RHEL 9 : golang (RHSA-2025:21337)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21337 advisory. The golang packages provide the Go programming language compiler. Security Fixes: database/sql: Postgres Scan Race Condition CVE-2025-47907 For more...

RHEL 8 : go-toolset:rhel8 (RHSA-2025:21384)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21384 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: database/sql: Postgres Sca...

EUVD-2025-136592

Malicious code in inda-fodji-go npm...

Malicious code in inda-fodj-go (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d7ca5488efb8fdfea31367f059a6a57f749a6ec24b04b28b5683d8d808ed19d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-136684

Malicious code in inda-fodj-go npm...

GHSA-88H9-77C7-P6W4 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Summary A vulnerability was identified in the evervault-go SDK’s attestation verification logic that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not meet expected integrity guarantees. The exploitability of this issue is...

CVE-2025-64186

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

EUVD-2025-142165

Malicious code in go-tumva-diabilu npm...

MAL-2025-174138 Malicious code in go-tumva-diabilu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45a259407d5bee0272c1c54dec3bdf3bd9d93efd1c99ac059e22badca298543a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Denial of Service (DoS)

Overview github.com/dvsekhvalnov/jose2go is a Pure Golang GO library for generating, decoding and encrypting JSON Web Tokens. Zero dependency, relies only on standard library. Affected versions of this package are vulnerable to Denial of Service DoS via the processing of crafted JSON Web Encrypti...

Malicious code in mahnud-magu-go (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b089d9f2f03160c986fce8034d928715a7f4034392a88f6dd903d8a9c50a7a1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11307

The WP Go Maps formerly WP Google Maps WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped...

PT-2025-46716

Name of the Vulnerable Software and Affected Versions Evervault-go versions prior to 1.3.2 Description A flaw exists in the attestation verification logic of the evervault-go SDK. This issue could allow incomplete documents to pass validation, potentially leading a client to trust an enclave...

Evervault Go SDK 数据伪造问题漏洞

Evervault Go SDK is an open source development toolkit from Evervault. A Data Forgery Issue vulnerability exists in Evervault Go SDK versions prior to 1.3.2, which stems from incomplete validation logic that could lead to trusting an enclave operator that does not meet integrity guarantees...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2025-2358)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2025:15729-1 go-sendxmpp-0.15.1-1.1 on GA media

These are all security issues fixed in the go-sendxmpp-0.15.1-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE-SU-2025:3681-1 Security update for go1.25

This update for go1.25 fixes the following issues: go1.25.3 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1244485 CVE-2025-58187 go75861 crypto/x509: TLS validation fails for FQDNs with trailing dot go75777 spec: Go1.25 spec should be dated closer to actual release date Furthe...