CVE-2025-46327

gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and...

OPENSUSE-SU-2025:15041-1 golang-github-prometheus-node_exporter-1.9.1-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-nodeexporter-1.9.1-2.1 package on the GA media of openSUSE Tumbleweed...

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

...

Important: runfinch-finch

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Prior to 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose Authorization header consist...

Amazon Linux 2023 : docker (ALAS2023-2025-945)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-945 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-944)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-944 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Prior to5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a...

Amazon Linux 2 : docker (ALASDOCKER-2025-058)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-058 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated ...

Amazon Linux 2 : docker (ALASECS-2025-055)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-055 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by ...

CVE-2025-46327

gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and...

CVE-2025-46327

CVE-2025-46327 affects gosnowflake (Snowflake Go driver) versions 1.7.0 up to 1.13.3 (exclusive). The issue is a TOCTOU race in the Easy Logging feature: on Linux/macOS the driver reads logging config from a user-provided file and verifies write access only by the file owner, but the check can ra...

CVE-2025-22871 affecting package golang for versions less than 1.22.7-3

CVE-2025-22871 affecting package golang for versions less than 1.22.7-3. A patched version of the package is available...

[SECURITY] Fedora 40 Update: golang-github-openprinting-ipp-usb-0.9.30-4.fc40

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol...

Fedora 40 : golang-github-openprinting-ipp-usb (2025-2280949271)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2280949271 advisory. rebuild with new golang to fix CVE-2025-22870 fedora2352013 Tenable has extracted the preceding description block directly from the Fedora security...

Cross-site Scripting (XSS)

golang.org/x/net is vulnerable to improper parsing logic. The vulnerability is due to incorrect tag interpretation in unquoted attribute values ending with a solidus / being mistakenly marked as self-closing, especially in foreign content like or . which allows attackers to exploit content in the...

Fedora: Security Advisory (FEDORA-2025-f974cb8ce5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 40 : golang (2025-f974cb8ce5)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f974cb8ce5 advisory. Includes security fixes to the net/http package, as well as bug fixes to the runtime and the go command. Full changelog. Tenable has extracted the...

CVE-2024-45336 affecting package golang for versions less than 1.23.7-1

CVE-2024-45336 affecting package golang for versions less than 1.23.7-1. A patched version of the package is available...

CVE-2024-45336 affecting package golang for versions less than 1.23.7-1

CVE-2024-45336 affecting package golang for versions less than 1.23.7-1. A patched version of the package is available...

CVE-2025-22871 affecting package golang for versions less than 1.18.8-7

CVE-2025-22871 affecting package golang for versions less than 1.18.8-7. A patched version of the package is available...

Denial Of Service (DoS)

golang.org/x/crypto are vulnerable to a Denial Of Service DoS. The vulnerability is due to incomplete or slow key exchanges, which cause pending content to be read into memory but never transmitted, allowing an attacker to consume server resources and cause a denial of service...