{ "history": [ { "added": 0, "commit": "b40e7f3f89ade93b7f480b9007ab8aafeb978472", "date": "2026-11-01", "dependencies": 194, "errors": [], "fixable": 74, "go_version": "go1.24.9", "in_binary": { "dependencies": 18, "stdlib": 39, "total": 57 }, "new_vulnerabilities": 0, "osv_confirmed": 84, "osv_only": 0, "ref": "v0.24.1", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 7.0, "upgraded": 0, "vulnerabilities": { "Critical": 12, "High": 34, "Low": 3, "Medium": 30, "Negligible": 0, "Unknown": 5 }, "workflow": { "High": 16, "Low": 6, "Medium": 20, "files": 17 } }, { "added": 0, "commit": "b40e7f3f89ade93b7f480b9007ab8aafeb978472", "date": "2026-11-02", "dependencies": 194, "errors": [], "fixable": 74, "go_version": "go1.24.9", "in_binary": { "dependencies": 17, "stdlib": 40, "total": 57 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 84, "osv_only": 0, "ref": "v0.24.1", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 7.0, "scorecard_date": "2026-11-02", "scorecard_note": null, "scorecard_source": "scorecard-cli", "upgraded": 0, "vulnerabilities": { "Critical": 12, "High": 34, "Low": 3, "Medium": 30, "Negligible": 0, "Unknown": 5 }, "vulnerable_packages": 14, "workflow": { "High": 14, "Low": 6, "Medium": 20, "files": 16 } } ], "latest": { "archived": false, "category": "Container Security \u203a Runtime Security", "changes": { "added": [], "any": false, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v0.24.1", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 1 }, "commit": "b40e7f3f89ade93b7f480b9007ab8aafeb978472", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yaml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v4.3.0", "version": "v4.3.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/labeler.yml", "name": "actions/labeler", "purl": "pkg:github/actions/labeler@v6.0.1", "version": "v6.0.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yaml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v6.0.0", "version": "v6.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/mkdocs-dev.yaml", "name": "actions/setup-python", "purl": "pkg:github/actions/setup-python@v6.0.0", "version": "v6.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release-snapshot.yaml", "name": "aquasecurity/trivy-action", "purl": "pkg:github/aquasecurity/trivy-action@master", "version": "master" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/publish-helm.yaml", "name": "azure/setup-helm", "purl": "pkg:github/azure/setup-helm@v4.3.1", "version": "v4.3.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "codecov/codecov-action", "purl": "pkg:github/codecov/codecov-action@v5.5.1", "version": "v5.5.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/publish-helm.yaml", "name": "dmnemec/copy_file_to_another_repo_action", "purl": "pkg:github/dmnemec/copy_file_to_another_repo_action@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/mkdocs-latest.yaml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v3.5.0", "version": "v3.5.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yaml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v3.30.3#analyze", "version": "v3.30.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yaml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v3.30.3#init", "version": "v3.30.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/publish-helm.yaml", "name": "helm/chart-testing-action", "purl": "pkg:github/helm/chart-testing-action@v2.7.0", "version": "v2.7.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/publish-helm.yaml", "name": "helm/kind-action", "purl": "pkg:github/helm/kind-action@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/fast-forward.yaml", "name": "sequoia-pgp/fast-forward", "purl": "pkg:github/sequoia-pgp/fast-forward@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yaml", "name": "sigstore/cosign-installer", "purl": "pkg:github/sigstore/cosign-installer@v3.10.0", "version": "v3.10.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/auto-author-assign.yml", "name": "toshimaru/auto-author-assign", "purl": "pkg:github/toshimaru/auto-author-assign@v2.1.1", "version": "v2.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cyphar.com/go-pathrs", "purl": "pkg:golang/cyphar.com/go-pathrs@v0.2.1", "version": "v0.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "dario.cat/mergo", "purl": "pkg:golang/dario.cat/mergo@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AdaLogics/go-fuzz-headers", "purl": "pkg:golang/github.com/AdaLogics/go-fuzz-headers@v0.0.0-20230811130428-ced1acdcaa24", "version": "v0.0.0-20230811130428-ced1acdcaa24" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/AdamKorcz/go-118-fuzz-build", "purl": "pkg:golang/github.com/AdamKorcz/go-118-fuzz-build@v0.0.0-20231105174938-2b5cbb29f3e2", "version": "v0.0.0-20231105174938-2b5cbb29f3e2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aquasecurity/libbpfgo", "purl": "pkg:golang/github.com/aquasecurity/libbpfgo@v0.9.2-libbpf-1.5.1.0.20250826165200-6296a7fa0a45", "version": "v0.9.2-libbpf-1.5.1.0.20250826165200-6296a7fa0a45" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/aquasecurity/table", "purl": "pkg:golang/github.com/aquasecurity/table@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/aquasecurity/tracee/api", "purl": "pkg:golang/github.com/aquasecurity/tracee/api", "version": "UNKNOWN" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aquasecurity/tracee/common", "purl": "pkg:golang/github.com/aquasecurity/tracee/common", "version": "UNKNOWN" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aquasecurity/tracee/types", "purl": "pkg:golang/github.com/aquasecurity/tracee/types@v0.0.0-20250902170041-945d17d40601", "version": "v0.0.0-20250902170041-945d17d40601" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/beorn7/perks", "purl": "pkg:golang/github.com/beorn7/perks@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cespare/xxhash/v2", "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "version": "v2.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/cgroups/v3", "purl": "pkg:golang/github.com/containerd/cgroups/v3@v3.0.3", "version": "v3.0.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/containerd", "purl": "pkg:golang/github.com/containerd/containerd@v1.7.29", "version": "v1.7.29" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/containerd/api", "purl": "pkg:golang/github.com/containerd/containerd/api@v1.8.0", "version": "v1.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/continuity", "purl": "pkg:golang/github.com/containerd/continuity@v0.4.4", "version": "v0.4.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/errdefs", "purl": "pkg:golang/github.com/containerd/errdefs@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/fifo", "purl": "pkg:golang/github.com/containerd/fifo@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/log", "purl": "pkg:golang/github.com/containerd/log@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/platforms", "purl": "pkg:golang/github.com/containerd/platforms@v0.2.1", "version": "v0.2.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/ttrpc", "purl": "pkg:golang/github.com/containerd/ttrpc@v1.2.7", "version": "v1.2.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/typeurl/v2", "purl": "pkg:golang/github.com/containerd/typeurl/v2@v2.1.1", "version": "v2.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cpuguy83/go-md2man/v2", "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.6", "version": "v2.0.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cyphar/filepath-securejoin", "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "types/go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "version": "v1.1.2-0.20180830191138-d8f796af33cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/distribution/reference", "purl": "pkg:golang/github.com/distribution/reference@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/docker", "purl": "pkg:golang/github.com/docker/docker@v28.1.1%2Bincompatible", "version": "v28.1.1+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-connections", "purl": "pkg:golang/github.com/docker/go-connections@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-events", "purl": "pkg:golang/github.com/docker/go-events@v0.0.0-20190806004212-e31b211e4f1c", "version": "v0.0.0-20190806004212-e31b211e4f1c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-units", "purl": "pkg:golang/github.com/docker/go-units@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/emicklei/go-restful/v3", "purl": "pkg:golang/github.com/emicklei/go-restful/v3@v3.12.0", "version": "v3.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/evanphx/json-patch/v5", "purl": "pkg:golang/github.com/evanphx/json-patch/v5@v5.9.11", "version": "v5.9.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", "version": "v1.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/fsnotify/fsnotify", "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.8.0", "version": "v1.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fxamacker/cbor/v2", "purl": "pkg:golang/github.com/fxamacker/cbor/v2@v2.7.0", "version": "v2.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.2", "version": "v1.4.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/zapr", "purl": "pkg:golang/github.com/go-logr/zapr@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonpointer", "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v0.21.0", "version": "v0.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/jsonreference", "purl": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.0", "version": "v0.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-openapi/swag", "purl": "pkg:golang/github.com/go-openapi/swag@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/go-viper/mapstructure/v2", "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gogo/protobuf", "purl": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "version": "v1.3.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/groupcache", "purl": "pkg:golang/github.com/golang/groupcache@v0.0.0-20210331224755-41bb18bfe9da", "version": "v0.0.0-20210331224755-41bb18bfe9da" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/protobuf", "purl": "pkg:golang/github.com/golang/protobuf@v1.5.4", "version": "v1.5.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/btree", "purl": "pkg:golang/github.com/google/btree@v1.1.3", "version": "v1.1.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/gnostic-models", "purl": "pkg:golang/github.com/google/gnostic-models@v0.6.8", "version": "v0.6.8" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/gofuzz", "purl": "pkg:golang/github.com/google/gofuzz@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/gopacket", "purl": "pkg:golang/github.com/google/gopacket@v1.1.19", "version": "v1.1.19" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gorilla/websocket", "purl": "pkg:golang/github.com/gorilla/websocket@v1.5.1", "version": "v1.5.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/grafana/pyroscope-go", "purl": "pkg:golang/github.com/grafana/pyroscope-go@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/grafana/pyroscope-go/godeltaprof", "purl": "pkg:golang/github.com/grafana/pyroscope-go/godeltaprof@v0.1.8", "version": "v0.1.8" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/hashicorp/golang-lru", "purl": "pkg:golang/github.com/hashicorp/golang-lru@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/hashicorp/golang-lru/v2", "purl": "pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7", "version": "v2.0.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/huandu/xstrings", "purl": "pkg:golang/github.com/huandu/xstrings@v1.5.0", "version": "v1.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/IBM/fluent-forward-go", "purl": "pkg:golang/github.com/IBM/fluent-forward-go@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/josharian/intern", "purl": "pkg:golang/github.com/josharian/intern@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/json-iterator/go", "purl": "pkg:golang/github.com/json-iterator/go@v1.1.12", "version": "v1.1.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.18.0", "version": "v1.18.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/klauspost/cpuid/v2", "purl": "pkg:golang/github.com/klauspost/cpuid/v2@v2.2.7", "version": "v2.2.7" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/kr/pretty", "purl": "pkg:golang/github.com/kr/pretty@v0.3.1", "version": "v0.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mailru/easyjson", "purl": "pkg:golang/github.com/mailru/easyjson@v0.7.7", "version": "v0.7.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Masterminds/goutils", "purl": "pkg:golang/github.com/Masterminds/goutils@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Masterminds/semver/v3", "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.3.1", "version": "v3.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Masterminds/sprig/v3", "purl": "pkg:golang/github.com/Masterminds/sprig/v3@v3.3.0", "version": "v3.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-runewidth", "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.15", "version": "v0.0.15" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/mattn/go-runewidth", "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.16", "version": "v0.0.16" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mennanov/fmutils", "purl": "pkg:golang/github.com/mennanov/fmutils@v0.3.1", "version": "v0.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Microsoft/go-winio", "purl": "pkg:golang/github.com/Microsoft/go-winio@v0.6.2", "version": "v0.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Microsoft/hcsshim", "purl": "pkg:golang/github.com/Microsoft/hcsshim@v0.12.3", "version": "v0.12.3" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/minio/sha256-simd", "purl": "pkg:golang/github.com/minio/sha256-simd@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/copystructure", "purl": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mitchellh/reflectwalk", "purl": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/docker-image-spec", "purl": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/locker", "purl": "pkg:golang/github.com/moby/locker@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/atomicwriter", "purl": "pkg:golang/github.com/moby/sys/atomicwriter@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/mountinfo", "purl": "pkg:golang/github.com/moby/sys/mountinfo@v0.7.1", "version": "v0.7.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/sequential", "purl": "pkg:golang/github.com/moby/sys/sequential@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/signal", "purl": "pkg:golang/github.com/moby/sys/signal@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/user", "purl": "pkg:golang/github.com/moby/sys/user@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/userns", "purl": "pkg:golang/github.com/moby/sys/userns@v0.1.0", "version": "v0.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/term", "purl": "pkg:golang/github.com/moby/term@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/concurrent", "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "version": "v0.0.0-20180306012644-bacd9c7ef1dd" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/reflect2", "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/morikuni/aec", "purl": "pkg:golang/github.com/morikuni/aec@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/munnerz/goautoneg", "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "version": "v0.0.0-20191010083416-a7dc8b61c822" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/olekukonko/tablewriter", "purl": "pkg:golang/github.com/olekukonko/tablewriter@v0.0.5", "version": "v0.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/runtime-spec", "purl": "pkg:golang/github.com/opencontainers/runtime-spec@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/selinux", "purl": "pkg:golang/github.com/opencontainers/selinux@v1.13.0", "version": "v1.13.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/pelletier/go-toml/v2", "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.3", "version": "v2.2.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/philhofer/fwd", "purl": "pkg:golang/github.com/philhofer/fwd@v1.1.2", "version": "v1.1.2" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "types/go.mod", "name": "github.com/pmezard/go-difflib", "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/pmezard/go-difflib", "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "version": "v1.0.1-0.20181226105442-5d4384ee4fb2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_golang", "purl": "pkg:golang/github.com/prometheus/client_golang@v1.22.0", "version": "v1.22.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/client_model", "purl": "pkg:golang/github.com/prometheus/client_model@v0.6.1", "version": "v0.6.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/common", "purl": "pkg:golang/github.com/prometheus/common@v0.62.0", "version": "v0.62.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/prometheus/procfs", "purl": "pkg:golang/github.com/prometheus/procfs@v0.15.1", "version": "v0.15.1" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/rivo/uniseg", "purl": "pkg:golang/github.com/rivo/uniseg@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rivo/uniseg", "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7", "version": "v0.4.7" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "github.com/rogpeppe/go-internal", "purl": "pkg:golang/github.com/rogpeppe/go-internal@v1.13.1", "version": "v1.13.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/russross/blackfriday/v2", "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", "version": "v2.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/sagikazarmark/locafero", "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.7.0", "version": "v0.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/shopspring/decimal", "purl": "pkg:golang/github.com/shopspring/decimal@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "version": "v1.9.3" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/sourcegraph/conc", "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.12.0", "version": "v1.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/spf13/cast", "purl": "pkg:golang/github.com/spf13/cast@v1.7.1", "version": "v1.7.1" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.9.1", "version": "v1.