{"id":"CVE-2025-58181","aliases":["ALPINE-CVE-2025-58181","DEBIAN-CVE-2025-58181","EUVD-2025-198228","GHSA-j5w8-q4qc-rx2x","GO-2025-4134","MGASA-2026-0147","OESA-2026-3398","OESA-2026-3399","OESA-2026-3400","OESA-2026-3401","OESA-2026-3879","OESA-2026-3880","OESA-2026-4068","RHSA-2026:7291","RHSA-2026:7385","ROOT-APP-GOBINARY-CVE-2025-58181","SUSE-SU-2026:0439-1","SUSE-SU-2026:0592-1","SUSE-SU-2026:0666-1","SUSE-SU-2026:0772-1","SUSE-SU-2026:0777-1","SUSE-SU-2026:0972-1","SUSE-SU-2026:1118-1","SUSE-SU-2026:20176-1","SUSE-SU-2026:20244-1","SUSE-SU-2026:20357-1","SUSE-SU-2026:20539-1","SUSE-SU-2026:20578-1","SUSE-SU-2026:20651-1","SUSE-SU-2026:20694-1","SUSE-SU-2026:20904-1","SUSE-SU-2026:21756-1","SUSE-SU-2026:21827-1","SUSE-SU-2026:21989-1","SUSE-SU-2026:22128-1","SUSE-SU-2026:22133-1","SUSE-SU-2026:2400-1","SUSE-SU-2026:2401-1","SUSE-SU-2026:2429-1","SUSE-SU-2026:2493-1","SUSE-SU-2026:2581-1","SUSE-SU-2026:2612-1","SUSE-SU-2026:3056-1","SUSE-SU-2026:3630-1","SUSE-SU-2026:5067-1","UBUNTU-CVE-2025-58181","USN-7956-1","openSUSE-RU-2026:20010-1","openSUSE-SU-2025:15761-1","openSUSE-SU-2025:15763-1","openSUSE-SU-2025:15771-1","openSUSE-SU-2025:15773-1","openSUSE-SU-2025:15774-1","openSUSE-SU-2025:15841-1","openSUSE-SU-2025:20143-1","openSUSE-SU-2025:20177-1","openSUSE-SU-2026:10013-1","openSUSE-SU-2026:10042-1","openSUSE-SU-2026:10127-1","openSUSE-SU-2026:10142-1","openSUSE-SU-2026:10143-1","openSUSE-SU-2026:10230-1","openSUSE-SU-2026:10232-1","openSUSE-SU-2026:10255-1","openSUSE-SU-2026:10543-1","openSUSE-SU-2026:11126-1","openSUSE-SU-2026:11781-1","openSUSE-SU-2026:12295-1","openSUSE-SU-2026:12299-1","openSUSE-SU-2026:12300-1","openSUSE-SU-2026:20132-1","openSUSE-SU-2026:20249-1","openSUSE-SU-2026:20366-1","openSUSE-SU-2026:20386-1","openSUSE-SU-2026:20620-1","openSUSE-SU-2026:20730-1","openSUSE-SU-2026:20788-1","openSUSE-SU-2026:20798-1","openSUSE-SU-2026:20893-1","openSUSE-SU-2026:20902-1","openSUSE-SU-2026:20969-1","openSUSE-SU-2026:21481-1","openSUSE-SU-2026:21483-1","openSUSE-SU-2026:21567-1","openSUSE-SU-2026:21824-1"],"status":"published","title":"Unbounded memory consumption in golang.org/x/crypto/ssh","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00597,"percentile":0.48859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2025-11-19T20:11:57Z","modified":"2026-11-03T22:56:58Z","fixes":[{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.45.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"etcd","fixed_in":["3.6.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"etcd","fixed_in":["3.6.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rclone","fixed_in":["1.72.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rclone","fixed_in":["1.72.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-go.crypto","fixed_in":["1:0.45.0-1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"golang.org/x/crypto","fixed_in":["v0.35.0-aikido.4","v0.37.0-aikido.5","v0.37.0-aikido.6","v0.40.0-aikido.8","v0.40.0-aikido.9","v0.32.0-aikido.6","v0.31.0-aikido.6","v0.31.0-aikido.7","v0.40.0-aikido.3","v0.35.0-aikido.2","v0.37.0-aikido.2","v0.31.0-aikido.8","v0.40.0-aikido.4","v0.37.0-aikido.3","v0.35.0-aikido.3","v0.40.0-aikido.5","v0.40.0-aikido.6","v0.36.0-aikido.3","v0.31.0-aikido.12","v0.31.0-aikido.10","v0.36.0-aikido.2","v0.31.0-aikido.11","v0.36.0-aikido.1","v0.32.0-aikido.4","v0.40.0-aikido.7","v0.37.0-aikido.4","v0.32.0-aikido.5","v0.31.0-aikido.9","v0.35.0-aikido.5","v0.35.0-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-golang.org/x/crypto","fixed_in":["v0.35.0-root.io.4","v0.40.0-root.io.1","v0.31.0-root.io.1","v0.37.0-root.io.1","v0.37.0-root.io.5","v0.37.0-root.io.6","v0.40.0-root.io.8","v0.40.0-root.io.9","v0.32.0-root.io.6","v0.35.0-root.io.1","v0.35.0-root.io.5","v0.31.0-root.io.12","v0.31.0-root.io.6","v0.31.0-root.io.7","v0.40.0-root.io.3","v0.35.0-root.io.2","v0.37.0-root.io.2","v0.31.0-root.io.8","v0.40.0-root.io.4","v0.37.0-root.io.3","v0.35.0-root.io.3","v0.40.0-root.io.5","v0.40.0-root.io.6","v0.36.0-root.io.3","v0.31.0-root.io.10","v0.36.0-root.io.2","v0.31.0-root.io.11","v0.36.0-root.io.1","v0.32.0-root.io.4","v0.40.0-root.io.7","v0.37.0-root.io.4","v0.32.0-root.io.5","v0.31.0-root.io.9","v0.35.0-root.io.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","fixed_in":["28.5.1_ce-150000.241.2","29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","fixed_in":["28.5.1_ce-150000.241.2","29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","fixed_in":["28.5.1_ce-150000.241.2","29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"docker","fixed_in":["28.5.1_ce-150000.241.2","29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker","fixed_in":["28.5.1_ce-150000.241.2","29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","fixed_in":["28.5.1_ce-150000.241.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"docker","fixed_in":["28.5.1_ce-150000.241.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","fixed_in":["28.5.1_ce-98.151.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"docker","fixed_in":["28.5.1_ce-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"docker","fixed_in":["28.5.1_ce-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"docker","fixed_in":["28.5.1_ce-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"docker","fixed_in":["28.5.1_ce-slfo.1.1_8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"docker","fixed_in":["28.5.1_ce-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"docker","fixed_in":["29.4.0_ce-150000.250.