143 matches found
capslock
Capslock 是一个针对 Go 包的能力分析 CLI，用于告知用户某个包可以访问哪些特权操作。其原理是通过跟踪对特权标准库操作的传递调用来对 Go 包的能力（capabilities）进行分类。 近年来针对开源软件的供应链攻击日益增多，这凸显了第三方依赖不应被天然信任。能力（capabilities）表明包可以访问哪些权限，并且可以与其他安全信号结合使用，以指示哪些代码在可以被视为可信之前需要额外的审查。 什么是能力？ 当前的安全分析很大程度上专注于识别包中的漏洞——考虑到新 CVE...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.57 security and extras update
Red Hat OpenShift Container Platform release 4.17.57 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...
golang-x-text
Go Text 本仓库包含用于文本处理的补充 Go 包，其中许多涉及 Unicode。 CLDR 版本控制 确保 x/text 中使用的 Unicode 版本与你的 Go 编译器使用的版本一致非常重要。x/text 仓库支持多个 Unicode 版本，并将 Unicode 版本与 Go 编译器的版本匹配。目前，这支持 Go 编译器从版本 1.7 开始。 贡献 要向本仓库提交更改，请参阅 http://go.dev/doc/contribute。 git 仓库是 https://go.googlesource.com/text。 要生成此仓库中的表格（编码表除外），请在此目录中运行 go...
GO-2026-6293 vulnerabilities
Vulnerabilities for packages: temporal-fips, falcosidekick-ui, kube-metrics-adapter, listmonk, temporal, falcosidekick-ui-fips, kube-metrics-adapter-fips, temporal-ui-server, temporal-ui-server-fips...
GO-2026-6255 vulnerabilities
Vulnerabilities for packages: kubescape-server, kaniko-fips, kubescape, scorecard, zot, skaffold-fips, cloudbeat-fips, kubescape-server-fips, cloudbeat, kaniko, livekit-cli, trivy-fips, podman-fips, podman, guac, conftest, trivy-operator-fips, skaffold, conftest-fips, trivy...
RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...
RHEL 9 : osbuild-composer (RHSA-2026:57541)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57541 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...
GO-2026-4770 vulnerabilities
Vulnerabilities for packages: livekit-cli, flux-operator, datadog-agent-fips, glab, gitlab-workhorse-ce, osv-scanner, ferretdb, jaeger-fips, gitlab-workhorse-ce-fips, datadog-agent, jaeger, flux-operator-fips, opencost-fips, opencost...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: cilium-fips, opentelemetry-collector-contrib-fips, certificate-transparency, minio-fips, tflint, dbmate, osv-scanner, rqlite, certificate-transparency-fips, opa-fips, pulumi-language-dotnet, gomplate, grpc-health-probe-fips, step-ca, falcosidekick-fips, tempo,...
GO-2026-5597 vulnerabilities
Vulnerabilities for packages: external-secrets-operator, grafana-fips, scorecard, nemo, skaffold-fips, kyverno-fips, seaweedfs-rocksdb-fips, argo-cd, flux-fips, seaweedfs-rocksdb, cerbos, external-secrets-operator-fips, gitaly, gitlab-rails-ce, syft-fips, rclone-fips, packer-fips, terragrunt-fips...
GO-2024-2659 vulnerabilities
Vulnerabilities for packages: cilium-cli, cadvisor, wolfictl, ko, kubescape, buf, zot, crossplane, tkn, aactl, kargo, spire-server-fips, ctop, spire-server, up, docker-compose, loki, prometheus, melange, kaniko, cadvisor-fips, buildkitd, dagger, grype, conftest, syft, conftest-fips, trivy...
GO-2026-5851 vulnerabilities
Vulnerabilities for packages: ratify-fips, kyverno-notation-aws, kubescape-server, policy-controller, kyverno, kyverno-notation-aws-fips, trivy-operator, docker-fips, tflint-fips, falcoctl, kubescape, goreleaser, neuvector-sigstore-interface-fips, tkn-fips, crossplane, kyverno-fips,...
GO-2024-2718 vulnerabilities
Vulnerabilities for packages: wolfictl, ko, policy-controller, falcoctl, kubescape, goreleaser, tkn-fips, zot, tekton-chains-fips, tkn, aactl, spire-server-fips, slsa-verifier, chainctl, spire-server, ko-fips, gitsign, melange, flux-source-controller, neuvector-sigstore-interface, falcoctl-fips,...
GO-2025-3887 vulnerabilities
Vulnerabilities for packages: pluto, helm-push, cluster-api-helm-controller, headlamp, linkerd2, flux, tw, chartmuseum, k9s, rancher-fleet, eksctl, cilium-cli, kargo, trivy-operator, cerbos, helm-set-status, k8ssandra-client, kots, helm-mapkubeapis, helm-docs, flux-source-controller, istio,...
GO-2024-2719 vulnerabilities
Vulnerabilities for packages: goreleaser, tkn, tekton-chains, slsa-verifier, wolfictl, aactl, gitsign, spire-server, flux-source-controller, ko, apko, skaffold, policy-controller, melange, kubescape, zarf, vexctl, falcoctl, neuvector-sigstore-interface, zot...
Updated golang packages fix security vulnerabilities
The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...
MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-1242:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1242:01 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE:...
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps...
