capslock

Capslock 是一个针对 Go 包的能力分析 CLI，用于告知用户某个包可以访问哪些特权操作。其原理是通过跟踪对特权标准库操作的传递调用来对 Go 包的能力（capabilities）进行分类。 近年来针对开源软件的供应链攻击日益增多，这凸显了第三方依赖不应被天然信任。能力（capabilities）表明包可以访问哪些权限，并且可以与其他安全信号结合使用，以指示哪些代码在可以被视为可信之前需要额外的审查。 什么是能力？ 当前的安全分析很大程度上专注于识别包中的漏洞——考虑到新 CVE...

golang-x-text

Go Text Este repositorio contiene paquetes Go complementarios para el procesamiento de texto, muchos de los cuales involucran Unicode. Versiones de CLDR Es importante que la versión de Unicode utilizada en x/text coincida con la utilizada por tu compilador de Go. El repositorio x/text soporta...

RHEL 8 : osbuild-composer (RHSA-2026:67148)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67148 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

AlmaLinux 10 : git-lfs (ALSA-2026:64788)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:64788 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-39883 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin iore...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.57 security and extras update

Red Hat OpenShift Container Platform release 4.17.57 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...

RHCOS 4 : OpenShift Container Platform 4.17.57 (RHSA-2026:60018)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60018 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

GO-2026-6293 vulnerabilities

Vulnerabilities for packages: listmonk, temporal-fips, falcosidekick-ui-fips, kube-metrics-adapter, temporal-ui-server-fips, falcosidekick-ui, temporal-ui-server, temporal, kube-metrics-adapter-fips...

GO-2026-6255 vulnerabilities

Vulnerabilities for packages: skaffold, kubescape-server-fips, trivy-fips, scorecard, trivy-operator-fips, conftest, cloudbeat, livekit-cli, docker-fips, conftest-fips, cloudbeat-fips, kubescape-server, trivy, kaniko-fips, kubescape, podman, podman-fips, zot, guac, skaffold-fips, kaniko...

RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

RHEL 9 : osbuild-composer (RHSA-2026:57541)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57541 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: glab, livekit-cli, opencost-fips, flux-operator, ferretdb, gitlab-workhorse-ce-fips, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, gitlab-workhorse-ce, opencost, datadog-agent, jaeger-fips...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: terraform-docs, k3d, gomplate, vcluster, conftest, dex, certificate-transparency-fips, falcosidekick, spire-server-fips, spegel, conftest-fips, cloudnative-pg, osv-scanner, trivy, falcosidekick-fips, dbmate, smarter-device-manager-fips, sigstore-scaffolding-fips,...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, nemo, chainloop-cli, packer-fips, terragrunt-fips, rclone, gitlab-rails-ce-fips, scorecard, external-secrets-operator, grafana, seaweedfs-rocksdb-fips, telegraf, gitlab-rails-ce, syft-fips, cerbos, rancher-fleet-fips, flux-fips, terragrunt,...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: spire-server, wolfictl, dagger, buf, aactl, conftest, ctop, cadvisor-fips, loki, up, prometheus, cilium-cli, spire-server-fips, melange, grype, conftest-fips, ko, trivy, docker-compose, cadvisor, syft, kubescape, buildkitd, kargo, zot, tkn, crossplane, kaniko...

GO-2026-5851 vulnerabilities

Vulnerabilities for packages: spire-server, tflint-fips, neuvector-sigstore-interface, ratify-fips, aactl, kubescape-server-fips, image-factory-fips, tbot, policy-controller, trivy-fips, kyverno-notation-aws-fips, falcoctl-fips, kyverno-notation-aws, falcoctl, trivy-operator-fips, zarf-fips,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: skaffold, spire-server, wolfictl, neuvector-sigstore-interface, slsa-verifier, aactl, apko, policy-controller, falcoctl-fips, falcoctl, flux-source-controller, vexctl, gitsign, spire-server-fips, ko-fips, tekton-chains-fips, melange, tkn-fips, ko, tekton-chains,...

GO-2025-3887 vulnerabilities

Vulnerabilities for packages: k8sgpt, kots, k8ssandra-client, eksctl, flux-helm-controller, rancher-fleet, chartmuseum, helm-set-status, helm-mapkubeapis, helm-push, flux-source-controller, envoy-gateway, cert-manager-cmctl, pluto, trivy, helm-operator, zarf, flux, linkerd2,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: apko, policy-controller, neuvector-sigstore-interface, slsa-verifier, vexctl, ko, flux-source-controller, tkn, falcoctl, zarf, aactl, spire-server, tekton-chains, goreleaser, kubescape, wolfictl, skaffold, zot, melange, gitsign...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...