Every CVE Search/ Get API key

CVE-2026-26958

filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

1.7 LowFix available

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.41%Up 0.4 points since Feb 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 1.7

filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
CVE-2026-26958
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-665
Updated
2026-11-02
EUVDEUVD-2026-8418 1.7

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
EUVD-2026-8418
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-fw7p-63qq-7hpr 1.7

filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

(*Point).MultiScalarMult failed to initialize its receiver.

If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on filippo.io/edwards25519 via github.com/go-sql-driver/mysql, you are not affected. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like govulncheck.

Record
GHSA-fw7p-63qq-7hpr
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-665
Updated
2026-11-02
NVD 1.7

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
CVE-2026-26958
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-665
Updated
2026-11-02
OSV 1.7

filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
CVE-2026-26958
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-665
Updated
2026-11-02
OSVDEBIAN-CVE-2026-26958 1.7

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
DEBIAN-CVE-2026-26958
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 23 moreShow less
OSVGHSA-fw7p-63qq-7hpr 1.7

filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

(*Point).MultiScalarMult failed to initialize its receiver.

If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on filippo.io/edwards25519 via github.com/go-sql-driver/mysql, you are not affected. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like govulncheck.

Record
GHSA-fw7p-63qq-7hpr
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-665
Updated
2026-11-02
OSVUBUNTU-CVE-2026-26958 1.7

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
UBUNTU-CVE-2026-26958
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
OSVAZL-78123 No score

CVE-2026-26958 affecting package keda 2.14.1-11

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
AZL-78123
Updated
2026-11-02
OSVAZL-78216 No score

CVE-2026-26958 affecting package telegraf 1.31.0-15

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

Record
AZL-78216
Updated
2026-11-02
OSVGO-2026-4503 No score

Invalid result or undefined behavior in filippo.io/edwards25519

Previously, if MultiScalarMult was invoked on an initialized point who was not the identity point, MultiScalarMult produced an incorrect result. If called on an uninitialized point, MultiScalarMult exhibited undefined behavior.

Record
GO-2026-4503
Updated
2026-11-02
OSVopenSUSE-SU-2026:10235-1 No score

cosign-3.0.5-1.1 on GA media

These are all security issues fixed in the cosign-3.0.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10235-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10601-1 No score

grafana-11.6.14+security01-1.1 on GA media

These are all security issues fixed in the grafana-11.6.14+security01-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10618-1 No score

alloy-1.15.1-1.1 on GA media

These are all security issues fixed in the alloy-1.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10618-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11650-1 No score

gopass-1.17.0-1.1 on GA media

These are all security issues fixed in the gopass-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11650-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12300-1 No score

kumactl-3.0.0-1.1 on GA media

These are all security issues fixed in the kumactl-3.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12300-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20386-1 No score

Security update for cosign

This update for cosign fixes the following issues:

Update to version 3.0.5:

  • CVE-2026-24122: Fixed improper validation of certificates that outlive expired CA certificates (bsc#1258542)
  • CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612)
  • CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139)
  • CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562)
  • CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080)
  • CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085)
  • CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620)
  • CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry under certain conditions (bsc#1256496)
  • CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913)
Record
openSUSE-SU-2026:20386-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20752-1 No score

Security update for alloy

This update for alloy fixes the following issues

Security issues:

  • CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).

Non security issue:

  • Updated to 1.16.0
  • Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)
Record
openSUSE-SU-2026:20752-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20902-1 No score

Security update for keybase-client

This update for keybase-client fixes the following issues:

Changes in keybase-client:

  • golang.org/x/crypto/ssh: Fixed multiple issues: CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)

  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (boo#1266596).

  • Update to version 6.6.2

    • Improve git default branch handling

  • CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)

  • Switch to go1.25 as required by update go image library.

  • Update to version 6.6.0

    • Various bug fixes and performance improvements

  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258591).

  • CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254023).

  • CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253864).

  • CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).

