CVE-2026-58262 Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...

CVE-2026-58262 Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...

CVE-2026-58262 Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...

xalgorix v4.5.125

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

UBUNTU-CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets

ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host an...

AZL-94673 CVE-2026-71557 affecting package cri-o 1.30.1-1

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

AZL-95484 CVE-2026-71556 affecting package packer for versions less than 1.9.5-20

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

AZL-94676 CVE-2026-71556 affecting package cri-o 1.30.1-1

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

AZL-95487 CVE-2026-71557 affecting package packer for versions less than 1.9.5-20

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

UBUNTU-CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

UBUNTU-CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

GHSA-QGQ7-7HM3-Q39J go-git: Malicious reference names may modify files outside the reference storage

Impact A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under .git/. The reference name was previously used as a path without verifying that the resolved path remained within the...

Directory Traversal

Overview github.com/go-git/go-git/plumbing is a highly extensible git implementation library written in pure Go. Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended...

Directory Traversal

Overview github.com/go-git/go-git/v5/plumbing is a highly extensible git implementation library written in pure Go. Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intend...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...