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","fixed_in":["20240716.00-0ubuntu1~16.04.0+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","fixed_in":["20241011.01-0ubuntu1~18.04.0+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","fixed_in":["20250116.00-0ubuntu1~20.04.0+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","fixed_in":["20250116.00-0ubuntu1~22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","fixed_in":["20250116.00-0ubuntu1~24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"google-guest-agent","fixed_in":["20250506.01-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"google-guest-agent","fixed_in":["20250506.01-0ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"google-guest-agent","fixed_in":["20250506.01-0ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rclone","fixed_in":["1.72.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"netbird","fixed_in":["0.60.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"zk","fixed_in":["0.15.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"docker","fixed_in":["28.5.1_ce-160000.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"zk","fixed_in":["0.15.6-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.45.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.72.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.72.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.12.0-1","1:0.13.0-1","1:0.14.0-1","1:0.16.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.21.0-1","1:0.22.0-1","1:0.23.0-1","1:0.24.0-1","1:0.24.0-2","1:0.25.0-1","1:0.25.0-1~bpo12+1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.4.0-1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.57.0-2","1:0.57.0-2~bpo13+1","1:0.58.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.57.0-2","1:0.57.0-2~bpo13+1","1:0.58.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.45.0-1"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2"]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.45.0"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.45.0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73.5-1.1.mga9"}]}],"bundled":31},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-13.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-15.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-15.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-15.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-2.oe2403sp1"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-3.oe2403sp3"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-2.oe2403sp4"}]}],"bundled":45},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.hum1"}]}],"bundled":40},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.25-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.9-1.hum1"}]}],"bundled":38},{"source":"osv","ecosystem":"Root:Go","package":"golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.35.0-aikido.4"},{"fixed":"v0.37.0-aikido.5"},{"fixed":"v0.37.0-aikido.6"},{"fixed":"v0.40.0-aikido.8"},{"fixed":"v0.40.0-aikido.9"},{"fixed":"v0.32.0-aikido.6"},{"fixed":"v0.31.0-aikido.6"},{"fixed":"v0.31.0-aikido.7"},{"fixed":"v0.40.0-aikido.3"},{"fixed":"v0.35.0-aikido.2"},{"fixed":"v0.37.0-aikido.2"},{"fixed":"v0.31.0-aikido.8"},{"fixed":"v0.40.0-aikido.4"},{"fixed":"v0.37.0-aikido.3"},{"fixed":"v0.35.0-aikido.3"},{"fixed":"v0.40.0-aikido.5"},{"fixed":"v0.40.0-aikido.6"},{"fixed":"v0.36.0-aikido.3"},{"fixed":"v0.31.0-aikido.12"},{"fixed":"v0.31.0-aikido.10"},{"fixed":"v0.36.0-aikido.2"},{"fixed":"v0.31.0-aikido.11"},{"fixed":"v0.36.0-aikido.1"},{"fixed":"v0.32.0-aikido.4"},{"fixed":"v0.40.0-aikido.7"},{"fixed":"v0.37.0-aikido.4"},{"fixed":"v0.32.0-aikido.5"},{"fixed":"v0.31.0-aikido.9"},{"fixed":"v0.35.0-aikido.5"},{"fixed":"v0.35.0-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.35.0-root.io.4"},{"fixed":"v0.40.0-root.io.1"},{"fixed":"v0.31.0-root.io.1"},{"fixed":"v0.37.0-root.io.1"},{"fixed":"v0.37.0-root.io.5"},{"fixed":"v0.37.0-root.io.6"},{"fixed":"v0.40.0-root.io.8"},{"fixed":"v0.40.0-root.io.9"},{"fixed":"v0.32.0-root.io.6"},{"fixed":"v0.35.0-root.io.1"},{"fixed":"v0.35.0-root.io.5"},{"fixed":"v0.31.0-root.io.12"},{"fixed":"v0.31.0-root.io.6"},{"fixed":"v0.31.0-root.io.7"},{"fixed":"v0.40.0-root.io.3"},{"fixed":"v0.35.0-root.io.2"},{"fixed":"v0.37.0-root.io.2"},{"fixed":"v0.31.0-root.io.8"},{"fixed":"v0.40.0-root.io.4"},{"fixed":"v0.37.0-root.io.3"},{"fixed":"v0.35.0-root.io.3"},{"fixed":"v0.40.0-root.io.5"},{"fixed":"v0.40.0-root.io.6"},{"fixed":"v0.36.0-root.io.3"},{"fixed":"v0.31.0-root.io.10"},{"fixed":"v0.36.0-root.io.2"},{"fixed":"v0.31.0-root.io.11"},{"fixed":"v0.36.0-root.io.1"},{"fixed":"v0.32.0-root.io.4"},{"fixed":"v0.40.0-root.io.7"},{"fixed":"v0.37.0-root.io.4"},{"fixed":"v0.32.0-root.io.5"},{"fixed":"v0.31.0-root.io.9"},{"fixed":"v0.35.0-root.io.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150600.4.12.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"squashfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150600.3.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150600.4.12.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"squashfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150600.3.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-150600.4.12.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"squashfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150600.3.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1+git78.f951e3a-150000.1.11.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-150000.241.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-98.151.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150400.3.35.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150400.3.35.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.39.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.39.