GO-2023-2102 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, kubernetes-ingress-defaultbackend, metacontroller, amass, prometheus-operator, kubernetes-dashboard-metrics-scraper, prometheus-alertmanager, gitness, kind, gobuster, kubewatch, vertical-pod-autoscaler, flux-kustomize-controller,...

GO-2026-5547 vulnerabilities

Vulnerabilities for packages: crossplane, tflint, neuvector-sigstore-interface, ratify, trivy-operator, vexctl, docker-cli-buildx, docker, dagger, gitlab-runner, cosign, policy-controller, bom, teleport, trivy, guac, gitsign, goreleaser, flux-source-controller, kyverno-notation-aws, rekor, ko,...

GO-2026-5023 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, kine, mattermost, flux-image-automation-controller, cloud-provider-aws, rancher-agent, gitlab-kas, prometheus-operator, fscrypt, falco-no-driver, nerdctl, trivy-operator, prometheus, cilium-cli, rancher, trivy, telegraf, flux-source-controlle...

GO-2026-5033 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, kine, buildah, mattermost, cloud-provider-aws, rancher-agent, gitlab-kas, prometheus-operator, fscrypt, falco-no-driver, nerdctl, docker-cli-buildx, prometheus, cilium-cli, rancher, telegraf, kaf, flux, spire-server, kubernetes, cilium,...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: tflint, neuvector-sigstore-interface, ratify, trivy-operator, vexctl, cosign, policy-controller, teleport, trivy, gitsign, goreleaser, flux-source-controller, kyverno-notation-aws, ko, slsa-verifier, spire-server, witness, zot, falcoctl, tkn, kubescape, zarf, skaffol...

GO-2026-4918 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, cluster-api-ipam-provider-in-cluster, redka, metacontroller, prometheus-operator, spicedb-operator, newrelic-infra-operator, clickhouse-operator, external-secrets-operator, kubewatch, delve, kserve-modelmesh-serving, velero-plugin-for-csi, skopeo,...

GO-2025-4134 vulnerabilities

Vulnerabilities for packages: gatus, crossplane, boring-registry, xeol, kube-rbac-proxy, kine, flux-image-automation-controller, amass, rke2-cloud-provider, blob-csi, prometheus-operator, go-jsonnet, docker-machine-driver-harvester, crossplane-provider-aws-memorydb, nri-kafka, hugo-extended,...

GO-2025-4155 vulnerabilities

Vulnerabilities for packages: redka, prometheus-operator, go-jsonnet, spicedb-operator, newrelic-infra-operator, smarter-device-manager, kserve-modelmesh-serving, otel-cli, gotestsum, minio-object-browser, gitleaks, rancher-helm, influx, kiali, kapp, gops, govulncheck, spark-operator,...

GO-2024-3005 vulnerabilities

Vulnerabilities for packages: argo-workflows, crossplane, opentelemetry-collector, up, buildah, ctop, neuvector-sigstore-interface, syft, paranoia, cert-manager-cmctl, chartmuseum, nerdctl, vexctl, apko, dagdotdev, eksctl, rancher-fleet, vcluster, cilium-cli, scorecard, kargo, dagger, helm-push,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: argo-workflows, boring-registry, crossplane, kine, temporal-server, kubernetes-dashboard-auth, crossplane-provider-azure-sql, crossplane-provider-family-azure, argo-rollouts, chartmuseum, octo-sts, doppler-kubernetes-operator, azcopy, openbao, vexctl,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, vexctl, apko, policy-controller, wolfictl, gitsign, goreleaser, flux-source-controller, ko, slsa-verifier, spire-server, zot, falcoctl, tkn, kubescape, zarf, skaffold, melange, aactl, tekton-chains...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, vexctl, apko, policy-controller, wolfictl, gitsign, goreleaser, flux-source-controller, ko, slsa-verifier, spire-server, zot, falcoctl, tkn, kubescape, zarf, skaffold, melange, aactl, tekton-chains...

Extracting and Verifying Illicit Bitcoin Addresses from Underground Forum Discussions

Existing labeled Bitcoin datasets are largely derived from community-reported abuse, blockchain heuristics, incident-specific collections, or proprietary labeling processes. Their construction methods are rarely publicly reproducible and often provide limited evidence that an address was directly...

...[ More ]

A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...

Linux Distros Unpatched Vulnerability : CVE-2026-56864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

AZL-96647 CVE-2026-56865 affecting package golang 1.25.12-1

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...