  • Update to version 6.5.1

    • Fix team deletion not working
    • Chat attachments improvements
    • Miscellaneous bugfixes
Record
openSUSE-SU-2026:20902-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20940-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266600)

  • Update to version 11.6.14+security-04: Security:

    • CVE-2026-28374: Fix insecure direct object reference in Annotations API (bsc#1265290)
    • CVE-2026-28376: Fix unbounded memory allocation in Grafana Live push endpoint (bsc#1265289)
    • CVE-2026-28383: Fix unbounded memory allocation in Grafana plugin resources (bsc#1265286)
    • CVE-2026-28380: Fix broken access control in Snapshot API (bsc#1265287)
    • CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass (bsc#1265285)
    • CVE-2026-28379: Fix viewer-triggered race condition in Grafana Live (bsc#1265288)
    • CVE-2026-33377: Fix dashboard Editor Privilege Escalation (bsc#1265284)
    • CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin (bsc#1265283)
    • CVE-2026-33381: Prevent users from generating Service Account tokens after permissions removal (bsc#1265281)
    • CVE-2026-33380: Fix vulnerability in SQL Expressions allowing an authenticated attacker to read arbitrary files from the Grafana server’s filesystem (bsc#1265282)

  • CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)

  • CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)

  • CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)

  • CVE-2026-21725: Fix missing UID when deleting datasource by name (bsc#1258873)

  • Update to version 11.6.14+security-01: Security:

    • CVE-2026-33375: Fix denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)

  • Update to version 11.6.14: Security:

    • CVE-2026-27876: Fix remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fix information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fix denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fix denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fix authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fix authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Update to version 11.6.13: Enhancement:

    • Wire the public dashboard service to the HTTP server

  • Update to version 11.6.12: Enhancement:

    • Update authentication redirect logic Bug fix:
    • Fix single panel render with variable references
Record
openSUSE-SU-2026:20940-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:0757-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260226T182644 2026-02-26T18:26:44Z (jsc#PED-11136) Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-4259 CVE-2025-13767 GHSA-fmqf-pmcm-8cx9
  • GO-2025-4260 CVE-2025-64641 GHSA-vww6-79rv-3j4x
  • GO-2026-4282 CVE-2017-18873 GHSA-x6mw-hf2j-vqpc
  • GO-2026-4305 CVE-2017-18903 GHSA-fcwg-45jh-5qhf
  • GO-2026-4325 CVE-2025-14822 GHSA-9r42-rhw3-2222
  • GO-2026-4326 CVE-2025-14435 GHSA-mx8m-v8qm-xwr8
  • GO-2026-4332 CVE-2026-23644 GHSA-2657-3c98-63jq
  • GO-2026-4348 CVE-2026-23991 GHSA-846p-jg2w-w324
  • GO-2026-4349 CVE-2026-23992 GHSA-fphv-w9fq-2525
  • GO-2026-4377 CVE-2026-24686 GHSA-jqc5-w2xx-5vq4
  • GO-2026-4410 CVE-2026-25140 GHSA-f4w5-5xv9-85f6
  • GO-2026-4502 CVE-2026-25766 GHSA-pgvm-wxw2-hrv9
  • GO-2026-4534 CVE-2026-25899 GHSA-2mr3-m5q5-wgp6
  • GO-2026-4535 CVE-2026-27585 GHSA-4xrr-hq4w-6vf4
  • GO-2026-4536 CVE-2026-27590 GHSA-5r3v-vc8m-m96g
  • GO-2026-4537 CVE-2026-27589 GHSA-879p-475x-rqh2
  • GO-2026-4538 CVE-2026-27587 GHSA-g7pc-pc7g-h8jh
  • GO-2026-4539 CVE-2026-27586 GHSA-hffm-g8v7-wrv7
  • GO-2026-4540 CVE-2026-25891 GHSA-m3c2-496v-cw3v
  • GO-2026-4541 CVE-2026-27588 GHSA-x76f-jf84-rqj8
  • GO-2026-4543 CVE-2026-25882 GHSA-mrq8-rjmw-wpq3
  • GO-2026-4559 CVE-2026-27141

Update to version 0.0.20260225T230704 2026-02-25T23:07:04Z.

  • GO-2026-4358 CVE-2026-24137 GHSA-fcv2-xgw5-pqxf
  • GO-2026-4361 GHSA-c32p-wcqj-j677
  • GO-2026-4394 CVE-2026-24051 GHSA-9h8m-3fm2-qjrq
  • GO-2026-4399 CVE-2026-25518 GHSA-gx3x-vq4p-mhhv
  • GO-2026-4507 CVE-2026-26314 GHSA-2gjw-fg97-vg3r
  • GO-2026-4508 CVE-2026-26313 GHSA-689v-6xwf-5jf3
  • GO-2026-4509 CVE-2026-27017 GHSA-7m29-f4hw-g2vx
  • GO-2026-4511 CVE-2026-26315 GHSA-m6j8-rg6r-7mv8
  • GO-2026-4512 CVE-2026-26995 GHSA-rrxv-pmq9-x67r
  • GO-2026-4531 CVE-2026-25591 GHSA-w6x6-9fp7-fqm4
  • GO-2026-4532 CVE-2026-25802 GHSA-299v-8pq9-5gjq
  • GO-2026-4533 CVE-2026-27571 GHSA-qrvq-68c2-7grw
  • GO-2026-4542 CVE-2026-27598 GHSA-6v48-fcq6-ff23
  • GO-2026-4545 CVE-2025-50180 GHSA-3c9r-837r-qqm4
  • GO-2026-4546 CVE-2026-27611 GHSA-8vrh-3pm2-v4v6
  • GO-2026-4547 CVE-2026-27626 GHSA-49gm-hh7w-wfvf
  • GO-2026-4548 GHSA-2phg-qgmm-r638

Update to version 0.0.20260223T182315 2026-02-23T18:23:15Z.

  • GO-2026-4392 CVE-2026-24845 GHSA-9m43-p3cx-w8j5
  • GO-2026-4434 CVE-2023-43635 GHSA-4jvr-vj2c-8q37
  • GO-2026-4435 CVE-2023-43636 GHSA-5h7v-g49c-h887
  • GO-2026-4436 CVE-2023-43637 GHSA-g7vp-j25f-h34p
  • GO-2026-4442 GHSA-x9p2-77v6-6vhf
  • GO-2026-4444 CVE-2026-23989 GHSA-9j2f-3rj3-wgpg
  • GO-2026-4445 CVE-2026-25760 GHSA-2286-hxv5-cmp2
  • GO-2026-4446 CVE-2026-24851 GHSA-jq9f-gm9w-rwm9
  • GO-2026-4447 GHSA-vf5j-r2hw-2hrw
  • GO-2026-4448 CVE-2025-64111 GHSA-gg64-xxr9-qhjp
  • GO-2026-4449 CVE-2025-64175 GHSA-p6x6-9mx6-26wj
  • GO-2026-4450 CVE-2026-23632 GHSA-5qhx-gwfj-6jqr
  • GO-2026-4451 CVE-2026-22592 GHSA-cr88-6mqm-4g57
  • GO-2026-4452 CVE-2026-24135 GHSA-jp7c-wj6q-3qf2
  • GO-2026-4453 CVE-2026-23633 GHSA-mrph-w4hh-gx3g
  • GO-2026-4454 GHSA-26gq-grmh-6xm6
  • GO-2026-4455 CVE-2025-70963 GHSA-9f8m-9547-2gqm
  • GO-2026-4456 CVE-2025-13523 GHSA-ffx7-34p2-vm3w
  • GO-2026-4457 CVE-2025-65852 GHSA-rjv5-9px2-fqw6
  • GO-2026-4458 CVE-2026-25793 GHSA-69x3-g4r3-p962
  • GO-2026-4459 CVE-2017-18907 GHSA-42x9-rr3c-gr59
  • GO-2026-4460 CVE-2017-18918 GHSA-5ghq-28r7-qwfj
  • GO-2026-4461 CVE-2026-25804 GHSA-86x4-wp9f-wrr9
  • GO-2026-4462 CVE-2017-18915 GHSA-hxxj-8phw-74vw
  • GO-2026-4463 CVE-2017-18917 GHSA-jxc4-w54c-qv5r
  • GO-2026-4464 CVE-2017-18911 GHSA-m462-mqw4-2c8m
  • GO-2026-4465 GHSA-vhvq-fv9f-wh4q
  • GO-2026-4466 CVE-2026-25791 GHSA-wxrw-gvg8-fqjp
  • GO-2026-4467 CVE-2017-18916 GHSA-x33g-375j-jhf7
  • GO-2026-4471 CVE-2025-66630 GHSA-68rr-p4fp-j59v
  • GO-2026-4473 CVE-2026-25934 GHSA-37cx-329c-33x3
  • GO-2026-4474 CVE-2026-25890 GHSA-4mh3-h929-w968
  • GO-2026-4475 CVE-2026-25889 GHSA-hxw8-4h9j-hq2r
  • GO-2026-4476 CVE-2017-18908…
Record
SUSE-SU-2026:0757-1
Updated
2026-11-02
OSVSUSE-SU-2026:0777-1 No score

Security update for cosign

This update for cosign fixes the following issues:

Update to version 3.0.5 (jsc#SLE-23879).