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"elemental-register","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"elemental-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"elemental-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"elemental-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"elemental-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-slfo.1.1_1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"elemental-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-slfo.1.1_1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-slfo.1.1_8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260430.00-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260430.00-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260430.00-slfo.1.1_1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.24.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150700.15.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.4.0_ce-150000.250.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-150700.9.11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-1.61.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150700.15.17.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"amazon-ssm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5678.0-4.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240716.00-0ubuntu1~16.04.0+esm2"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20150608-1","1:0.0~git20151201.0.7b85b09-2","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2","1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-0ubuntu4","0.21-0ubuntu3","0.21-0ubuntu5","0.22-0ubuntu1","0.22-0ubuntu2","0.23-0ubuntu1","0.23-0ubuntu2","0.23-0ubuntu3","0.24-0ubuntu2","0.24-0ubuntu3","0.24-0ubuntu4","0.25-0ubuntu1","0.26-0ubuntu2","0.26-0ubuntu3","0.27-0ubuntu1","0.27-0ubuntu2","2.0.0~beta1-0ubuntu3","2.0.0~beta1-0ubuntu4","2.0.0~beta2-0ubuntu1","2.0.0~beta2-0ubuntu2","2.0.0~beta3-0ubuntu1","2.0.0~beta3-0ubuntu2","2.0.0~beta3-0ubuntu3","2.0.0~beta3-0ubuntu4","2.0.0~beta4-0ubuntu1","2.0.0~beta4-0ubuntu2","2.0.0~beta4-0ubuntu3","2.0.0~beta4-0ubuntu4","2.0.0~beta4-0ubuntu5","2.0.0~beta4-0ubuntu6","2.0.0~beta4-0ubuntu7","2.0.0~rc1-0ubuntu1","2.0.0~rc1-0ubuntu2","2.0.0~rc1-0ubuntu3","2.0.0~rc2-0ubuntu2","2.0.0~rc2-0ubuntu3","2.0.0~rc3-0ubuntu1","2.0.0~rc3-0ubuntu2","2.0.0~rc3-0ubuntu3","2.0.0~rc3-0ubuntu4","2.0.0~rc4-0ubuntu1","2.0.0~rc5-0ubuntu1","2.0.0~rc6-0ubuntu1","2.0.0~rc6-0ubuntu2","2.0.0~rc7-0ubuntu1","2.0.0~rc7-0ubuntu2","2.0.0~rc8-0ubuntu1","2.0.0~rc8-0ubuntu2","2.0.0~rc8-0ubuntu3","2.0.0~rc8-0ubuntu5","2.0.0~rc8-0ubuntu6","2.0.0~rc8-0ubuntu7","2.0.0~rc9-0ubuntu2","2.0.0~rc9-0ubuntu3","2.0.0~rc9-0ubuntu4","2.0.0~rc9-0ubuntu5","2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.1-0ubuntu1~16.04.1","2.0.2-0ubuntu1~16.04.1","2.0.3-0ubuntu1~ubuntu16.04.2","2.0.4-0ubuntu1~ubuntu16.04.1","2.0.5-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.2","2.0.9-0ubuntu1~16.04.1","2.0.9-0ubuntu1~16.04.2","2.0.10-0ubuntu1~16.04.1","2.0.10-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.4","2.0.11-0ubuntu1~16.04.4+esm1","2.0.11-0ubuntu1~16.04.4+esm2","2.0.11-0ubuntu1~16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4","2.37.4ubuntu0.1","2.38","2.39.2","2.39.2ubuntu0.2","2.40","2.42.1","2.45.1","2.45.1ubuntu0.2","2.46.1","2.47.1","2.48","2.48.3","2.54.3+16.04~esm2","2.54.3+16.04.0ubuntu0.1~esm3","2.54.3+16.04.0ubuntu0.1~esm4","2.54.3+16.04.0ubuntu0.1~esm5","2.54.3+16.04.0ubuntu0.1~esm6","2.61.4ubuntu0.16.04.1+esm1","2.61.4ubuntu0.16.04.1+esm2","2.61.4ubuntu0.16.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18-0ubuntu6","2.19-0ubuntu1","2.20-0ubuntu3","2.20-0ubuntu4","2.21-0ubuntu1","2.21-0ubuntu2","2.21-0ubuntu3","2.21-0ubuntu4","3.0.0~beta2-0ubuntu3","3.0.0~beta3-0ubuntu3","3.0.0~beta5-0ubuntu2","3.0.0~beta7-0ubuntu1","3.0.0-0ubuntu1","3.0.0-0ubuntu2","3.0.0-0ubuntu3","3.0.0-0ubuntu4","3.0.1-0ubuntu1~18.04.1","3.0.2-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.2","3.0.3-0ubuntu1~18.04.2+esm1","3.0.3-0ubuntu1~18.04.2+esm2","3.0.3-0ubuntu1~18.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04","2.37.4+18.04.1","2.38+18.04","2.39.2+18.04","2.40+18.04","2.42.1+18.04","2.45.1+18.04","2.45.1+18.04.2","2.46.1+18.04","2.47.1+18.04","2.48+18.04","2.48.3+18.04","2.49.2+18.04","2.51.1+18.04","2.54.2+18.04ubuntu1","2.54.3+18.04","2.54.3+18.04.2ubuntu0.1","2.54.3+18.04.2ubuntu0.2","2.55.5+18.04","2.57.5+18.04","2.57.5+18.04ubuntu0.1","2.58+18.04","2.58+18.04.1","2.61.4ubuntu0.18.04.1+esm1","2.61.4ubuntu0.18.04.1+esm2","2.61.4ubuntu0.18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20170629.0.5ef0053-1ubuntu1","1:0.0~git20170629.0.5ef0053-1ubuntu2","1:0.0~git20170629.0.5ef0053-2","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2","1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241011.01-0ubuntu1~18.04.0+esm2"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~20.04.0+esm2"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0","20250116.00-0ubuntu1~20.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41+19.10.1","2.42.1+20.04","2.43.3+git1.8109f8","2.44~pre1+20.04","2.44+20.04","2.44.2+20.04","2.44.3+20.04","2.45.1+20.04","2.45.1+20.04.2","2.46.1+20.04","2.47.1+20.04","2.48+20.04","2.48.3+20.04","2.49.2+20.04","2.51.1+20.04ubuntu2","2.54.2+20.04ubuntu2","2.54.3+20.04","2.54.3+20.04.1","2.54.3+20.04.1ubuntu0.1","2.54.3+20.04.1ubuntu0.2","2.54.3+20.04.1ubuntu0.3","2.55.5+20.04","2.57.5+20.04","2.57.5+20.04ubuntu0.1","2.58+20.04","2.58+20.04.1","2.61.3+20.04","2.62+20.04","2.63+20.04","2.63+20.04ubuntu0.1","2.65.3+20.04","2.66.1+20.04","2.67.1+20.04","2.67.1+20.04ubuntu1~esm1","2.67.1+20.04ubuntu1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20190701.4def268-2","1:0.0~git20200221.2aa609c-1","1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1","1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2","1:0.0~git20200221.2aa609c-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~22.04.2"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.53+21.10ubuntu1","2.54.2+22.04ubuntu1","2.54.2+22.04ubuntu2","2.54.2+22.04ubuntu3","2.54.3+git19.g868fc21+22.04","2.54.3+git26.g360067e+22.04","2.55.2+22.04","2.55.2+22.04.1","2.55.3+22.04","2.55.3+22.04ubuntu1","2.55.5+22.04","2.56.2+22.04ubuntu1","2.57