Every CVE Search/ Get API key

CVE-2026-25681

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

6.1 MediumFix available

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.22%Up 0.2 points since May 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-25681
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
EUVDEUVD-2026-31452 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
EUVD-2026-31452
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w9p8-pvxh-rxpj 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree....

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
GHSA-w9p8-pvxh-rxpj
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
NVD 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-25681
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
OSVBELL-CVE-2026-25681 6.1
Record
BELL-CVE-2026-25681
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.1

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
CVE-2026-25681
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 48 moreShow less
OSVDEBIAN-CVE-2026-25681 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
DEBIAN-CVE-2026-25681
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:34357 8.2

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:34357
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:34359 8.2

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:34359
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35827 8.2

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:35827
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:35828 8.2

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:35828
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:37072 8.7

Red Hat Security Advisory: podman security, bug fix, and enhancement update

Record
RHSA-2026:37072
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:37123 8.7

Red Hat Security Advisory: podman security, bug fix, and enhancement update

Record
RHSA-2026:37123
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42078 9.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:42078
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:42079 9.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:42079
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:51112 8.2

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:51112
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:53412 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53412
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53413 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53413
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:53415 8.6

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:53415
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:59560 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:59560
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:59562 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:59562
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61585 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:61585
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:63134 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:63134
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66432 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67138 8.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:67138
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67139 8.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:67139
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67517 8.8

Red Hat Security Advisory: grafana security update

Record
RHSA-2026:67517
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:68334 8.8

Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

Record
RHSA-2026:68334
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:69293 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:34357 8.2

Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:34357
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:34359 8.2

Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:34359
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:37072 8.7

Important: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

  • golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

  • golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

  • podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z] (JIRA:Rocky Linux-173842)

  • [FJ10.2 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-10.2.z] (JIRA:Rocky Linux-192440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:37072
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:37123 8.7

Important: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

  • golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

  • golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

  • podman does not clean up all files and leaves orphaned files consuming disk space [rhel-9.8.z] (JIRA:Rocky Linux-173988)

  • [FJ9.8 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-9.8.z] (JIRA:Rocky Linux-192439)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:37123
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:66432 8.2

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67138 8.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67138
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67139 8.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67139
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:69293 8.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-25681 6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
UBUNTU-CVE-2026-25681
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:34357 No score

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)
  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:34357
Updated
2026-11-02
OSVALSA-2026:34359 No score

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry

Security Fix(es):

  • github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)
  • github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)
  • net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:34359
Updated
2026-11-02
OSVALSA-2026:35827 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35827
Updated
2026-11-02
OSVALSA-2026:35828 No score

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

  • golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:35828
Updated
2026-11-02
OSVALSA-2026:37123 No score

Important: podman security, bug fix, and enhancement update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
  • golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
  • golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

  • podman does not clean up all files and leaves orphaned files consuming disk space [almalinux-9.8.z] (JIRA:AlmaLinux-173988)
  • [FJ9.8 Bug]: [REG]The "podman-remote save" command fails for rootless users. [almalinux-9.8.z] (JIRA:AlmaLinux-192439)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:37123
Updated
2026-11-02
OSVALSA-2026:66432 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66432
Updated
2026-11-02
OSVALSA-2026:69293 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69293
Updated
2026-11-02
OSVAZL-111548 No score

CVE-2026-25681 affecting package kubevirt-openvmm 1.9.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-111548
Updated
2026-11-02
OSVAZL-87158 No score

CVE-2026-25681 affecting package azl-otel-collector 0.127.0-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87158
Updated
2026-11-02
OSVAZL-87221 No score

CVE-2026-25681 affecting package cri-o 1.30.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87221
Updated
2026-11-02
OSVAZL-87314 No score

CVE-2026-25681 affecting package podman 5.6.1-10

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87314
Updated
2026-11-02
OSVAZL-87344 No score

CVE-2026-25681 affecting package yq 4.45.1-1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87344
Updated
2026-11-02
OSVAZL-87378 No score

CVE-2026-25681 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87378
Updated
2026-11-02
OSVAZL-87435 No score

CVE-2026-25681 affecting package cert-manager for versions less than 1.12.15-9

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87435
Updated
2026-11-02
OSVAZL-87480 No score

CVE-2026-25681 affecting package cf-cli for versions less than 8.7.11-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87480
Updated
2026-11-02
OSVAZL-87492 No score

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Record
AZL-87492
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opentelemetry-collector
AlmaLinux:10
 before 0.152.1-1.el10_2
0.152.1-1.el10_2
opentelemetry-collector
AlmaLinux:9
 before 0.152.1-1.el9_8
0.152.1-1.el9_8
grafana
AlmaLinux:10
 before 10.2.6-27.el10_2
10.2.6-27.el10_2
grafana-selinux
AlmaLinux:10
 before 10.2.6-27.el10_2
10.2.6-27.el10_2
grafana
AlmaLinux:9
 before 10.2.6-23.el9_8
10.2.6-23.el9_8
grafana-selinux
AlmaLinux:9
 before 10.2.6-23.el9_8
10.2.6-23.el9_8
podman
AlmaLinux:9
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-docker
AlmaLinux:9
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-plugins
AlmaLinux:9
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-remote
AlmaLinux:9
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
Show 290 moreShow less
Affected packages
PackageAffectedFixed
podman-tests
AlmaLinux:9
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
osbuild-composer
AlmaLinux:10
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-core
AlmaLinux:10
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-worker
AlmaLinux:10
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer
AlmaLinux:9
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer-core
AlmaLinux:9
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer-worker
AlmaLinux:9
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
azl-otel-collector
Azure Linux:3
 through 0.127.0-1 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
yq
Azure Linux:3
 through 4.45.1-1 None known
application-gateway-kubernetes-ingress
Azure Linux:3
 before 1.7.7-5
1.7.7-5
cert-manager
Azure Linux:3
 before 1.12.15-9
1.12.15-9
cf-cli
Azure Linux:3
 before 8.7.11-7
8.7.11-7
cloud-provider-kubevirt
Azure Linux:3
 before 0.5.1-5
0.5.1-5
cni-plugins
Azure Linux:3
 before 1.4.0-6
1.4.0-6
containerd2
Azure Linux:3
 before 2.2.4-4
2.2.4-4
containerized-data-importer
Azure Linux:3
 before 1.62.0-6
1.62.0-6
cri-tools
Azure Linux:3
 before 1.32.0-6
1.32.0-6
dasel
Azure Linux:3
 before 2.8.1-4
2.8.1-4
docker-buildx
Azure Linux:3
 before 0.14.0-15
0.14.0-15
docker-compose
Azure Linux:3
 before 2.27.0-12
2.27.0-12
gh
Azure Linux:3
 before 2.62.0-17
2.62.0-17
influxdb
Azure Linux:3
 before 2.7.5-17
2.7.5-17
keda
Azure Linux:3
 before 2.14.1-14
2.14.1-14
kube-vip-cloud-provider
Azure Linux:3
 before 0.0.10-6
0.0.10-6
kubernetes
Azure Linux:3
 before 1.30.10-25
1.30.10-25
kubevirt
Azure Linux:3
 before 1.7.1-7
1.7.1-7
multus
Azure Linux:3
 before 4.0.2-9
4.0.2-9
packer
Azure Linux:3
 before 1.9.5-15
1.9.5-15
prometheus-adapter
Azure Linux:3
 before 0.12.0-6
0.12.0-6
sriov-network-device-plugin
Azure Linux:3
 before 3.7.0-6
3.7.0-6
telegraf
Azure Linux:3
 before 1.31.0-23
1.31.0-23
buildah
Alpaquita:23
 1.28.0-r1 and later None known
containerd
Alpaquita:23
 1.6.10-r0 and later None known
podman
Alpaquita:23
 4.3.1-r0 and later None known
runc
Alpaquita:23
 1.1.4-r3 and later None known
skopeo
Alpaquita:23
 1.10.0-r2 and later None known
buildah
Alpaquita:25
 1.40.0-r0 and later None known
containerd
Alpaquita:25
 2.1.1-r0 and later None known
docker-cli-buildx
Alpaquita:25
 0.24.0-r0 and later None known
google-guest-agent
Alpaquita:25
 20250521.00-r0 and later None known
osv-scanner
Alpaquita:25
 2.1.0-r4 and later None known
podman
Alpaquita:25
 5.5.0-r0 and later None known
rootlesskit
Alpaquita:25
 2.3.5-r0 and later None known
runc
Alpaquita:25
 1.3.0-r1 and later None known
skopeo
Alpaquita:25
 1.18.0-r2 and later None known
buildah
Alpaquita:stream
 1.31.0-r0 and later None known
calicoctl
Alpaquita:stream
 3.31.3-r0 and later None known
cilium-cli
Alpaquita:stream
 0.19.0-r12 and later None known
cni-plugins
Alpaquita:stream
 1.9.0-r2 and later None known
containerd
Alpaquita:stream
 1.7.2-r1 and later None known
cri-tools
Alpaquita:stream
 1.35.0-r2 and later None known
docker-cli-buildx
Alpaquita:stream
