GO-2026-4770 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, datadog-agent, flux-operator-fips, osv-scanner, glab, livekit-cli, jaeger, gitlab-workhorse-ce-fips, ferretdb, opencost-fips, jaeger-fips, opencost, flux-operator, datadog-agent-fips...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k8sgpt, trivy-fips, kwok, conftest-fips, guac, fulcio-fips, kots, grafana-agent-operator, minio, spicedb, terragrunt, external-secrets-fips, trivy, minio-fips, smarter-device-manager-fips, temporal-fips, temporal, k3d, kubernetes-csi-external-provisioner, opa,...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: grafana, argo-cd-fips, rancher-fleet-fips, packer-fips, syft, flux-fips, gitlab-rails-ce, grafana-fips, scorecard, flux, syft-fips, chainloop-cli, rancher-fleet, argo-cd, upwind-agent, skaffold-fips, seaweedfs-rocksdb-fips, external-secrets-operator-fips,...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: spire-server-fips, conftest-fips, zot, grype, melange, syft, prometheus, conftest, kaniko, cilium-cli, up, wolfictl, cadvisor, loki, crossplane, trivy, buildkitd, aactl, ko, spire-server, buf, dagger, ctop, cadvisor-fips, kubescape, tkn, docker-compose, kargo...

GO-2026-5851 vulnerabilities

Vulnerabilities for packages: trivy-operator-fips, spire-server-fips, trivy-fips, image-factory-fips, zarf-fips, goreleaser, policy-controller-fips, kubescape-server-fips, docker-fips, falcoctl-fips, tbot, kyverno, gitsign, chainctl-fips, ratify, tflint, crossplane, trivy, kyverno-fips,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: spire-server-fips, zot, flux-source-controller, melange, slsa-verifier, goreleaser, policy-controller-fips, falcoctl-fips, vexctl, gitsign, wolfictl, aactl, falcoctl, ko, skaffold, spire-server, tekton-chains-fips, neuvector-sigstore-interface, apko, tkn-fips,...

GO-2025-3887 vulnerabilities

Vulnerabilities for packages: helm-set-status, cilium-cli, helm-docs, helm-mapkubeapis, envoy-gateway, chartmuseum, istio, kots, k9s, tw, nova, zot, flux, trivy, cluster-api-helm-controller, eksctl, k8sgpt, pluto, rancher-fleet, trivy-operator, headlamp, zarf, cerbos, flux-source-controller, karg...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: tekton-chains, skaffold, slsa-verifier, aactl, melange, gitsign, zot, apko, zarf, flux-source-controller, tkn, goreleaser, kubescape, wolfictl, neuvector-sigstore-interface, vexctl, falcoctl, spire-server, ko, policy-controller...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-1242:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1242:01 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE:...

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps...

Critical Photon OS Security Update - PHSA-2026-5.0-0869

Updates of 'docker-compose', 'coredns', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2026-5.0-92-0869

Updates of 'go' packages of Photon OS have been released...

ALSA-2026:8841 Important: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url...

ALSA-2026:3669 Important: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: golang: net/url: Memory exhaustion in query parameter parsing i...

Critical Photon OS Security Update - PHSA-2026-4.0-0968

Updates of 'linux', 'go', 'vim' packages of Photon OS have been released...

MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-195:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-195:01 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

Moderate: go-rpm-macros security update

This package provides build-stage rpm automation to simplify the creation of Go language golang packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fixes: os/exec: Unexpected paths returned from LookPath in os/exec...

CVE-2025-47912

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...

RLSA-2025:13941 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: Go VCS Command Execution Vulnerability CVE-2025-4674 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages...