cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

CVE-2025-15556-Notepad-WinGUp-Updater-RCE

Software interessato: versioni di Notepad++ precedenti alla versione 8.8.9 che utilizzano l'aggiornatore WinGUp. Tipo di vulnerabilità: bypass della verifica dell'integrità degli aggiornamenti che porta all'esecuzione di codice arbitrario. Descrizione: l'aggiornatore WinGUp non verifica...

CVE-2026-80675 libbpf: Reject non-exclusive metadata maps in the signed loader

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha against the metadata hash in its instructions. map-sha is calculated when BPFOBJGETINFOBYFD is called on the frozen map. While the map is...

CVE-2026-81717

opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...

CVE-2026-81717

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in its portable USB drive feature, whose threat model assumes an attacker with physical write access to the drive. First, USBDriveCreator._verify_integrity_file validates only files listed in the manifest, so an at...

EUVD-2026-67067

opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...

CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files

opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...

CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files

opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-31431-CopyFail-Lab

CVE-2026-31431 "Copy Fail" — Laboratorio LPE del Kernel Linux Panoramica Questo repository documenta un'indagine di laboratorio completa su CVE-2026-31431 Copy Fail , una vulnerabilità di escalation dei privilegi locali LPE ad alta gravità nel modulo crittografico algifaead del kernel Linux,...

copy-fail-CVE-2026-31431-IOC

copyfail-detect Kit di rilevamento per CVE-2026-31431 "Copy Fail", una tecnica di escalation dei privilegi locale del kernel Linux che corrompe i dati della page-cache senza modificare il file su disco. Perché Esiste Copy Fail può bypassare il monitoraggio tradizionale dell'integrità dei file...

golang security update

An update is available for golang. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

golang security update

An update is available for golang. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:22112)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22112 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

RockyLinux 10 : golang (RLSA-2026:22120)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22120 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

CVE-2026-72714

A flaw was found in Rocq Prover. When a module that locally disabled the universe checking flag is closed, the prover fails to restore the universe graph's copy of this flag. This desynchronization allows the kernel to accept terms that are inconsistent with the universe, even though the system...

CVE-2026-74592

A flaw was found in the Linux kernel's Integrity Measurement Architecture IMA. When a file is truncated, the system's integrity policy hooks are not properly instantiated, preventing the action cache flags from being reset. This oversight means that after truncation, the file is not re-collected,...

Astra Linux – Vulnerabilities in paramiko, libssh, libssh2, erlang, openssh

The SSH transport protocol, with certain OpenSSH extensions, found in OpenSSH versions prior to 9.6 and other products, allows remote attackers to bypass integrity checks. As a result, some packets may be omitted from the extension negotiation message. Consequently, the client and server may end ...

Linux Distros Unpatched Vulnerability : CVE-2026-68554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an...