 0.11.0-r0 and later None known
etcd
Alpaquita:stream
 3.6.4-r6 and later None known
google-guest-agent
Alpaquita:stream
 20250214.01-r0 and later None known
grype
Alpaquita:stream
 0.100.0-r0 and later None known
helm
Alpaquita:stream
 3.19.0-r4 and later None known
osv-scanner
Alpaquita:stream
 2.1.0-r2 and later None known
podman
Alpaquita:stream
 4.5.1-r1 and later None known
rootlesskit
Alpaquita:stream
 2.1.0-r0 and later None known
runc
Alpaquita:stream
 1.1.7-r1 and later None known
skopeo
Alpaquita:stream
 1.13.0-r1 and later None known
osbuild-composer
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els8
132.2-3.el9_6.alma.1.tuxcare.els8
osbuild-composer-core
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els8
132.2-3.el9_6.alma.1.tuxcare.els8
osbuild-composer-tests
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els8
132.2-3.el9_6.alma.1.tuxcare.els8
osbuild-composer-worker
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els8
132.2-3.el9_6.alma.1.tuxcare.els8
osbuild-composer
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els9
76-2.el9_2.2.alma.tuxcare.els9
osbuild-composer-core
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els9
76-2.el9_2.2.alma.tuxcare.els9
osbuild-composer-dnf-json
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els9
76-2.el9_2.2.alma.tuxcare.els9
osbuild-composer-tests
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els9
76-2.el9_2.2.alma.tuxcare.els9
osbuild-composer-worker
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els9
76-2.el9_2.2.alma.tuxcare.els9
golang-golang-x-net
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 22 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.7.0+dfsg-1
 None known
golang-golang-x-net
Debian:13
 All versions, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 5 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1
 None known
golang-golang-x-net
Debian:14
 before 1:0.55.0-1, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+1
1:0.55.0-1
golang.org/x/net
Go
 before 0.55.0
0.55.0
opentelemetry-collector
Red Hat:enterprise_linux:10.2
 before 0:0.152.1-1.el10_2
0:0.152.1-1.el10_2
opentelemetry-collector
Red Hat:enterprise_linux:9::appstream
 before 0:0.152.1-1.el9_8
0:0.152.1-1.el9_8
grafana
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-27.el10_2
0:10.2.6-27.el10_2
grafana-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-27.el10_2
0:10.2.6-27.el10_2
grafana-debugsource
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-27.el10_2
0:10.2.6-27.el10_2
grafana-selinux
Red Hat:enterprise_linux:10.2
 before 0:10.2.6-27.el10_2
0:10.2.6-27.el10_2
grafana
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-23.el9_8
0:10.2.6-23.el9_8
grafana-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-23.el9_8
0:10.2.6-23.el9_8
grafana-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-23.el9_8
0:10.2.6-23.el9_8
grafana-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:10.2.6-23.el9_8
0:10.2.6-23.el9_8
podman
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-debuginfo
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-debugsource
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-docker
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-remote
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-remote-debuginfo
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-tests-debuginfo
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman-tests
Red Hat:enterprise_linux:10.2
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-debugsource
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-docker
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-plugins
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-plugins-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-remote
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-remote-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-tests
