Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-198830

Malicious code in go-template npm...

Malicious code in go-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2b1faf83824d6073ab908373d9704ee8fb7cb05322cfb6cedc079603455f10 The package go-template was found to contain malicious code. Source: ghsa-malware 508770194aad24fbaa79597bcc1a3f618b9397f2ad3f6fd1dc06c5dc0938a6ee An...

MAL-2025-190846 Malicious code in go-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2b1faf83824d6073ab908373d9704ee8fb7cb05322cfb6cedc079603455f10 The package go-template was found to contain malicious code. Source: ghsa-malware 508770194aad24fbaa79597bcc1a3f618b9397f2ad3f6fd1dc06c5dc0938a6ee An...

Malicious code in @asyncapi/go-watermill-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88957e3f78294013ec0e22167aec58b8de4dcc65099728725b884c54b6afa328 The package @asyncapi/go-watermill-template was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198727

Malicious code in @asyncapi/go-watermill-template npm...

ROS-20251124-04

Go programming language vulnerability is related to unrestricted resource allocation. Exploitation The vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2025-65109

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

CVE-2025-65109

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

CVE-2025-65109 Minder does not sandbox http.send in Rego programs

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

EUVD-2025-198530

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

delve and golang security update

An update is available for golang, delve. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Go Programming Language. Security Fixes: golang: archive/tar:...

RLSA-2025:21815 Moderate: delve and golang security update

The Go Programming Language. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the...

RHSA-2025:21815 Red Hat Security Advisory: delve and golang security update

Bulletin has no description...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: thanos, cilium-cli, prometheus-pushgateway, gh, buildah, docker-machine-driver-linode, azcopy, timestamp-authority, vale, temporal-server, terragrunt, witness, eksctl, external-dns, crossplane-provider-aws-dynamodb, cluster-api-aws-controller, headlamp,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: thanos, cilium-cli, prometheus-pushgateway, gh, buildah, docker-machine-driver-linode, azcopy, timestamp-authority, vale, temporal-server, terragrunt, witness, eksctl, external-dns, crossplane-provider-aws-dynamodb, cluster-api-aws-controller, headlamp,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: cilium-cli, prometheus-pushgateway, buildah, docker-machine-driver-linode, azcopy, timestamp-authority, vale, temporal-server, terragrunt, witness, eksctl, external-dns, crossplane-provider-aws-dynamodb, cluster-api-aws-controller, headlamp, infinispan-operator,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: cilium-cli, prometheus-pushgateway, buildah, docker-machine-driver-linode, azcopy, timestamp-authority, vale, temporal-server, terragrunt, witness, eksctl, external-dns, crossplane-provider-aws-dynamodb, cluster-api-aws-controller, headlamp, infinispan-operator,...

The vulnerability of the crypto/tls component in the Go programming language, which allows a perpetrator to disclose protected information

The vulnerability of the crypto/tls component in the Go programming language is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the `net/http` component in the Go programming language, which allows a hacker to trigger a service failure

The vulnerability of the net/http component in the Go programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...