFS Parser Denial of Service
rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...
GO-2026-6278 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket...
CVE-2026-42501
A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...
Security update for go1.26-openssl
This update for go1.26-openssl fixes the following issues: Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to...
WordPress WP Go Maps plugin < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability
Unauthenticated Sensitive Information Disclosure via Marker ID vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin WP Go Maps versions 10.0.10...
CVE-2026-79658
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.11 packages and security update
Red Hat OpenShift Container Platform release 4.22.11 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.11 security and extras update
Red Hat OpenShift Container Platform release 4.22.11 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.30 security and extras update
Red Hat OpenShift Container Platform release 4.21.30 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...
Security update for runc
This update for runc rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Enterprise Storage...