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
podman-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el8
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el8
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el8
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el9
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el9
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el9
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el8
 before 0:3.49.63-2.el8ap
0:3.49.63-2.el8ap
python3.12-pulpcore
Red Hat:ansible_automation_platform:2.5::el9
 before 0:3.49.63-2.el9ap
0:3.49.63-2.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.6.6-1.el8ap
0:1.6.6-1.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.6.6-1.el9ap
0:1.6.6-1.el9ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el8
 before 0:3.1.50-1.el8ap
0:3.1.50-1.el8ap
python3.12-gitpython
Red Hat:ansible_automation_platform:2.5::el9
 before 0:3.1.50-1.el9ap
0:3.1.50-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el8
 before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el8
 before 1:2.16.19-1.el8ap
1:2.16.19-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.6.30-2.el8ap
0:4.6.30-2.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el8
 before 0:1.1.20-1.el8ap
0:1.1.20-1.el8ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-gateway-config
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.5.20260715-1.el8ap
0:2.5.20260715-1.el8ap
automation-hub
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-galaxy-ng
Red Hat:ansible_automation_platform:2.5::el8
 before 0:4.10.16-1.el8ap
0:4.10.16-1.el8ap
python3.12-pulp-ansible
Red Hat:ansible_automation_platform:2.5::el8
 before 1:0.25.6-1.el8ap
1:0.25.6-1.el8ap
python3.12-pulp-container
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.19.12-1.el8ap
0:2.19.12-1.el8ap
python3.12-pyjwt+crypto
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pyjwt
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.13.0-1.el8ap
0:2.13.0-1.el8ap
python3.12-pysequoia
Red Hat:ansible_automation_platform:2.5::el8
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-pysequoia-debugsource
Red Hat:ansible_automation_platform:2.5::el8
 before 0:0.1.34-1.el8ap
0:0.1.34-1.el8ap
python3.12-urllib3
Red Hat:ansible_automation_platform:2.5::el8
 before 0:2.7.0-1.el8ap
0:2.7.0-1.el8ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
python3.12-urllib3
Red Hat:ansible_automation_platform_developer:2.5::el9
 before 0:2.7.0-1.el9ap
0:2.7.0-1.el9ap
ansible-test
Red Hat:ansible_automation_platform:2.5::el9
 before 1:2.16.19-1.el9ap
1:2.16.19-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.5::el9
 before 0:4.6.30-2.el9ap
0:4.6.30-2.el9ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el9
 before 0:1.1.20-1.el9ap
0:1.1.20-1.el9ap
automation-gateway
Red Hat:ansible_automation_platform:2.5::el9
 before 0:2.5.20260715-1.el9ap
0:2.5.20260715-1.el9ap
opentelemetry-collector
Rocky Linux:10
 before 0:0.152.1-1.el10_2
0:0.152.1-1.el10_2
opentelemetry-collector
Rocky Linux:9
 before 0:0.152.1-1.el9_8
0:0.152.1-1.el9_8
podman
Rocky Linux:10
 before 7:5.8.2-4.el10_2
7:5.8.2-4.el10_2
podman
Rocky Linux:9
 before 6:5.8.2-4.el9_8
6:5.8.2-4.el9_8
osbuild-composer
Rocky Linux:10
 before 0:165.1-5.el10_2.rocky.0.1
0:165.1-5.el10_2.rocky.0.1
image-builder
Rocky Linux:9
 before 0:52.1-2.el9_8
0:52.1-2.el9_8
image-builder
Rocky Linux:10
 before 0:52.1-2.el10_2.rocky.0.1
0:52.1-2.el10_2.rocky.0.1
osbuild-composer
Rocky Linux:9
 before 0:165.1-5.el9_8.rocky.0.1
0:165.1-5.el9_8.rocky.0.1
golang.org/x/net
Root:Go
 before v0.42.0-aikido.3