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.6", "version": "v1.0.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.20.0", "version": "v1.20.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/spf13/viper", "purl": "pkg:golang/github.com/spf13/viper@v1.20.1", "version": "v1.20.1" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "github.com/subosito/gotenv", "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tinylib/msgp", "purl": "pkg:golang/github.com/tinylib/msgp@v1.1.9", "version": "v1.1.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/urfave/cli/v2", "purl": "pkg:golang/github.com/urfave/cli/v2@v2.27.6", "version": "v2.27.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/x448/float16", "purl": "pkg:golang/github.com/x448/float16@v0.8.4", "version": "v0.8.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xrash/smetrics", "purl": "pkg:golang/github.com/xrash/smetrics@v0.0.0-20240521201337-686a1a2994c1", "version": "v0.0.0-20240521201337-686a1a2994c1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opencensus.io", "purl": "pkg:golang/go.opencensus.io@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.54.0", "version": "v0.54.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.34.0", "version": "v1.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.34.0", "version": "v1.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.34.0", "version": "v1.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "go.uber.org/atomic", "purl": "pkg:golang/go.uber.org/atomic@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "go.uber.org/goleak", "purl": "pkg:golang/go.uber.org/goleak@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "go.uber.org/zap", "purl": "pkg:golang/go.uber.org/zap@v1.27.0", "version": "v1.27.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "golang.org/x/arch", "purl": "pkg:golang/golang.org/x/arch@v0.19.0", "version": "v0.19.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.40.0", "version": "v0.40.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "golang.org/x/exp", "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20250718183923-645b1fa84792", "version": "v0.0.0-20250718183923-645b1fa84792" }, { "ecosystem": "golang", "licenses": [], "location": "api/go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.38.0", "version": "v0.38.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.42.0", "version": "v0.42.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.30.0", "version": "v0.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.16.0", "version": "v0.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "api/go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.31.0", "version": "v0.31.0" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.33.0", "version": "v0.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.34.0", "version": "v0.34.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.30.0", "version": "v0.30.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.33.0", "version": "v0.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "api/go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.27.0", "version": "v0.27.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.12.0", "version": "v0.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gomodules.xyz/jsonpatch/v2", "purl": "pkg:golang/gomodules.xyz/jsonpatch/v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto", "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20241118233622-e639e219e697", "version": "v0.0.0-20241118233622-e639e219e697" }, { "ecosystem": "golang", "licenses": [], "location": "api/go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20250218202821-56aae31c358a", "version": "v0.0.0-20250218202821-56aae31c358a" }, { "ecosystem": "golang", "licenses": [], "location": "api/go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.72.0", "version": "v1.72.0" }, { "ecosystem": "golang", "licenses": [], "location": "api/go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.36.6", "version": "v1.36.6" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "gopkg.in/check.v1", "purl": "pkg:golang/gopkg.in/check.v1@v1.0.0-20201130134442-10cb98267c6c", "version": "v1.0.0-20201130134442-10cb98267c6c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/evanphx/json-patch.v4", "purl": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.12.0", "version": "v4.12.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/inf.v0", "purl": "pkg:golang/gopkg.in/inf.v0@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v2", "purl": "pkg:golang/gopkg.in/yaml.v2@v2.4.0", "version": "v2.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "cmd/traceectl/go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "gotest.tools", "purl": "pkg:golang/gotest.tools@v2.2.0%2Bincompatible", "version": "v2.2.0+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gotest.tools/v3", "purl": "pkg:golang/gotest.tools/v3@v3.4.0", "version": "v3.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/api", "purl": "pkg:golang/k8s.io/api@v0.32.4", "version": "v0.32.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/apiextensions-apiserver", "purl": "pkg:golang/k8s.io/apiextensions-apiserver@v0.32.1", "version": "v0.32.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/apimachinery", "purl": "pkg:golang/k8s.io/apimachinery@v0.32.4", "version": "v0.32.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/client-go", "purl": "pkg:golang/k8s.io/client-go@v0.32.1", "version": "v0.32.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/cri-api", "purl": "pkg:golang/k8s.io/cri-api@v0.32.3", "version": "v0.32.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/klog/v2", "purl": "pkg:golang/k8s.io/klog/v2@v2.130.1", "version": "v2.130.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/kube-openapi", "purl": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20241105132330-32ad38e42d3f", "version": "v0.0.0-20241105132330-32ad38e42d3f" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "k8s.io/utils", "purl": "pkg:golang/k8s.io/utils@v0.0.0-20241104100929-3ea5e8cea738", "version": "v0.0.0-20241104100929-3ea5e8cea738" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "kernel.org/pub/linux/libs/security/libcap/cap", "purl": "pkg:golang/kernel.org/pub/linux/libs/security/libcap/cap@v1.2.76", "version": "v1.2.76" }, { "ecosystem": "golang", "licenses": [], "location": "common/go.mod", "name": "kernel.org/pub/linux/libs/security/libcap/psx", "purl": "pkg:golang/kernel.org/pub/linux/libs/security/libcap/psx@v1.2.76", "version": "v1.2.76" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/controller-runtime", "purl": "pkg:golang/sigs.k8s.io/controller-runtime@v0.20.4", "version": "v0.20.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/json", "purl": "pkg:golang/sigs.k8s.io/json@v0.0.0-20241010143419-9aa6b5e7a4b3", "version": "v0.0.0-20241010143419-9aa6b5e7a4b3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/structured-merge-diff/v4", "purl": "pkg:golang/sigs.k8s.io/structured-merge-diff/v4@v4.4.2", "version": "v4.4.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "sigs.k8s.io/yaml", "purl": "pkg:golang/sigs.k8s.io/yaml@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/pr.yaml", "name": "./.github/actions/test-go-module", "purl": "", "version": "UNKNOWN" } ], "description": "Trace Linux runtime activity and security events with eBPF", "errors": [], "go_binary": { "asset": "tracee-x86_64.v0.24.1.tar.gz", "binary": "tracee", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2025-61729", "CVE-2025-61729" ], "epss": { "cve": "CVE-2025-61729", "percentile": 0.39638, "score": 0.00457 }, "fixed_version": "v1.24.11", "id": "GO-2025-4155", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509", "version": "v1.24.9" }, { "aliases": [ "CVE-2025-61727" ], "epss": { "cve": "CVE-2025-61727", "percentile": 0.20933, "score": 0.00284 }, "fixed_version": "v1.24.11", "id": "GO-2025-4175", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509", "version": "v1.24.9" }, { "aliases": [ "CVE-2025-68121" ], "epss": { "cve": "CVE-2025-68121", "percentile": 0.59731, "score": 0.00902 }, "fixed_version": "v1.24.13", "id": "GO-2026-4337", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected session resumption in crypto/tls", "version": "v1.24.9" }, { "aliases": [ "CVE-2025-61730", "CVE-2025-61730" ], "epss": { "cve": "CVE-2025-61730", "percentile": 0.25445, "score": 0.00324 }, "fixed_version": "v1.24.12", "id": "GO-2026-4340", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls", "version": "v1.24.9" }, { "aliases": [ "CVE-2025-61726", "CVE-2025-61726" ], "epss": { "cve": "CVE-2025-61726", "percentile": 0.83237, "score": 0.02292 }, "fixed_version": "v1.24.12", "id": "GO-2026-4341", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory exhaustion in query parameter parsing in net/url", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-25679" ], "epss": { "cve": "CVE-2026-25679", "percentile": 0.57493, "score": 0.00827 }, "fixed_version": "v1.25.8", "id": "GO-2026-4601", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect parsing of IPv6 host literals in net/url", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-27139" ], "epss": { "cve": "CVE-2026-27139", "percentile": 