Toward greater transparency: Expanding machine-readable Vulnerability Exploitability eXchange (VEX)

Starting today, Microsoft is publishing Vulnerability Exploitability eXchange VEX statements for all Microsoft-assigned CVEs. Building on our work with theCommon Security Advisory Framework CSAFand our previousAzure Linux VEX implementation, this latest milestone in the Microsoft Security Respons...

CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

TencentOS Server 4: golang (TSSA-2026:0882)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0882 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

key-transparency-auditor v20260818.0.0

key-transparency-auditor A reference implementation of a third-party auditor for Signal's key transparency service, based on the key transparency specification. Overview This service is written in Java using the Micronaut framework. To build and unit test, run root@kitploit: ./mvnw clean test in...

CVE-2026-56865

A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy GOPROXY could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparenc...

Police Are Hiding Their Use of Flock Surveillance Cameras

A usage policy for Flock license plate reader cameras tells police not to talk about the cameras: When cops use Flock to arrest someone in Wapello County, Iowa, they don't want them to know. A usage policy for the automated license plate reader cameras in the county tells police, in no uncertain...

BIT-GOLANG-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

BIT-GOLANG-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

SUSE-SU-2026:23301-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

PT-2026-79925

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

PT-2026-83508

Name of the Vulnerable Software and Affected Versions Imager::File::PNG versions 1.003 through 1.003 Description A heap corruption issue exists when reading a PNG file containing a tRNS transparency chunk via the read direct8 function. The function adds an alpha channel to the created image but...

SUSE CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

SUSE CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: prometheus-fips, elastic-agent, prometheus, commercial-grafana, ld-relay, opentelemetry-collector-k8s-fips, jaeger, jaeger-fips, keda-fips, prometheus-pushgateway-fips, cloud-sql-proxy, datadog-agent-fips, keda, loki, grafana-fips, metrics-server, metrics-server-fips...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, osv-scanner, hubble-ui, cloudnative-pg, cilium-cli, grpc-health-probe, k8sgpt-operator, temporal, minio, falcosidekick, pulumi-language-dotnet, kaniko, kube-rbac-proxy, dbmate, ferretdb, spegel, tflint, restic, sigstore-scaffolding,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: istio, minio, minio-object-browser, karma, cloud-sql-proxy, mcp-grafana, keda, prometheus-pushgateway, splunk-otel-collector, jaeger, aws-otel-collector, tempo, mc, datadog-agent, certificate-transparency, loki, trillian, telegraf, minio-operator, grafana-pyroscope...

GO-2026-5381 vulnerabilities

Vulnerabilities for packages: istio, fluent-bit-plugin-loki, minio, minio-object-browser, karma, cloud-sql-proxy, metrics-server, mcp-grafana, keda, prometheus-pushgateway, splunk-otel-collector, jaeger, aws-otel-collector, tempo, mc, node-problem-detector, datadog-agent, certificate-transparency...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: prometheus, istio, fluent-bit-plugin-loki, minio, prometheus-operator, karma, cloud-sql-proxy, metrics-server, keda, prometheus-pushgateway, splunk-otel-collector, jaeger, aws-otel-collector, tempo, mc, node-problem-detector, datadog-agent, certificate-transparency,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: juicefs, gitea, kubeflow-pipelines, temporal, db-operator, envoy-gateway, minio, crossplane-provider-sql, ratify, seaweedfs, wolfictl, grafana-alloy, tkn, kyverno-policy-reporter, temporal-server, dbmate, dgraph, amass, flux-kustomize-controller, splunk-otel-collecto...