v0.42.0-aikido.3v0.39.0-aikido.4v0.34.0-aikido.3v0.33.0-aikido.7v0.38.0-aikido.1v0.35.0-aikido.3v0.38.0-aikido.2v0.35.0-aikido.2v0.50.0-aikido.1v0.40.0-aikido.1v0.26.0-aikido.2v0.50.0-aikido.2v0.38.0-aikido.3v0.41.0-aikido.1v0.42.0-aikido.1v0.48.0-aikido.1v0.33.0-aikido.5v0.39.0-aikido.1v0.52.0-aikido.1v0.47.0-aikido.1v0.39.0-aikido.2v0.35.0-aikido.1v0.33.0-aikido.6v0.39.0-aikido.3v0.42.0-aikido.2v0.48.0-aikido.2v0.34.0-aikido.1v0.52.0-aikido.2v0.34.0-aikido.2v0.37.0-aikido.1v0.47.0-aikido.2v0.43.0-aikido.1v0.41.0-aikido.2v0.40.0-aikido.2v0.38.0-aikido.4v0.23.0-aikido.1v0.29.0-aikido.3v0.47.0-aikido.3v0.35.0-aikido.4v0.54.0-aikido.2v0.38.0-aikido.5v0.40.0-aikido.3v0.35.0-aikido.5v0.41.0-aikido.3v0.47.0-aikido.4v0.49.0-aikido.1v0.52.0-aikido.3v0.52.0-aikido.4v0.29.0-aikido.4v0.38.0-aikido.6v0.41.0-aikido.4v0.40.0-aikido.4v0.47.0-aikido.5v0.54.0-aikido.3v0.52.0-aikido.5v0.29.0-aikido.5v0.43.0-aikido.2v0.54.0-aikido.4v0.23.0-aikido.2v0.23.0-aikido.3v0.29.0-aikido.6
rootio-golang.org/x/net
Root:Go
 before v0.42.0-root.io.3
v0.42.0-root.io.3v0.39.0-root.io.4v0.38.0-root.io.1v0.34.0-root.io.3v0.33.0-root.io.7v0.35.0-root.io.3v0.38.0-root.io.2v0.41.0-root.io.1v0.35.0-root.io.2v0.50.0-root.io.1v0.40.0-root.io.1v0.26.0-root.io.2v0.38.0-root.io.3v0.50.0-root.io.2v0.42.0-root.io.1v0.48.0-root.io.1v0.33.0-root.io.5v0.39.0-root.io.1v0.52.0-root.io.1v0.47.0-root.io.1v0.39.0-root.io.2v0.35.0-root.io.1v0.33.0-root.io.6v0.39.0-root.io.3v0.42.0-root.io.2v0.48.0-root.io.2v0.34.0-root.io.1v0.52.0-root.io.2v0.34.0-root.io.2v0.37.0-root.io.1v0.47.0-root.io.2v0.43.0-root.io.1v0.41.0-root.io.2v0.40.0-root.io.2v0.38.0-root.io.4v0.23.0-root.io.1v0.29.0-root.io.3v0.47.0-root.io.3v0.35.0-root.io.4v0.54.0-root.io.2v0.38.0-root.io.5v0.40.0-root.io.3v0.35.0-root.io.5v0.41.0-root.io.3v0.47.0-root.io.4v0.49.0-root.io.1v0.52.0-root.io.3v0.52.0-root.io.4v0.29.0-root.io.4v0.38.0-root.io.6v0.41.0-root.io.4v0.40.0-root.io.4v0.47.0-root.io.5v0.54.0-root.io.3v0.52.0-root.io.5v0.29.0-root.io.5v0.43.0-root.io.2v0.54.0-root.io.4v0.23.0-root.io.2v0.23.0-root.io.3v0.29.0-root.io.6
elemental-toolkit
SUSE:Linux Micro 6.0
 before 2.1.6-1.1
2.1.6-1.1
elemental-operator
SUSE:Linux Micro 6.0
 before 1.6.11-1.1
1.6.11-1.1
elemental-toolkit
SUSE:Linux Micro 6.1
 before 2.2.9-slfo.1.1_1.1
2.2.9-slfo.1.1_1.1
elemental-operator
SUSE:Linux Micro 6.1
 before 1.7.5-slfo.1.1_1.1
1.7.5-slfo.1.1_1.1
mcphost
SUSE:Linux Enterprise Server 16.0
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
mcphost
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
mcphost
SUSE:Linux Micro 6.2
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
alloy
SUSE:Linux Enterprise Server 16.0
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
alloy
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
cosign
SUSE:Linux Enterprise Server 16.0
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
cosign
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.35.5-150400.3.68.1
1.35.5-150400.3.68.1
buildah
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.35.5-150500.3.62.1
1.35.5-150500.3.62.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-15
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-QubitProducts-exporter_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 0.4.0-150002.3.6.2
0.4.0-150002.3.6.2
golang-github-boynux-squid_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 1.13.0-150002.3.6.2
1.13.0-150002.3.6.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 1.0.10-150002.3.9.2
1.0.10-150002.3.9.2
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools SLE-15
 before 0.28.1-150002.4.11.1
0.28.1-150002.4.11.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
 before 3.5.3-150002.3.13.1
3.5.3-150002.3.13.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
 before 11.6.14+security04-150002.4.21.1
11.6.14+security04-150002.4.21.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.4-150002.3.9.1
5.2.4-150002.3.9.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 0.26.0-150002.3.11.1
0.26.0-150002.3.11.1
prometheus-postgres_exporter
SUSE:Multi Linux Manager Tools SLE-15
 before 0.10.1-150002.3.3.2
0.10.1-150002.3.3.2
python-defusedxml-sle15
SUSE:Multi Linux Manager Tools SLE-15
 before 0.7.1-150002.1.3.1
0.7.1-150002.1.3.1
rhnlib