0.12457, "score": 0.00219 }, "fixed_version": "v1.25.8", "id": "GO-2026-4602", "kev": null, "level": "symbol", "module": "stdlib", "summary": "FileInfo can escape from a Root in os", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-27142" ], "epss": { "cve": "CVE-2026-27142", "percentile": 0.31368, "score": 0.00374 }, "fixed_version": "v1.25.8", "id": "GO-2026-4603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "URLs in meta content attribute actions are not escaped in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-32289" ], "epss": { "cve": "CVE-2026-32289", "percentile": 0.21611, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4865", "kev": null, "level": "symbol", "module": "stdlib", "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-32288" ], "epss": { "cve": "CVE-2026-32288", "percentile": 0.21609, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4869", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation for old GNU sparse in archive/tar", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-32283" ], "epss": { "cve": "CVE-2026-32283", "percentile": 0.49799, "score": 0.00621 }, "fixed_version": "v1.25.9", "id": "GO-2026-4870", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-33814" ], "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fixed_version": "v1.25.10", "id": "GO-2026-4918", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-32281" ], "epss": { "cve": "CVE-2026-32281", "percentile": 0.2925, "score": 0.00355 }, "fixed_version": "v1.25.9", "id": "GO-2026-4946", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient policy validation in crypto/x509", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-32280" ], "epss": { "cve": "CVE-2026-32280", "percentile": 0.49458, "score": 0.00615 }, "fixed_version": "v1.25.9", "id": "GO-2026-4947", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected work during chain building in crypto/x509", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39836" ], "epss": { "cve": "CVE-2026-39836", "percentile": 0.50332, "score": 0.00633 }, "fixed_version": "v1.25.10", "id": "GO-2026-4971", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39826" ], "epss": { "cve": "CVE-2026-39826", "percentile": 0.31066, "score": 0.00371 }, "fixed_version": "v1.25.10", "id": "GO-2026-4980", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Escaper bypass leads to XSS in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-33811" ], "epss": { "cve": "CVE-2026-33811", "percentile": 0.58975, "score": 0.00875 }, "fixed_version": "v1.25.10", "id": "GO-2026-4981", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Crash when handling long CNAME response in net", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39823" ], "epss": { "cve": "CVE-2026-39823", "percentile": 0.24388, "score": 0.00314 }, "fixed_version": "v1.25.10", "id": "GO-2026-4982", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Bypass of meta content URL escaping causes XSS in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39821" ], "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fixed_version": "v1.25.13", "id": "GO-2026-5026", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-27145" ], "epss": { "cve": "CVE-2026-27145", "percentile": 0.48256, "score": 0.00591 }, "fixed_version": "v1.25.11", "id": "GO-2026-5037", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient candidate hostname parsing in crypto/x509", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-42504" ], "epss": { "cve": "CVE-2026-42504", "percentile": 0.46636, "score": 0.0056 }, "fixed_version": "v1.25.11", "id": "GO-2026-5038", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-42507" ], "epss": { "cve": "CVE-2026-42507", "percentile": 0.30985, "score": 0.0037 }, "fixed_version": "v1.25.11", "id": "GO-2026-5039", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-42505" ], "epss": { "cve": "CVE-2026-42505", "percentile": 0.32254, "score": 0.00382 }, "fixed_version": "v1.25.12", "id": "GO-2026-5856", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-33818" ], "epss": { "cve": "CVE-2026-33818", "percentile": 0.47077, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-5972", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Enforce maximum recursion depth in encoding/asn1", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-56853" ], "epss": { "cve": "CVE-2026-56853", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6089", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-56862" ], "epss": { "cve": "CVE-2026-56862", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6090", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-56858" ], "epss": { "cve": "CVE-2026-56858", "percentile": 0.23831, "score": 0.0031 }, "fixed_version": "v1.25.13", "id": "GO-2026-6091", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Fix Javascript regexp context tracking in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-56860" ], "epss": { "cve": "CVE-2026-56860", "percentile": 0.46041, "score": 0.0055 }, "fixed_version": "v1.25.13", "id": "GO-2026-6218", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Avoid quadratic complexity in resolvePath in net/url", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.26.9", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.26.9", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.26.9", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.26.9", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.26.9", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v1.26.9", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v1.26.9", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.26.9", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v1.26.9", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.26.10", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-53492", "GHSA-33vj-92qq-66hc" ], "epss": { "cve": "CVE-2026-53492", "percentile": 0.28922, "score": 0.00353 }, "fixed_version": "", "id": "GO-2026-5064", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-50195", "GHSA-cvxm-645q-p574" ], "epss": { "cve": "CVE-2026-50195", "percentile": 0.23133, "score": 0.00303 }, "fixed_version": "", "id": "GO-2026-5338", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-46680", "GHSA-fqw6-gf59-qr4w" ], "epss": { "cve": "CVE-2026-46680", "percentile": 0.05463, "score": 0.00163 }, "fixed_version": "v1.7.32", "id": "GO-2026-5378", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-47262", "GHSA-jpcc-p29g-p8mq" ], "epss": { "cve": "CVE-2026-47262", "percentile": 0.18457, "score": 0.00265 }, "fixed_version": "v1.7.33", "id": "GO-2026-5475", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53489", "GHSA-rgh6-rfwx-v388" ], "epss": { "cve": "CVE-2026-53489", "percentile": 0.06876, "score": 0.00174 }, "fixed_version": "", "id": "GO-2026-5622", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53488", "GHSA-xhf5-7wjv-pqxp" ], "epss": { "cve": "CVE-2026-53488", "percentile": 0.07132, "score": 0.00176 }, "fixed_version": "v1.7.33", "id": "GO-2026-5758", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd CRI \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53495", "GHSA-7jxh-36q5-gcqv" ], "epss": { "cve": "CVE-2026-53495", "percentile": 0.05332, "score": 0.00162 }, "fixed_version": "v1.7.35", "id": "GO-2026-6444", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53493", "GHSA-pg57-6jwg-q645" ], "epss": { "cve": "CVE-2026-53493", "percentile": 0.29375, "score": 0.00356 }, "fixed_version": "v1.7.36", "id": "GO-2026-6597", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-95837", "GHSA-p7v4-vr35-mj6f" ], "epss": { "cve": "CVE-2026-95837", "percentile": 0.011, "score": 0.00106 }, "fixed_version": "", "id": "GO-2026-6791", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd", "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-95838", "GHSA-rp3h-jf77-q9p4" ], "epss": { "cve": "CVE-2026-95838", "percentile": 0.1296, "score": 0.00223 }, "fixed_version": "", "id": "GO-2026-6796", "kev": null, "level": "symbol", "module": "github.com/containerd/containerd/api", "summary": "containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd", "version": "v1.8.0" }, { "aliases": [ "CVE-2026-33997", "GHSA-pxq6-2prw-chj9" ], "epss": { "cve": "CVE-2026-33997", "percentile": 0.34433, "score": 0.00402 }, "fixed_version": "", "id": "GO-2026-4883", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-34040", "GHSA-x744-4wpc-v9h2" ], "epss": { "cve": "CVE-2026-34040", "percentile": 0.95361, "score": 0.0927 }, "fixed_version": "", "id": "GO-2026-4887", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker", "version": "v28.1.1+incompatible" }, { "aliases": [ "GHSA-w67g-5rqw-f597" ], "epss": null, "fixed_version": "v1.5.3", "id": "GO-2026-6278", "kev": null, "level": "symbol", "module": "github.com/gorilla/websocket", "summary": "Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket", "version": "v1.5.1" }, { "aliases": [ "CVE-2026-33186", "GHSA-p77j-4mvh-x3m3" ], "epss": { "cve": "CVE-2026-33186", "percentile": 0.75569, "score": 0.01584 }, "fixed_version": "v1.79.3", "id": "GO-2026-4762", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc", "version": "v1.72.0" }, { "aliases": [ "GHSA-hrxh-6v49-42gf" ], "epss": null, "fixed_version": "v1.82.1", "id": "GO-2026-6061", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-84304", "GHSA-vp52-pcj8-j9qc" ], "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fixed_version": "v1.83.1", "id": "GO-2026-6348", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-84445", "GHSA-2v4p-qf9q-27wj" ], "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fixed_version": "v1.82.2", "id": "GO-2026-6443", "kev": null, "level": "symbol", "module": "google.golang.org/grpc", "summary": "Server panic via missing authority or Host headers in google.golang.org/grpc", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-32282" ], "epss": { "cve": "CVE-2026-32282", "percentile": 0.21771, "score": 0.00292 }, "fixed_version": "v1.25.9", "id": "GO-2026-4864", "kev": null, "level": "package", "module": "stdlib", "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39822" ], "epss": { "cve": "CVE-2026-39822", "percentile": 0.14177, "score": 0.00232 }, "fixed_version": "v1.25.12", "id": "GO-2026-4970", "kev": null, "level": "package", "module": "stdlib", "summary": "Root escape via symlink plus trailing slash in os", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39825" ], "epss": { "cve": "CVE-2026-39825", "percentile": 0.33182, "score": 0.0039 }, "fixed_version": "v1.25.10", "id": "GO-2026-4976", "kev": null, "level": "package", "module": "stdlib", "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.26.9", "id": "GO-2026-6609", "kev": null, "level": "package", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-61801", "GHSA-mjcv-p78q-w5fw" ], "epss": { "cve": "CVE-2026-61801", "percentile": 0.01634, "score": 0.00117 }, "fixed_version": "v0.4.1", "id": "GO-2026-6686", "kev": null, "level": "package", "module": "github.com/moby/sys/user", "summary": "Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user", "version": "v0.3.0" }, { "aliases": [ "CVE-2026-56852" ], "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fixed_version": "v0.39.0", "id": "GO-2026-5970", "kev": null, "level": "package", "module": "golang.org/x/text", "summary": "Infinite loop on invalid input in golang.org/x/text", "version": "v0.27.0" }, { "aliases": [ "CVE-2025-61728", "CVE-2025-61728" ], "epss": { "cve": "CVE-2025-61728", "percentile": 0.54549, "score": 0.00738 }, "fixed_version": "v1.24.12", "id": "GO-2026-4342", "kev": null, "level": "module", "module": "stdlib", "summary": "Excessive CPU consumption when building archive index in archive/zip", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-42499" ], "epss": { "cve": "CVE-2026-42499", "percentile": 0.56521, "score": 0.00798 }, "fixed_version": "v1.25.10", "id": "GO-2026-4977", "kev": null, "level": "module", "module": "stdlib", "summary": "Quadratic string concatenation in consumePhrase in net/mail", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-39820" ], "epss": { "cve": "CVE-2026-39820", "percentile": 0.56059, "score": 0.00784 }, "fixed_version": "v1.25.10", "id": "GO-2026-4986", "kev": null, "level": "module", "module": "stdlib", "summary": "Quadratic string concatentation in consumeComment in net/mail", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-56859" ], "epss": { "cve": "CVE-2026-56859", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6088", "kev": null, "level": "module", "module": "stdlib", "summary": "Add recursion depth guard during decode in encoding/xml", "version": "v1.24.9" }, { "aliases": [ "CVE-2026-42306", "GHSA-rg2x-37c3-w2rh" ], "epss": { "cve": "CVE-2026-42306", "percentile": 0.01018, "score": 0.00104 }, "fixed_version": "", "id": "GO-2026-5617", "kev": null, "level": "module", "module": "github.com/docker/docker", "summary": "Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-41568", "GHSA-vp62-88p7-qqf5" ], "epss": { "cve": "CVE-2026-41568", "percentile": 0.01188, "score": 0.00108 }, "fixed_version": "", "id": "GO-2026-5668", "kev": null, "level": "module", "module": "github.com/docker/docker", "summary": "Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-41567", "GHSA-x86f-5xw2-fm2r" ], "epss": { "cve": "CVE-2026-41567", "percentile": 0.04603, "score": 0.00155 }, "fixed_version": "", "id": "GO-2026-5746", "kev": null, "level": "module", "module": "github.com/docker/docker", "summary": "Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker", "version": "v28.1.1+incompatible" }, { "aliases": [ "GHSA-259r-337f-4rfw" ], "epss": null, "fixed_version": "v1.18.7", "id": "GO-2026-5841", "kev": null, "level": "module", "module": "github.com/klauspost/compress", "summary": "OOB read in github.com/klauspost/compress/s2", "version": "v1.18.0" }, { "aliases": [ "CVE-2025-47913" ], "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fixed_version": "v0.43.0", "id": "GO-2025-4116", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Potential denial of service in golang.org/x/crypto/ssh/agent", "version": "v0.40.0" }, { "aliases": [ "CVE-2025-58181", "GHSA-j5w8-q4qc-rx2x" ], "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fixed_version": "v0.45.0", "id": "GO-2025-4134", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Unbounded memory consumption in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2025-47914", "GHSA-f6x5-jh6r-wrfv" ], "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fixed_version": "v0.45.0", "id": "GO-2025-4135", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39833", "GHSA-jppx-rxg9-jmrx" ], "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fixed_version": "v0.52.0", "id": "GO-2026-5005", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39832", "GHSA-f5wc-c3c7-36mc" ], "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fixed_version": "v0.52.0", "id": "GO-2026-5006", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-46597" ], "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fixed_version": "v0.52.0", "id": "GO-2026-5013", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39828" ], "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fixed_version": "v0.52.0", "id": "GO-2026-5014", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39835" ], "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fixed_version": "v0.52.0", "id": "GO-2026-5015", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39827" ], "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fixed_version": "v0.52.0", "id": "GO-2026-5016", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39830" ], "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fixed_version": "v0.52.0", "id": "GO-2026-5017", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39829" ], "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fixed_version": "v0.52.0", "id": "GO-2026-5018", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39831" ], "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fixed_version": "v0.52.0", "id": "GO-2026-5019", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39834" ], "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fixed_version": "v0.52.0", "id": "GO-2026-5020", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-42508", "GHSA-5cgq-3rg8-m6cv" ], "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fixed_version": "v0.52.0", "id": "GO-2026-5021", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-46595" ], "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fixed_version": "v0.52.0", "id": "GO-2026-5023", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-46598" ], "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fixed_version": "v0.52.0", "id": "GO-2026-5033", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent", "version": "v0.40.0" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-56854" ], "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fixed_version": "v0.55.0", "id": "GO-2026-6303", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-78662" ], "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fixed_version": "v0.56.0", "id": "GO-2026-6354", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-56855" ], "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fixed_version": "v0.56.0", "id": "GO-2026-6355", "kev": null, "level": "module", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh", "version": "v0.40.0" }, { "aliases": [ "CVE-2025-47911" ], "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fixed_version": "v0.45.0", "id": "GO-2026-4440", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Quadratic parsing complexity in golang.org/x/net/html", "version": "v0.42.0" }, { "aliases": [ "CVE-2025-58190" ], "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fixed_version": "v0.45.0", "id": "GO-2026-4441", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Infinite parsing loop in