.4+22.04","2.57.5+22.04","2.57.5+22.04ubuntu0.1","2.58+22.04","2.58+22.04.1","2.61.3+22.04","2.62+22.04","2.63+22.04","2.63+22.04ubuntu0.1","2.65.3+22.04","2.66.1+22.04","2.67.1+22.04","2.68.5+ubuntu22.04.1","2.71+ubuntu22.04","2.72+ubuntu22.04","2.73+ubuntu22.04","2.73+ubuntu22.04.1","2.74.1+ubuntu22.04.4","2.75.2+ubuntu22.04","2.76+ubuntu22.04","2.76+ubuntu22.04.1","2.76.3+ubuntu22.04","2.76.3+ubuntu22.04.1","2.77.1+ubuntu22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.0~git20201221.eec23a3-1","1:0.0~git20211202.5770296-1","1:0.0~git20211202.5770296-1ubuntu0.1~esm1","1:0.0~git20211202.5770296-1ubuntu0.1~esm2","1:0.0~git20211202.5770296-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~24.04.3"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1","20250116.00-0ubuntu1~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.60.4+23.10","2.61.3+24.04","2.62+24.04build1","2.63+24.04","2.63+24.04ubuntu0.1","2.63.1+24.04","2.65.3+24.04","2.66.1+24.04","2.67.1+24.04","2.68.5+ubuntu24.04.1","2.71+ubuntu24.04","2.72+ubuntu24.04","2.73+ubuntu24.04","2.73+ubuntu24.04.1","2.73+ubuntu24.04.2","2.74.1+ubuntu24.04.4","2.75.2+ubuntu24.04","2.76+ubuntu24.04","2.76+ubuntu24.04.1","2.76.3+ubuntu24.04","2.77.1+ubuntu24.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.4.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.19.0-1ubuntu0.1~esm1","1:0.19.0-1ubuntu0.1~esm2","1:0.19.0-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.25.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250506.01-0ubuntu1.1"}]}],"versions":["20250116.00-0ubuntu2","20250506.01-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.67.1+25.04","2.68.5+ubuntu25.10.2","2.71+ubuntu25.10","2.71.1+ubuntu25.10.1","2.72+ubuntu25.10.2","2.73+ubuntu25.10","2.73+ubuntu25.10.1","2.74.1+ubuntu25.10.4","2.75.2+ubuntu25.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.47.0-1","1:0.55.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250506.01-0ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.1+ubuntu26.04.4","2.76+ubuntu26.10.1","2.76+ubuntu26.10.2","2.76.3+ubuntu26.10","2.77.1+ubuntu26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250506.01-0ubuntu2"}]}],"versions":["20250506.01-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.71.1+ubuntu25.10.1","2.72+ubuntu26.04.1","2.73+ubuntu26.04.1","2.74+ubuntu26.04","2.74.1+ubuntu26.04","2.74.1+ubuntu26.04.3","2.74.1+ubuntu26.04.4","2.75.2+ubuntu26.04.2","2.76+ubuntu26.04.2","2.76+ubuntu26.04.3","2.76.3+ubuntu26.04","2.77.1+ubuntu26.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.45.0-1","1:0.47.0-1","1:0.47.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240716.00-0ubuntu1~16.04.0+esm2"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0","20240716.00-0ubuntu1~16.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241011.01-0ubuntu1~18.04.0+esm2"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~20.04.0+esm2"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0","20250116.00-0ubuntu1~20.04.0+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~22.04.2"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~24.04.3"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1","20250116.00-0ubuntu1~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250506.01-0ubuntu1.1"}]}],"versions":["20250116.00-0ubuntu2","20250506.01-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.72.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.11.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-bp160.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-bp160.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.32.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.35-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1+git78.f951e3a-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rz-pm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"k3sup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.14-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubeseal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kumactl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"elemental-register","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"elemental-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260430.00-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4+git20.5d61136-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260723T184607-160000.1.1"}]}],"bundled":1734},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"zk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.6-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-160000.3.1"}]}],"bundled":39}],"products":[{"vendor":"golang","product":"crypto"},{"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh"}],"references":[{"url":"https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA","tags":["Mailing List","web","advisory","article","report"]},{"url":"https://go.dev/cl/721961","tags":["Patch","web","fix","article","report"]},{"url":"https://go.dev/issue/76363","tags":["Issue Tracking","web","report","article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4134","tags":["Vendor Advisory","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58181","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j5w8-q4qc-rx2x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-58181","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58181.