16875 matches found
CVE-2026-25466
CVE-2026-25466 affects the WordPress WP Go Maps plugin (vulnerable:
github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log
A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...
github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys
A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and...
GoLand -- Multiple vulnerabilities
https://www.jetbrains.com/privacy-security/issues-fixed/ reports: In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...
PT-2026-63956
Name of the Vulnerable Software and Affected Versions JetBrains GoLand versions prior to 2026.2 Description Arbitrary code execution is possible within the Go Modules integration before the user grants project trust. Recommendations Update JetBrains GoLand to version 2026.2...
OPENSUSE-SU-2026:21436-1 Security update for rclone
This update for rclone fixes the following issues: Changes in rclone: - Update to version 1.74.4 boo1267192: Version v1.74.4 gui: update embedded release to 1.1.10 local: stop --links symlinks escaping the destination directory CVE-2026-54572 local: don't restore setuid/setgid/sticky bits from...
GO-2026-6018 Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper...
GO-2026-6027 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev...
GO-2026-6024 File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser
File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser...
CVE-2026-55677
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...
OPENSUSE-SU-2026:21413-1 Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....
EUVD-2026-46642
Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...
Photon OS 5.0: Go PHSA-2026-5.0-0855
An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0855. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid328957...
SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3151-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3151-1 advisory. This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. -...
golang security, bug fix, and enhancement update
1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1 1.25.5-1 - Update to Go 1.25.5 fips-1 1.25.3-5 - gating.yaml: Add tier1 s390x tests 1.25.3-4 - Cleanup lib/ ownership - Remove legacy logic forcing lib/...
Oracle Linux 10 : golang (ELSA-2026-22120)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22120 advisory. 1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1...
AlmaLinux 10 : golang-github-openprinting-ipp-usb (ALSA-2026:35832)
The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:35832 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 crypto/x509: golang: golang crypto/x509: Denial of...
MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-1326:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1326:01 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 crypto/x509: golan...
AlmaLinux 8 : go-toolset:rhel8 (ALSA-2026:10704)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:10704 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 crypto/tls: golang: Go crypto/tls: Denial of Service via...