golang.org/x/net", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-42506" ], "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fixed_version": "v0.55.0", "id": "GO-2026-5025", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-42502" ], "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5027", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-25680" ], "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fixed_version": "v0.55.0", "id": "GO-2026-5028", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-25681" ], "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5029", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-27136" ], "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5030", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-46600" ], "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fixed_version": "v0.56.0", "id": "GO-2026-5942", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "module", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-56851" ], "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fixed_version": "v0.41.0", "id": "GO-2026-6629", "kev": null, "level": "module", "module": "golang.org/x/text", "summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text", "version": "v0.27.0" }, { "aliases": [ "CVE-2026-84303", "GHSA-qc2q-p7wx-3px3" ], "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fixed_version": "v1.83.1", "id": "GO-2026-6441", "kev": null, "level": "module", "module": "google.golang.org/grpc", "summary": "Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc", "version": "v1.72.0" } ], "go_version": "go1.24.9", "main_module": "github.com/aquasecurity/tracee" }, "id": "aquasecurity__tracee", "manifests": [ ".github/actions/build-dependencies/action.yaml", ".github/workflows/auto-author-assign.yml", ".github/workflows/codeql.yaml", ".github/workflows/fast-forward.yaml", ".github/workflows/labeler.yml", ".github/workflows/mkdocs-dev.yaml", ".github/workflows/mkdocs-latest.yaml", ".github/workflows/performance.yaml", ".github/workflows/pr-ff.yaml", ".github/workflows/pr-sync.yaml", ".github/workflows/pr.yaml", ".github/workflows/publish-helm.yaml", ".github/workflows/release-snapshot.yaml", ".github/workflows/release.yaml", ".github/workflows/test-daily.yaml", ".github/workflows/test-helm-chart.yaml", "api/go.mod", "api/go.sum", "cmd/traceectl/go.mod", "cmd/traceectl/go.sum", "common/go.mod", "common/go.sum", "go.mod", "go.sum", "types/go.mod", "types/go.sum" ], "name": "tracee", "osv": { "advisories": 114, "available": true, "confirmed": 84, "osv_only": [], "warning": null }, "ref": "v0.24.1", "ref_kind": "release", "release_integrity": { "asset": "tracee-x86_64.v0.24.1.tar.gz", "assets": 4, "build_provenance": null, "checksums_published": true, "digest_matches_github": true, "immutable_release": null, "methods": [], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "checksums-only" }, "released_at": "2025-11-19T00:31:18Z", "repository": "aquasecurity/tracee", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 275 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (220), github (35), file (19) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:06:22+00:00", "scorecard": { "checks": [ { "name": "CII-Best-Practices", "reason": "no effort to earn an OpenSSF best practices badge detected", "score": 0 }, { "name": "Fuzzing", "reason": "project is not fuzzed", "score": 0 }, { "name": "Signed-Releases", "reason": "Project has not signed or included provenance with any releases.", "score": 0 }, { "name": "Vulnerabilities", "reason": "14 existing vulnerabilities detected", "score": 0 }, { "name": "Security-Policy", "reason": "security policy file detected", "score": 4 }, { "name": "Branch-Protection", "reason": "branch protection is not maximal on development and all release branches", "score": 6 }, { "name": "Code-Review", "reason": "Found 12/14 approved changesets -- score normalized to 8", "score": 8 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 8", "score": 8 }, { "name": "Token-Permissions", "reason": "detected GitHub workflow tokens with excessive permissions", "score": 9 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "CI-Tests", "reason": "25 out of 25 merged PRs checked by a CI test -- score normalized to 10", "score": 10 }, { "name": "Contributors", "reason": "project has 22 contributing companies or organizations", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "Dependency-Update-Tool", "reason": "update tool detected", "score": 10 }, { "name": "License", "reason": "license file detected", "score": 10 }, { "name": "Maintained", "reason": "13 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow detected", "score": 10 }, { "name": "SAST", "reason": "SAST tool is run on all commits", "score": 10 } ], "date": "2026-11-02", "score": 7.0, "source": "scorecard-cli", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-53492", "GHSA-33vj-92qq-66hc" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53492", "percentile": 0.28922, "score": 0.00353 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5064", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Critical", "summary": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-50195", "GHSA-cvxm-645q-p574" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-50195", "percentile": 0.23133, "score": 0.00303 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5338", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Critical", "summary": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-42508" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-5cgq-3rg8-m6cv", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status", "url": "https://github.com/advisories/GHSA-5cgq-3rg8-m6cv", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39831" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-89gr-r52h-f8rx", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed", "url": "https://github.com/advisories/GHSA-89gr-r52h-f8rx", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39832" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-f5wc-c3c7-36mc", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys", "url": "https://github.com/advisories/GHSA-f5wc-c3c7-36mc", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39833" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-jppx-rxg9-jmrx", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't enforce invoking key constraints", "url": "https://github.com/advisories/GHSA-jppx-rxg9-jmrx", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39834" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-rm3j-f69w-wqmq", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to infinite loop on large channel writes", "url": "https://github.com/advisories/GHSA-rm3j-f69w-wqmq", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39830" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-vgwf-h737-ff37", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses", "url": "https://github.com/advisories/GHSA-vgwf-h737-ff37", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-46595" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-x527-x647-q7gg", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement", "url": "https://github.com/advisories/GHSA-x527-x647-q7gg", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-33186" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33186", "percentile": 0.75569, "score": 0.01584 }, "fix_state": "fixed", "fixed_in": [ "1.79.3" ], "id": "GHSA-p77j-4mvh-x3m3", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Critical", "summary": "gRPC-Go has an authorization bypass via missing leading slash in :path", "url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-46680" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46680", "percentile": 0.05463, "score": 0.00163 }, "fix_state": "fixed", "fixed_in": [ "1.7.32" ], "id": "GHSA-fqw6-gf59-qr4w", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "High", "summary": "containerd user ID handling bypass allows runAsNonRoot evasion", "url": "https://github.com/advisories/GHSA-fqw6-gf59-qr4w", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53488" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53488", "percentile": 0.07132, "score": 0.00176 }, "fix_state": "fixed", "fixed_in": [ "1.7.33" ], "id": "GHSA-xhf5-7wjv-pqxp", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "High", "summary": "containerd CRI \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull", "url": "https://github.com/advisories/GHSA-xhf5-7wjv-pqxp", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-95837", "GHSA-p7v4-vr35-mj6f" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-95837", "percentile": 0.011, "score": 0.00106 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-6791", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "High", "summary": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-42306" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42306", "percentile": 0.01018, "score": 0.00104 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-rg2x-37c3-w2rh", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "High", "summary": "Docker: Race condition in docker cp allows bind mount redirection to host path", "url": "https://github.com/advisories/GHSA-rg2x-37c3-w2rh", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-41567" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-41567", "percentile": 0.04603, "score": 0.00155 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-x86f-5xw2-fm2r", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "High", "summary": "Docker: `PUT /containers/{id}/archive` executes container binary on the