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-58181","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33808","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-73-5-2026-04-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-4-2026-04-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-3-2026-03-23","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-2-2026-03-06","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-1-2026-02-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-0-2026-01-30","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-72-1-2025-12-10","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-72-0-2025-11-21","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-2-2025-10-20","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-1-2025-09-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-0-2025-08-22","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-3-2025-07-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-2-2025-06-27","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-1-2025-06-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-0-2025-06-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-3-2025-05-21","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-2-2025-05-01","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-1-2025-02-14","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-0-2025-01-12","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-2-2024-11-15","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-1-2024-09-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-0-2024-09-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-67-0-2024-06-14","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-66-0-2024-03-10","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-2-2024-01-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-1-2024-01-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-0-2023-11-26","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-2-2023-10-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-1-2023-10-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-0-2023-09-11","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-63-1-2023-07-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-63-0-2023-06-30","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-62-2-2023-03-16","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47914","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3399","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3400","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3401","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42507","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3880","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7291","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27141","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58190","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22873","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68119","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61732","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61731","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61725","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61724","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58186","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58185","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58181","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47910","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68121","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61730","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58189","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58188","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-58183","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61728","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61726","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32289","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32288","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32283","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27144","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27143","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61727","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27139","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27138","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27137","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27142","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7291.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22873","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/06/2","tags":["article"]},{"url":"https://go.dev/cl/670036","tags":["article"]},{"url":"https://go.dev/issue/73555","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4403","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2397528","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47910","tags":["advisory"]},{"url":"https://go.dev/cl/699275","tags":["article"]},{"url":"https://go.dev/issue/75054","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3955","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47911","tags":["advisory"]},{"url":"https://github.com/golang/vulndb/issues/4440","tags":["article"]},{"url":"https://go.dev/cl/709876","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4440","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407247","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47912","tags":["advisory"]},{"url":"https://go.dev/cl/709857","tags":["article"]},{"url":"https://go.dev/issue/75678","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4010","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47914","tags":["advisory"]},{"url":"https://go.dev/cl/721960","tags":["article"]},{"url":"https://go.dev/issue/76364","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4135","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2415997","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58181","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58183","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3122","tags":["article"]},{"url":"https://go.dev/cl/709861","tags":["article"]},{"url":"https://go.dev/issue/75677","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4014","