GO-2024-3110 vulnerabilities

Vulnerabilities for packages: cadvisor, node-feature-discovery, kubernetes, grafana-alloy, buildah, syft, eks-distro-fips, cluster-autoscaler, grype, podman, grafana-alloy-fips, gosu, neuvector-fips, ctop, cluster-autoscaler-fips, runc, cadvisor-fips, k3s, neuvector, docker, eks-distro,...

CLEANSTART-2026-TQ91108 Security fixes in gosu 1.19-r2

Package gosu version 1.19-r2 fixes 1 vulnerabilities: CVE-2026-39824...

CLEANSTART-2026-MR40964 Security fixes for CVE-2025-47907, CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2026-39824 applied in versions: 1.17-r5, 1.19-r0, 1.19-r1, 1.19-r2

Multiple security vulnerabilities affect the gosu package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XK97736 Security fixes for CVE-2025-47907, CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2026-39824 applied in versions: 1.17-r5, 1.19-r0, 1.19-r1, 1.19-r2

Multiple security vulnerabilities affect the gosu package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MZ81553 Security fixes for CVE-2025-47907, CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2026-39824 applied in versions: 1.17-r5, 1.19-r0, 1.19-r1, 1.19-r2

Multiple security vulnerabilities affect the gosu package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XE66300 Security fixes for CVE-2025-47907, CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2026-39824 applied in versions: 1.17-r5, 1.19-r0, 1.19-r1, 1.19-r2

Multiple security vulnerabilities affect the gosu package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: cni-plugins, mockery, docker-credential-acr-env, newrelic-prometheus-configurator, ferretdb, cfssl, cue, hey, nuclei, supercronic, vite, dockerize, wazero, oras, ytt, cass-operator, esbuild, aws-efs-csi-driver, goreleaser, kubewatch, pulumi, wireguard-go,...

New DEEP#GOSU Malware Campaign Targets Windows Users with Advanced Tactics

A new elaborate attack campaign has been observed employing PowerShell and VBScript malware to infect Windows systems and harvest sensitive information. Cybersecurity company Securonix, which dubbed the campaign DEEPGOSU, said it's likely associated with the North Korean state-sponsored group...

Information Disclosure

github.com/tianon/gosu is vulnerable information disclosure. The library changes and leaves file descriptors open when accessing them. This can allow a malicious user to change permissions on sensitive files and read them...