Security issues fixed:

  • CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620).
  • CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913).
  • CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496).
  • CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562).
  • CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080).
  • CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085).
  • CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542).
  • CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612).

Other updates and bugfixes:

  • chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  • chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  • chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  • chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  • chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  • chore(deps): bump the actions group with 3 updates (#4703)
  • update golang builder to use go1.25.7 (#4687)
  • update golangci-lint to v2.8.x (#4688)
  • Support DSSE signing conformance test (#4685)
  • chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  • Deprecate rekor-entry-type flag (#4691)
  • Deprecate cosign triangulate (#4676)
  • Deprecate cosign copy (#4681)
  • Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  • chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  • chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  • Automatically require signed timestamp with Rekor v2 entries (#4666)
  • Fix syntax issue in conformance test, update nightly (#4664)
  • Add mTLS support for TSA client connections when signing with a signing config (#4620)
  • fix: avoid panic on malformed tlog entry body (#4652)
  • Verify validity of chain rather than just certificate (#4663)
  • Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  • chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  • Bump sigstore/sigstore to resolve GHSA (#4660)
  • Gracefully fail if bundle payload body is not a string (#4648)
  • fix: avoid panic on malformed replace payload (#4653)
  • chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  • fix: avoid panic on malformed attestation payload (#4651)
  • fix: avoid panic on malformed tlog entries (#4649)
  • Update conformance to latest
  • docs(cosign): clarify RFC3161 revocation semantics (#4642)
  • Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  • chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  • Add origin key for ctfe trusted root
  • Add changelog updates for v3.0.4 and v2.6.2 (#4625)
  • Update to version 3.0.4:
  • Fix bundle verify path for old bundle/trusted root (#4623)
  • chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  • chore(deps): bump cuelang.org/go in the gomod group (#4615)
  • Optimize cosign tree performance by caching digest resolution (#4612)
  • Don't require a trusted root to verify offline with a key (#4613)
  • Support default services for trusted-root and…
Record
SUSE-SU-2026:0777-1
Updated
2026-11-02
OSVSUSE-SU-2026:1524-1 No score

Security update 5.1.3 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

  • Internal changes to fix build issues with no impact for customers

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bumped rollup to version 4.59.0
    • CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
      • Bumped brace-expansion to version 5.0.2
    • CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
    • CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bumped google.golang.org/grpc to version 1.79.3

grafana:

  • Security issues fixed:

    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)
    • CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
    • CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
    • CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)
    • CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:

    • Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability
    • Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences
    • Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced
    • Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface
    • One-Click Actions: Visualizations now support faster navigation via one-click links and actions
    • Alerting History: Added version history for alert rules, allowing you to track changes over time
    • Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
    • Cron Support: Annotations now support Cron syntax for more flexible scheduling
    • Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath
    • Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting
    • Alerting Limits: Added size limits for expanded notification templates to prevent system strain
    • RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
    • Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries
    • Dashboard Reliability:
      • Fixed bugs involving row repeats and 'self-referencing' data links
      • Fixed a bug preventing single panels from…
Record
SUSE-SU-2026:1524-1
Updated
2026-11-02
OSVSUSE-SU-2026:20904-1 No score

Security update for cosign

This update for cosign fixes the following issues:

Update to version 3.0.5:

  • CVE-2026-24122: Fixed improper validation of certificates that outlive expired CA certificates (bsc#1258542)
  • CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258612)
  • CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257139)
  • CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256562)
  • CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned by TUF repository (bsc#1257080)
  • CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a compromised or misconfigured TUF repository (bsc#1257085)
  • CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620)
  • CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry under certain conditions (bsc#1256496)
  • CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253913)
Record
SUSE-SU-2026:20904-1
Updated
2026-11-02
OSVSUSE-SU-2026:21793-1 No score

Security update for alloy

This update for alloy fixes the following issues

Security issues:

  • CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).