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58185","tags":["advisory"]},{"url":"https://github.com/golang/go/commit/8709a41d5ef7321f486a1857f189c3fee20e8edd","tags":["article"]},{"url":"https://go.dev/cl/709856","tags":["article"]},{"url":"https://go.dev/issue/75671","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4011","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58186","tags":["advisory"]},{"url":"https://go.dev/cl/709855","tags":["article"]},{"url":"https://go.dev/issue/75672","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4012","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58187","tags":["advisory"]},{"url":"https://github.com/golang/go/commit/3fc4c79fdbb17b9b29ea9f8c29dd780df075d4c4","tags":["article"]},{"url":"https://go.dev/cl/709854","tags":["article"]},{"url":"https://go.dev/issue/75681","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4007","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58188","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407260","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58189","tags":["advisory"]},{"url":"https://go.dev/cl/707776","tags":["article"]},{"url":"https://go.dev/issue/75652","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4008","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437110","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58190","tags":["advisory"]},{"url":"https://github.com/golang/vulndb/issues/4441","tags":["article"]},{"url":"https://go.dev/cl/709875","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4441","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61723","tags":["advisory"]},{"url":"https://github.com/golang/go/commit/5ce8cd16f3859ec5ac4106ad8ec15d6236f4501b","tags":["article"]},{"url":"https://go.dev/cl/709858","tags":["article"]},{"url":"https://go.dev/issue/75676","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4009","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61724","tags":["advisory"]},{"url":"https://go.dev/cl/709859","tags":["article"]},{"url":"https://go.dev/issue/75716","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4015","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407249","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61725","tags":["advisory"]},{"url":"https://go.dev/cl/709860","tags":["article"]},{"url":"https://go.dev/issue/75680","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4006","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61726","tags":["advisory"]},{"url":"https://go.dev/cl/736712","tags":["article"]},{"url":"https://go.dev/issue/77101","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4341","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61727","tags":["advisory"]},{"url":"https://go.dev/cl/723900","tags":["article"]},{"url":"https://go.dev/issue/76442","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4175","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","tags":["advisory"]},{"url":"https://go.dev/cl/736713","tags":["article"]},{"url":"https://go.dev/issue/77102","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4342","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61729","tags":["advisory"]},{"url":"https://go.dev/cl/725920","tags":["article"]},{"url":"https://go.dev/issue/76445","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4155","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61731","tags":["advisory"]},{"url":"https://go.dev/cl/736711","tags":["article"]},{"url":"https://go.dev/issue/77100","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4339","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437016","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61732","tags":["advisory"]},{"url":"https://go.dev/cl/734220","tags":["article"]},{"url":"https://go.dev/issue/76697","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4433","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434438","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68119","tags":["advisory"]},{"url":"https://go.dev/cl/736710","tags":["article"]},{"url":"https://go.dev/issue/77099","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4338","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68121","tags":["advisory"]},{"url":"https://go.dev/cl/737700","tags":["article"]},{"url":"https://go.dev/issue/77217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4337","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27137","tags":["advisory"]},{"url":"https://go.dev/cl/752182","tags":["article"]},{"url":"https://go.dev/issue/77952","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4599","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27138","tags":["advisory"]},{"url":"https://go.dev/cl/752183","tags":["article"]},{"url":"https://go.dev/issue/77953","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4600","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27139","tags":["advisory"]},{"url":"https://go.dev/cl/749480","tags":["article"]},{"url":"https://go.dev/issue/77827","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4602","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27141","tags":["advisory"]},{"url":"https://go.dev/cl/746180","tags":["article"]},{"url":"https://go.dev/issue/77652","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4559","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27142","tags":["advisory"]},{"url":"https://go.dev/cl/752081","tags":["article"]},{"url":"https://go.dev/issue/77954","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4603","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27143","tags":["advisory"]},{"url":"https://go.dev/cl/763765","tags":["article"]},{"url":"https://go.dev/issue/78333","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4868","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27144","tags":["advisory"]},{"url":