GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: octo-sts, ksops-fips, flux-kustomize-controller, harbor-fips, cloud-provider-azure-fips, grafana-agent-operator, cyberark-secrets-provider-for-k8s-fips, cloud-provider-gcp-cloud-controller-manager-fips, kubelet-csr-approver, weaviate, crossplane-provider-azure-web,...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: ollama, chainctl, gotenberg, hugo, hugo-extended...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, spire-server-fips, crossplane-provider-aws-s3, zot, flux-source-controller, grype, melange, crossplane-provider-aws-lambda, pulumi-language-dotnet, goreleaser, slsa-verifier, flux-kustomize-controller, syft,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: mongo-tools, opencost, redpanda, snyk-cli, external-secrets-operator, gitlab-kas, mage, gitlab-pages, gitleaks, envoy-gateway, harbor, wireguard-go, nri-consul, tailscale, istio, apisix-ingress-controller, renovate, container-object-storage-interface, dgraph, argo-cd...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-rds, crossplane-provider-aws-cloudfront, crossplane-provider-aws-route53, crossplane-provider-azure-authorization, crossplane-provider-aws-cloudwatchlogs, aws-otel-collector, crossplane-provider-aws-eks,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-aws, crane, skaffold, velero-plugin-for-aws, ghaudit, minify, wazero, flux-kustomize-controller, nri-cassandra, neuvector-scanner, go, mkcert, yam, kube-bench, restic, gobuster, nri-mongodb, wgcf, docker, cni-plugins, grafana-mimir, bazelisk,...

JetBrains GoLand < 2026.2 Multiple Vulnerabilities

The version of JetBrains GoLand installed on the remote host is prior to 2026.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration CVE-2026-64802 - In...

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-64802

Technical details about CVE-2026-64802 are not publicly provided in the supplied documents. Monitor for updates from JetBrains and NVD; no specifics on affected versions, vectors, or fixes are available here.

EUVD-2026-48227

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

PT-2026-63956

Name of the Vulnerable Software and Affected Versions JetBrains GoLand versions prior to 2026.2 Description Arbitrary code execution is possible within the Go Modules integration before the user grants project trust. Recommendations Update JetBrains GoLand to version 2026.2...

GO-2026-5953 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

DEBIAN-CVE-2026-50135

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat follows symlinks instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount e.g. a...

SUSE-SU-2026:2765-1 Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Security issue fixed: - CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-lusitaniae-apacheexporter: - Non customer facing changes...

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...

SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:2493-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2493-1 advisory. - Security: re-vendor Go dependencies to address CVEs tracked against containerized-data-importer backport of upstream PR 4110,...

GO-2026-5708 Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana

Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5505 Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization in github.com/portainer/portainer

Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-5095 Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana

Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...