Non security issue:

  • Updated to 1.16.0
  • Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815)
Record
SUSE-SU-2026:21793-1
Updated
2026-11-02
OSVSUSE-SU-2026:2243-1 No score

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Security Fixes:

    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)

golang-github-prometheus-node_exporter:

  • Backward Compatibility and packaging changes:

    • Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains
    • Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility

  • Version 1.10.2:

    • Fixed typo in Zswap metric name (meminfo)

  • Version 1.10.1:

    • Fixed mount points being collected multiple times (filesystem)
    • Refactored mountinfo parsing (bsc#1261810)
    • Added Zswap/Zswapped metrics (meminfo)

  • Version 1.10.0:

    • New collectors: PCIe devices, swaps
    • Added systemd virtualization metrics, AIX metrics
    • WiFi packet metrics, additional PCIe and TLB metrics
    • Changed mdadm to use sysfs, added erofs to excluded filesystems
    • Fixed bugs: cpufreq collector, ethtool metrics

golang-github-prometheus-prometheus:

  • Security issues fixed:

    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987).
    • CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)
      • Bump google.golang.org/grpc to version 1.79.3
    • CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      • Bump rollup to version 4.59.0

  • Other changes:

    • Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit.
    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)

prometheus-postgres_exporter:

  • Security Fixes:

    • CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987)
    • CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986)
    • CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)

  • Highlights of other changes and bug fixes:

    • Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy

grafana was updated from version 11.6.11 to 11.6.14+security01:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references

spacecmd:

  • Version…
Record
SUSE-SU-2026:2243-1
Updated
2026-11-02
OSVSUSE-SU-2026:2258-1 No score

Security update for grafana

This update for grafana to version to 11.6.14+security01 fixes the following issues:

  • Security Fixes:

    • CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)
    • CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)
    • CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595)
    • CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)
    • CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)
    • CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)
    • CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)
    • CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)
    • CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)
    • CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)
    • CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)

  • Highlights of other changes and bug fixes:

    • Version 11.6.13:

      • Wire the public dashboard service to the HTTP server

    • Version 11.6.12:

      • Update authentication redirect logic
      • Fixed single panel render with variable references
Record
SUSE-SU-2026:2258-1
Updated
2026-11-02
OSVSUSE-SU-2026:2438-1 No score

Security update for alloy

This update for alloy fixes the following issues

Security issues:

  • CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message (bsc#1259919).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258099).
  • CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results and lead to undefined behavior (bsc#1258609).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260317).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262955).
  • CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263530).

Non security issue:

  • Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
  • Update to version 1.16.1
  • Bug Fixes logging: Fix startup deadlock when components log before logging config is evaluated Update to Beyla 3.9.8 Migrate from Docker to Moby
  • Use latest openSUSE Tumbleweed image for building web UI assets
  • Install nvm to set node version specified upstream
  • update to 1.16.0:
  • Features
  • Add clustering for loki.source.kubernetes_events (#6027) (3dbf587) (@petewall)
  • Add otelcol.auth.google client auth provider (#5526) (da99a66) (@dashpole, @clayton-cornell)
  • beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
  • database_observability: Add support for GCP Cloud SQL metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
  • database_observability: Make targets optional (#5924) (54664b2) (@matthewnolf)
  • database_observability: Update default excluded schemas and users (#6080) (b386fff) (@cristiangreco)
  • faro.receiver: Add sourcemap fetching from remote locations (#4614) (b6cb5da) (@Oxel40)
  • helm: Add support for global.image.pullPolicy (#6069) (2e2ce72) (@petewall)
  • helm: Allow configuring image pull policy for config reloader (#5923) (991539b) (@kalleep)
  • loki.secretfilter: Add label_timed_out option to mark timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
  • loki.secretfilter: Add secrets_redacted_by_category_total metric combining rule and origin (#5855) (053a2f7) (@kleimkuhler)
  • loki.secretfilter: Change secretfilter to use go-re2 regex library instead of stdlib (#5909) (c16a660) (@mikefat)
  • loki.secretfilter: Remove redundant secrets_redacted_by_rule_total and secrets_redacted_by_origin metrics (#5970) (b16decb) (@kleimkuhler)
  • Oracle exporter can scrape more than one DB (#6008) (6fbad38) (@ptodev)
  • prometheus.exporter.cloudwatch: Upgrade YACE and drop aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
  • prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0 (#5836) (4f49b57) (@cristiangreco)
  • prometheus.remote_write: Sync WAL with upstream Prometheus (#5907) (e74a91b) (@x1unix)
  • pyroscope: Add support for extra async-profiler CLI arguments (#5472) (9251e33) (@ivanape)
  • pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
  • pyroscope: Update debuginfo client for HTTP/1.1 upload API (#6037) (879d8e5) (@korniltsev-grafanista)
  • Change service stop command from 'sc' to 'net' (#5906) (450973d) (@mateuszdrab)
  • database_observability.mysql: Refactor explain plan loop batch size (#5894) (f0fcd6b) (@cristiangreco)
  • database_observability.postgres: Cleanup embedded exporter collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
  • database_observability.postgres: Fix EXPLAIN param count when placeholders repeat (#6082) (b612b81) (@rgeyer)
  • database_observability: Drop schema_detection from logs (#6076) (b0105cb) (@cristiangreco) -…
Record
SUSE-SU-2026:2438-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
filippo.io/edwards25519
Go
 before 1.1.1
1.1.1
keda
Azure Linux:3
 through 2.14.1-11 None known
telegraf
Azure Linux:3
 through 1.31.0-15 None known
golang-filippo-edwards25519
Debian:12
 All versions, plus listed versions
1.0.0~rc1+git20210721-0.11.2.0-11.2.0-2
 None known
golang-filippo-edwards25519
Debian:13
 All versions, plus listed versions
1.0.0~rc1+git20210721-0.11.2.0-11.2.0-2
 None known
golang-filippo-edwards25519
Debian:14
 before 1.2.0-1, plus listed versions
1.0.0~rc1+git20210721-0.1
1.2.0-1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 104 CVEs
 before 0.0.20260226T182644-150000.1.149.1
0.0.20260226T182644-150000.1.149.1
cosign
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 9 CVEs
 before 3.0.5-150400.3.35.1
3.0.5-150400.3.35.1
cosign
openSUSE:Leap 15.6
From an advisory covering 9 CVEs
 before 3.0.5-150400.3.35.1
3.0.5-150400.3.35.1
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 1.0.10-150002.3.6.1
1.0.10-150002.3.6.1
Show 23 moreShow less
Affected packages
PackageAffectedFixed
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 3.5.0-150002.3.8.1
3.5.0-150002.3.8.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 11.6.14+security01-150002.4.14.1
11.6.14+security01-150002.4.14.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 5.1.13-150002.3.9.3
5.1.13-150002.3.9.3
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 17 CVEs
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 17 CVEs
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
cosign
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 3.0.5-160000.1.1
3.0.5-160000.1.1
cosign
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 3.0.5-160000.1.1
3.0.5-160000.1.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 1.16.1-150700.15.20.1
1.16.1-150700.15.20.1
golang-filippo-edwards25519
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.0.0~beta.3-21.0.0~rc1-11.0.0~rc1+git20210721-0.1
 None known
golang-filippo-edwards25519
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.0.0~rc1+git20210721-0.1
 None known
golang-filippo-edwards25519
Ubuntu:25.10
 All versions, plus listed versions
1.0.0~rc1+git20210721-0.1
 None known
golang-filippo-edwards25519
Ubuntu:26.10
 All versions, plus listed versions
1.0.0~rc1+git20210721-0.1build11.2.0-11.2.0-2
 None known
golang-filippo-edwards25519
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.0.0~rc1+git20210721-0.11.0.0~rc1+git20210721-0.1build1
 None known
cosign
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 3.0.5-1.1
3.0.5-1.1
grafana
openSUSE:Tumbleweed
From an advisory covering 12 CVEs
 before 11.6.14+security01-1.1
11.6.14+security01-1.1
alloy
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.15.1-1.1
1.15.1-1.1
gopass
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.17.0-1.1
1.17.0-1.1
kumactl
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.0.0-1.1
3.0.0-1.1
cosign
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 3.0.5-160000.1.1
3.0.5-160000.1.1
grafana
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 11.6.14+security04-bp160.1.1
11.6.14+security04-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-26958 is a low vulnerability (CVSS 1.7) in Filosottile Filippo.io/edwards25519, published February 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 36th percentile. Fixed in filippo.io/edwards25519 1.1.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,661 references and the rest of 6 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open