"https://go.dev/cl/763764","tags":["article"]},{"url":"https://go.dev/issue/78371","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4867","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","tags":["advisory"]},{"url":"https://go.dev/cl/763767","tags":["article"]},{"url":"https://go.dev/issue/78334","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4870","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32288","tags":["advisory"]},{"url":"https://go.dev/cl/763766","tags":["article"]},{"url":"https://go.dev/issue/78301","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4869","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289","tags":["advisory"]},{"url":"https://go.dev/cl/763762","tags":["article"]},{"url":"https://go.dev/issue/78331","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4865","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33809","tags":["advisory"]},{"url":"https://go.dev/cl/757660","tags":["article"]},{"url":"https://go.dev/issue/78267","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4815","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7385","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33813","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42503","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7385.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33813","tags":["advisory"]},{"url":"https://go.dev/cl/759860","tags":["article"]},{"url":"https://go.dev/issue/78407","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4961","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42503","tags":["advisory"]},{"url":"https://go.dev/cl/774381","tags":["article"]},{"url":"https://go.dev/issue/79211","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260439-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237608","tags":["report"]},{"url":"https://bugzilla.suse.com/1238611","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://bugzilla.suse.com/1241710","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253784","tags":["report"]},{"url":"https://bugzilla.suse.com/1253967","tags":["report"]},{"url":"https://bugzilla.suse.com/1255462","tags":["report"]},{"url":"https://bugzilla.suse.com/1257432","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8556","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260592-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234486","tags":["report"]},{"url":"https://bugzilla.suse.com/1237611","tags":["report"]},{"url":"https://bugzilla.suse.com/1238683","tags":["report"]},{"url":"https://bugzilla.suse.com/1239186","tags":["report"]},{"url":"https://bugzilla.suse.com/1239323","tags":["report"]},{"url":"https://bugzilla.suse.com/1240444","tags":["report"]},{"url":"https://bugzilla.suse.com/1253802","tags":["report"]},{"url":"https://bugzilla.suse.com/1256535","tags":["report"]},{"url":"https://bugzilla.suse.com/1257138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260666-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253904","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260772-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250620","tags":["report"]},{"url":"https://bugzilla.suse.com/1253913","tags":["report"]},{"url":"https://bugzilla.suse.com/1256496","tags":["report"]},{"url":"https://bugzilla.suse.com/1256562","tags":["report"]},{"url":"https://bugzilla.suse.com/1257080","tags":["report"]},{"url":"https://bugzilla.suse.com/1257085","tags":["report"]},{"url":"https://bugzilla.suse.com/1257139","tags":["report"]},{"url":"https://bugzilla.suse.com/1258542","tags":["report"]},{"url":"https://bugzilla.suse.com/1258612","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260972-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261118-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241826","tags":["report"]},{"url":"https://bugzilla.suse.com/1241857","tags":["report"]},{"url":"https://bugzilla.suse.com/1251511","tags":["report"]},{"url":"https://bugzilla.suse.com/1251679","tags":["report"]},{"url":"https://bugzilla.suse.com/1253581","tags":["report"]},{"url":"https://bugzilla.suse.com/1253901","tags":["report"]},{"url":"https://bugzilla.suse.com/1254079","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620244-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620357-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620539-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620578-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620651-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620694-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620904-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621756-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253952","tags":["report"]},{"url":"https://bugzilla.suse.com/1260224","tags":["report"]},{"url":"https://bugzilla.suse.com/1264759","tags":["report"]},{"url":"https://bugzilla.suse.com/1264762","tags":["report"]},{"url":"https://bugzilla.suse.com/1265274","tags":["report"]},{"url":"https://bugzilla.suse.com/1265275","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621827-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621989-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210938","tags":["report"]},{"url":"https://bugzilla.suse.com/1239334","tags":["report"]},{"url":"https://bugzilla.suse.com/1239944","tags":["report"]},{"url":"https://bugzilla.suse.com/1243254","tags":["report"]},{"url":"https://bugzilla.suse.com/1243505","tags":["report"]},{"url":"https://bugzilla.suse.com/1245759","tags":["report"]},{"url":"https://bugzilla.suse.com/1253889","tags":["report"]},{"url":"https://bugzilla.suse.com/1257010","tags":["report"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://bugzilla.suse.com/1262926","tags":["report"]},{"url":"https://bugzilla.suse.com/1265762","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622