21024 matches found
CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...
Routeglass
Routeglass - High speed Router & Network Appliance Fingerprinting Tool Routeglass is a fast, multi-threaded router fingerprinting tool written in Go. The goal of the project is simple: identify web-exposed routers, firewalls, gateways, and embedded network devices by fingerprinting HTTP responses...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
ROOT-APP-GOBINARY-CVE-2026-44973 CVE-2026-44973 in github.com/go-git/go-billy/v5 - Patched by Root
Root has patched CVE-2026-44973 in the github.com/go-git/go-billy/v5 package for Root:Go. Multiple fixed versions available...
OPENSUSE-SU-2026:22010-1 Security update for distribution
This update for distribution fixes the following issues: - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration bsc1281468. - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log:...
SUSE-SU-2026:23990-1 Security update for distribution
This update for distribution fixes the following issues: - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration bsc1281468. - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log:...
ROOT-APP-GOBINARY-CVE-2026-50163 CVE-2026-50163 in oras.land/oras-go/v2 - Patched by Root
Root has patched CVE-2026-50163 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-85731 CVE-2026-85731 in oras.land/oras-go/v2 - Patched by Root
Root has patched CVE-2026-85731 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-50151 CVE-2026-50151 in oras.land/oras-go/v2 - Patched by Root
Root has patched CVE-2026-50151 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-45570 CVE-2026-45570 in github.com/go-git/go-git/v5 - Patched by Root
Root has patched CVE-2026-45570 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-45022 CVE-2026-45022 in github.com/go-git/go-git/v5 - Patched by Root
Root has patched CVE-2026-45022 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-71556 CVE-2026-71556 in github.com/go-git/go-git/v5 - Patched by Root
Root has patched CVE-2026-71556 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2, github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5, tar 7.5.19, libsolv 0.7.24-5.el98, compat-openssl11 1:1.1.1k-5.el98.3, sigstore 2.3.1, and dif...