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.5-150002.3.9.1
5.2.5-150002.3.9.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.8-150002.3.12.1
5.2.8-150002.3.12.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.6-150002.3.9.1
5.2.6-150002.3.9.1
supportutils-plugin-salt
SUSE:Multi Linux Manager Tools SLE-15
 before 1.2.3-150002.3.3.1
1.2.3-150002.3.3.1
supportutils-plugin-susemanager-client
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.3-150002.3.9.1
5.2.3-150002.3.9.1
uyuni-common-libs
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.5-150002.3.6.1
5.2.5-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
dracut-saltboot
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 1.2.1-150002.3.9.1
1.2.1-150002.3.9.1
golang-github-prometheus-node_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 1.10.2-150002.3.6.2
1.10.2-150002.3.6.2
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
 before 5.2.12-150002.3.17.1
5.2.12-150002.3.17.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.17.1-150700.15.23.1
1.17.1-150700.15.23.1
cosign
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
cosign
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 3.1.1-150400.3.45.1
3.1.1-150400.3.45.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 1.7.4-150700.3.30.1
1.7.4-150700.3.30.1
kubevirt-1.6
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 1.6.6-150700.15.17.1
1.6.6-150700.15.17.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 12.4.5-150200.3.91.1
12.4.5-150200.3.91.1
containerized-data-importer
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 1.64.0-150700.9.14.1
1.64.0-150700.9.14.1
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
 None known
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
 None known
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
 None known
rclone
openSUSE:Tumbleweed
 before 1.74.2-1.1
1.74.2-1.1
mcphost
openSUSE:Tumbleweed
 before 0.34.0-8.1
0.34.0-8.1
yq
openSUSE:Tumbleweed
 before 4.53.2-2.1
4.53.2-2.1
hauler
openSUSE:Tumbleweed
 before 1.4.3-5.1
1.4.3-5.1
trivy
openSUSE:Tumbleweed
 before 0.71.0-1.1
0.71.0-1.1
git-bug
openSUSE:Tumbleweed
 before 0.10.1-5.1
0.10.1-5.1
alloy
openSUSE:Tumbleweed
 before 1.17.0-1.1
1.17.0-1.1
velociraptor
openSUSE:Tumbleweed
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
gomuks
openSUSE:Tumbleweed
 before 26.03+git.1780250926.564a8707-1.1
26.03+git.1780250926.564a8707-1.1
percona-toolkit
openSUSE:Tumbleweed
 before 3.7.1.4-1.1
3.7.1.4-1.1
trivy
openSUSE:Leap 16.0
 before 0.71.0-160000.1.1
0.71.0-160000.1.1
neonmodem
openSUSE:Leap 16.0
 before 1.0.7+git0.346d1d3-bp160.1.1
1.0.7+git0.346d1d3-bp160.1.1
grafana
openSUSE:Leap 16.0
 before 11.6.14+security04-bp160.2.1
11.6.14+security04-bp160.2.1
mcphost
openSUSE:Leap 16.0
 before 0.34.0-160000.2.1
0.34.0-160000.2.1
alloy
openSUSE:Leap 16.0
 before 1.17.0-160000.1.1
1.17.0-160000.1.1
hauler
openSUSE:Leap 16.0
 before 2.0.1-bp160.1.1
2.0.1-bp160.1.1
cosign
openSUSE:Leap 16.0
 before 3.1.1-160000.1.1
3.1.1-160000.1.1
lux
openSUSE:Leap 16.0
 before 0.24.1-bp160.1.1
0.24.1-bp160.1.1
rclone
openSUSE:Leap 16.0
 before 1.74.4-bp160.1.1
1.74.4-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1
kubevirt1.8
openSUSE:Leap 16.0
 before 1.8.4-160000.1.1
1.8.4-160000.1.1
glab
openSUSE:Leap 16.0
 before 1.114.0-bp160.1.1
1.114.0-bp160.1.1
containerized-data-importer1.65
openSUSE:Leap 16.0
 before 1.65.0-160000.3.1
1.65.0-160000.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25681 is a medium vulnerability (CVSS 6.1) in Golang Net, published May 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in opentelemetry-collector 0.152.1-1.el10_2.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 99 package rows and 2,285 references. The JSON record has them. Also not on the record: 16 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 65 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open