host", "url": "https://github.com/advisories/GHSA-x86f-5xw2-fm2r", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-34040", "GHSA-x744-4wpc-v9h2" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-34040", "percentile": 0.95361, "score": 0.0927 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-4887", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "High", "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker", "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-63209" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-63209", "percentile": 0.47329, "score": 0.00572 }, "fix_state": "fixed", "fixed_in": [ "1.18.7" ], "id": "GHSA-259r-337f-4rfw", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/klauspost/compress", "severity": "High", "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress", "url": "https://github.com/advisories/GHSA-259r-337f-4rfw", "version": "v1.18.0" }, { "aliases": [ "CVE-2026-46597" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-q4h4-gmj2-qvw2", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic", "url": "https://github.com/advisories/GHSA-q4h4-gmj2-qvw2", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39829" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-w879-237q-wc7r", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS", "url": "https://github.com/advisories/GHSA-w879-237q-wc7r", "version": "v0.40.0" }, { "aliases": [ "CVE-2025-47913" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fix_state": "fixed", "fixed_in": [ "0.43.0" ], "id": "GO-2025-4116", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.", "url": "https://go.dev/cl/700295", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-56854" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-6303", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC", "url": "https://go.dev/issue/80213", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-78662" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6354", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket", "url": "https://go.dev/issue/81316", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-56855" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6355", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d", "url": "https://go.dev/issue/81317", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-33814" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fix_state": "fixed", "fixed_in": [ "0.53.0" ], "id": "GO-2026-4918", "in_binary": "vulnerable code in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "url": "https://go.dev/cl/761581", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-33814" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fix_state": "fixed", "fixed_in": [ "0.53.0" ], "id": "GO-2026-4918", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "url": "https://go.dev/cl/761581", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-39821" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5026", "in_binary": "vulnerable code in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna pac", "url": "https://go.dev/cl/767220", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-39821" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5026", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna pac", "url": "https://go.dev/cl/767220", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-46600" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-5942", "in_binary": "module in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "url": "https://go.dev/cl/786345", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-46600" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-5942", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "url": "https://go.dev/cl/786345", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-56852" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fix_state": "fixed", "fixed_in": [ "0.39.0" ], "id": "GO-2026-5970", "in_binary": "package in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "url": "https://go.dev/issue/80142", "version": "v0.23.0" }, { "aliases": [ "CVE-2026-56852" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fix_state": "fixed", "fixed_in": [ "0.39.0" ], "id": "GO-2026-5970", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "url": "https://go.dev/issue/80142", "version": "v0.27.0" }, { "aliases": [ "CVE-2026-56851" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "0.41.0" ], "id": "GO-2026-6629", "in_binary": "module in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "url": "https://go.dev/cl/793360", "version": "v0.23.0" }, { "aliases": [ "CVE-2026-56851" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "0.41.0" ], "id": "GO-2026-6629", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "url": "https://go.dev/cl/793360", "version": "v0.27.0" }, { "aliases": [ "CVE-2026-84445" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fix_state": "fixed", "fixed_in": [ "1.82.2" ], "id": "GHSA-2v4p-qf9q-27wj", "in_binary": "vulnerable code in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers", "url": "https://github.com/advisories/GHSA-2v4p-qf9q-27wj", "version": "v1.72.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "fixed", "fixed_in": [ "1.82.1" ], "id": "GHSA-hrxh-6v49-42gf", "in_binary": "vulnerable code in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-84304" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-vp52-pcj8-j9qc", "in_binary": "vulnerable code in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation", "url": "https://github.com/advisories/GHSA-vp52-pcj8-j9qc", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-53495" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53495", "percentile": 0.05332, "score": 0.00162 }, "fix_state": "fixed", "fixed_in": [ "1.7.35" ], "id": "GHSA-7jxh-36q5-gcqv", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service", "url": "https://github.com/advisories/GHSA-7jxh-36q5-gcqv", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-47262" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-47262", "percentile": 0.18457, "score": 0.00265 }, "fix_state": "fixed", "fixed_in": [ "1.7.33" ], "id": "GHSA-jpcc-p29g-p8mq", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "containerd image-triggered runtime DoS via unbounded group parsing", "url": "https://github.com/advisories/GHSA-jpcc-p29g-p8mq", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53493" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53493", "percentile": 0.29375, "score": 0.00356 }, "fix_state": "fixed", "fixed_in": [ "1.7.36" ], "id": "GHSA-pg57-6jwg-q645", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "Containerd has image-pull DoS via crafted OCI index graph amplification", "url": "https://github.com/advisories/GHSA-pg57-6jwg-q645", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-95838" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-95838", "percentile": 0.1296, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "1.7.35" ], "id": "GHSA-rp3h-jf77-q9p4", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "containerd: Unpack DoS via repeated opaque whiteouts", "url": "https://github.com/advisories/GHSA-rp3h-jf77-q9p4", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-53489", "GHSA-rgh6-rfwx-v388" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-53489", "percentile": 0.06876, "score": 0.00174 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5622", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/containerd/containerd", "severity": "Medium", "summary": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd", "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388", "version": "v1.7.29" }, { "aliases": [ "CVE-2026-33997" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33997", "percentile": 0.34433, "score": 0.00402 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-pxq6-2prw-chj9", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "Medium", "summary": "Moby has an Off-by-one error in its plugin privilege validation", "url": "https://github.com/advisories/GHSA-pxq6-2prw-chj9", "version": "v28.1.1+incompatible" }, { "aliases": [ "CVE-2026-41568" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-41568", "percentile": 0.01188, "score": 0.00108 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-vp62-88p7-qqf5", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "Medium", "summary": "Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap", "url": "https://github.com/advisories/GHSA-vp62-88p7-qqf5", "version": "v28.1.1+incompatible" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "fixed", "fixed_in": [ "1.5.3" ], "id": "GHSA-w67g-5rqw-f597", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/gorilla/websocket", "severity": "Medium", "summary": "Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key", "url": "https://github.com/advisories/GHSA-w67g-5rqw-f597", "version": "v1.5.1" }, { "aliases": [ "CVE-2026-61801" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-61801", "percentile": 0.01634, "score": 0.00117 }, "fix_state": "fixed", "fixed_in": [ "0.4.1" ], "id": "GHSA-mjcv-p78q-w5fw", "in_binary": "package in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/moby/sys/user", "severity": "Medium", "summary": "github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files", "url": "https://github.com/advisories/GHSA-mjcv-p78q-w5fw", "version": "v0.3.0" }, { "aliases": [ "CVE-2026-39828" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-45gg-vh54-h5m9", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions", "url": "https://github.com/advisories/GHSA-45gg-vh54-h5m9", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39835" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-78mq-xcr3-xm33", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow", "url": "https://github.com/advisories/GHSA-78mq-xcr3-xm33", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-46598" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-9m57-25v3-79x9", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking pathological inputs can lead to client panic", "url": "https://github.com/advisories/GHSA-9m57-25v3-79x9", "version": "v0.40.0" }, { "aliases": [ "CVE-2025-47914" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-f6x5-jh6r-wrfv", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read", "url": "https://github.com/advisories/GHSA-f6x5-jh6r-wrfv", "version": "v0.40.0" }, { "aliases": [ "CVE-2025-58181" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-j5w8-q4qc-rx2x", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption", "url": "https://github.com/advisories/GHSA-j5w8-q4qc-rx2x", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-39827" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-qpw4-5x99-6vjp", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS", "url": "https://github.com/advisories/GHSA-qpw4-5x99-6vjp", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-25680" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GHSA-5cv4-jp36-h3mw", "in_binary": "module in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Go Net HTML parser is vulnerable to denial of service", "url": "https://github.com/advisories/GHSA-5cv4-jp36-h3mw", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-25680" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GHSA-5cv4-jp36-h3mw", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Go Net HTML parser is vulnerable to denial of service", "url": "https://github.com/advisories/GHSA-5cv4-jp36-h3mw", "version": "v0.42.0" }, { "aliases": [ "CVE-2025-47911" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4440", "in_binary": "module in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://go.dev/cl/709876", "version": "v0.38.0" }, { "aliases": [ "CVE-2025-47911" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4440", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://go.dev/cl/709876", "version": "v0.42.0" }, { "aliases": [ "CVE-2025-58190" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4441", "in_binary": "module in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c", "version": "v0.38.0" }, { "aliases": [ "CVE-2025-58190" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4441", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-42506" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5025", "in_binary": "module in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79571", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-42506" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5025", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79571", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-42502" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5027", "in_binary": "module in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79572", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-42502" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5027", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79572", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-25681" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5029", "in_binary": "module in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79574", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-25681" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5029", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79574", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-27136" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5030", "in_binary": "module in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79575", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-27136" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5030", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79575", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-84303" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-qc2q-p7wx-3px3", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Medium", "summary": "gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion", "url": "https://github.com/advisories/GHSA-qc2q-p7wx-3px3", "version": "v1.72.0" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.31.0" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "common/go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.33.0" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.34.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.40.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "module in binary", "kev": null, "location": "api/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.42.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "module in binary", "kev": null, "location": "cmd/traceectl/go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.38.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.42.0" } ], "workflow_audit": { "files": 16, "findings": [ { "confidence": "Medium", "description": "use of fundamentally insecure workflow trigger", "file": ".github/workflows/auto-author-assign.yml", "line": 5, "note": "this workflow", "rule": "dangerous-triggers", "severity": "High", "url": "https://docs.zizmor.sh/audits/#dangerous-triggers" }, { "confidence": "Medium", "description": "use of fundamentally insecure workflow trigger", "file": ".github/workflows/fast-forward.yaml", "line": 2, "note": "this workflow", "rule": "dangerous-triggers", "severity": "High", "url": "https://docs.zizmor.sh/audits/#dangerous-triggers" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/mkdocs-latest.yaml", "line": 41, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/pr-sync.yaml", "line": 43, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/pr.yaml", "line": 187, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/pr.yaml", "line": 674, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release-snapshot.yaml", "line": 38, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release-snapshot.yaml", "line": 77, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/release.yaml", "line": 44, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/release.yaml", "line": 51, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/release.yaml", "line": 89, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/release.yaml", "line": 96, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/release.yaml", "line": 126, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "High", "description": "code injection via template expansion", "file": ".github/workflows/release.yaml", "line": 139, "note": "this step", "rule": "template-injection", "severity": "High", "url": "https://docs.zizmor.sh/audits/#template-injection" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/mkdocs-dev.yaml", "line": 14, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/mkdocs-latest.yaml", "line": 12, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr-sync.yaml", "line": 16, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 4, "note": "default permissions used due to no permissions: block", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 79, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 93, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 137, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 171, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 233, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 274, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 332, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 370, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 423, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 461, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 502, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 530, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/pr.yaml", "line": 597, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/publish-helm.yaml", "line": 21, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-daily.yaml", "line": 12, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/test-helm-chart.yaml", "line": 9, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/pr.yaml", "line": 253, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/pr.yaml", "line": 260, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/pr.yaml", "line": 267, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/pr.yaml", "line": 308, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/pr.yaml", "line": 315, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/pr.yaml", "line": 322, "note": "this step", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" } ] } }, "updated": "2026-11-02" }