Oracle Linux 10 : golang (ELSA-2026-37436)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-37436 advisory. 1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1...

golang security update

1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1 1.25.5-1 - Update to Go 1.25.5 fips-1 1.25.3-5 - gating.yaml: Add tier1 s390x tests 1.25.3-4 - Cleanup lib/ ownership - Remove legacy logic forcing lib/...

golang-github-openprinting-ipp-usb security update

0.9.27-7.2 - rebuilt with golang-1.26.4-1.el102 to fix CVE-2026-33811, CVE-2026-27145 0.9.27-7.1 - rebuilt with golang-1.26.3-4.el102 to fix CVE-2026-32281 0.9.27-7 - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810...

SUSE-SU-2026:2763-1 Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Security issue fixed: - CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-lusitaniae-apacheexporter: - Non customer facing changes...

SUSE-SU-2026:21560-1 Security update for distribution

This update for distribution fixes the following issues Security issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authentication real...

OPENSUSE-SU-2026:20686-1 Security update for distribution

This update for distribution fixes the following issues Security issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authentication real...

PT-2026-26773

Name of the Vulnerable Software and Affected Versions goxmlsig versions prior to 1.6.0 goxmlsig versions prior to 1.22 when using older Go versions or go.mod versions Description The validateSignature function in validate.go has a loop variable capture issue in Go versions before 1.22, or when...

CVE-2025-66630

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may...

CVE-2025-66630

Fiber is a Go web framework. Before 2.52.11 and on Go

Security update for coredns (important)

openSUSE Security Update: Security update for coredns Announcement ID: openSUSE-SU-2026:0032-1 Rating: important References: 1255345 Cross-References: CVE-2025-61726 CVE-2025-61728 CVE-2025-61731 CVE-2025-68119 CVE-2025-68121 CVE-2025-68156 CVSS scores: CVE-2025-61726 SUSE: 6.9...

AZL-75719 CVE-2025-61728 affecting package golang for versions less than 1.25.6-1

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...

EUVD-2021-26466

Malware in sbrugna...

EUVD-2019-5938

Malware in sbrugna...

EUVD-2021-22841

Malware in sbrugna...

EUVD-2022-28708

Malicious code in bioql PyPI...

EUVD-2022-52465

Malicious code in bioql PyPI...

EUVD-2022-52429

Malicious code in bioql PyPI...

EUVD-2022-28709

Malicious code in bioql PyPI...

Golang 1.24.x < 1.24.7 / 1.25.x < 1.25.1 Insecure Bypass (75054)

The version of Golang running on the remote host is 1.24.x prior to 1.24.7, 1.25.x prior to 1.25.1. It is, therefore, affected by a vulnerability as referenced in 75054 advisory. - When passing patterns to CrossOriginProtection.AddInsecureBypassPattern, requests that would have redirected to thos...

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

...