128-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622133-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262400-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251420","tags":["report"]},{"url":"https://bugzilla.suse.com/1251615","tags":["report"]},{"url":"https://bugzilla.suse.com/1253559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253935","tags":["report"]},{"url":"https://bugzilla.suse.com/1254014","tags":["report"]},{"url":"https://bugzilla.suse.com/1260234","tags":["report"]},{"url":"https://bugzilla.suse.com/1265467","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7374","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262401-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262429-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262493-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230323","tags":["report"]},{"url":"https://bugzilla.suse.com/1236523","tags":["report"]},{"url":"https://bugzilla.suse.com/1238699","tags":["report"]},{"url":"https://bugzilla.suse.com/1241838","tags":["report"]},{"url":"https://bugzilla.suse.com/1251495","tags":["report"]},{"url":"https://bugzilla.suse.com/1251689","tags":["report"]},{"url":"https://bugzilla.suse.com/1260295","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262581-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234563","tags":["report"]},{"url":"https://bugzilla.suse.com/1236533","tags":["report"]},{"url":"https://bugzilla.suse.com/1266171","tags":["report"]},{"url":"https://bugzilla.suse.com/1266603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262612-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208300","tags":["report"]},{"url":"https://bugzilla.suse.com/1241030","tags":["report"]},{"url":"https://bugzilla.suse.com/1241033","tags":["report"]},{"url":"https://bugzilla.suse.com/1241728","tags":["report"]},{"url":"https://bugzilla.suse.com/1251365","tags":["report"]},{"url":"https://bugzilla.suse.com/1251559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253508","tags":["report"]},{"url":"https://bugzilla.suse.com/1253517","tags":["report"]},{"url":"https://bugzilla.suse.com/1253797","tags":["report"]},{"url":"https://bugzilla.suse.com/1253799","tags":["report"]},{"url":"https://bugzilla.suse.com/1253980","tags":["report"]},{"url":"https://bugzilla.suse.com/1253983","tags":["report"]},{"url":"https://bugzilla.suse.com/1258096","tags":["report"]},{"url":"https://bugzilla.suse.com/1260139","tags":["report"]},{"url":"https://bugzilla.suse.com/1260149","tags":["report"]},{"url":"https://bugzilla.suse.com/1260180","tags":["report"]},{"url":"https://bugzilla.suse.com/1263247","tags":["report"]},{"url":"https://bugzilla.suse.com/1263313","tags":["report"]},{"url":"https://bugzilla.suse.com/1263357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263411","tags":["report"]},{"url":"https://bugzilla.suse.com/1263445","tags":["report"]},{"url":"https://bugzilla.suse.com/1263515","tags":["report"]},{"url":"https://bugzilla.suse.com/1263606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264862","tags":["report"]},{"url":"https://bugzilla.suse.com/1264888","tags":["report"]},{"url":"https://bugzilla.suse.com/1264938","tags":["report"]},{"url":"https://bugzilla.suse.com/1266051","tags":["report"]},{"url":"https://bugzilla.suse.com/1266057","tags":["report"]},{"url":"https://bugzilla.suse.com/1266086","tags":["report"]},{"url":"https://bugzilla.suse.com/1266112","tags":["report"]},{"url":"https://bugzilla.suse.com/1266122","tags":["report"]},{"url":"https://bugzilla.suse.com/1266127","tags":["report"]},{"url":"https://bugzilla.suse.com/1266132","tags":["report"]},{"url":"https://bugzilla.suse.com/1266150","tags":["report"]},{"url":"https://bugzilla.suse.com/1266160","tags":["report"]},{"url":"https://bugzilla.suse.com/1266477","tags":["report"]},{"url":"https://bugzilla.suse.com/1266482","tags":["report"]},{"url":"https://bugzilla.suse.com/1266541","tags":["report"]},{"url":"https://bugzilla.suse.com/1266547","tags":["report"]},{"url":"https://bugzilla.suse.com/1267058","tags":["report"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262265","tags":["report"]},{"url":"https://bugzilla.suse.com/1265736","tags":["report"]},{"url":"https://bugzilla.suse.com/1266575","tags":["report"]},{"url":"https://bugzilla.suse.com/1267120","tags":["report"]},{"url":"https://bugzilla.suse.com/1269093","tags":["report"]},{"url":"https://bugzilla.suse.com/1272000","tags":["report"]},{"url":"https://bugzilla.suse.com/1272840","tags":["report"]},{"url":"https://bugzilla.suse.com/1273606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253611","tags":["report"]},{"url":"https://bugzilla.suse.com/1253946","tags":["report"]},{"url":"https://bugzilla.suse.com/1254082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-58181","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA?pli=1","tags":["report"]},{"url":"https://github.com/golang/go/issues/76363","tags":["report"]},{"url":"https://github.com/golang/crypto/commit/e79546e28b85ea53dd37afe1c4102746ef553b9c","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7956-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251363","tags":["report"]},{"url":"https://bugzilla.suse.com/1251547","tags":["report"]},{"url":"https://bugzilla.suse.com/1253512","tags":["report"]},{"url":"https://bugzilla.suse.com/1253786","tags":["report"]},{"url":"https://bugzilla.suse.com/1253977","tags":["report"]},{"url":"https://bugzilla.suse.com/1234565","tags":["report"]},{"url":"https://bugzilla.suse.com/1239494","tags":["report"]},{"url":"https://bugzilla.suse.com/1251463","tags":["report"]},{"url":"https://bugzilla.suse.com/1251664","tags":["report"]},{"url":"https://bugzilla.suse.com/1253930","tags":["report"]},{"url":"https://bugzilla.suse.com/1254084","tags":["report"]},{"url":"https://bugzilla.suse.com/1247629","tags":["report"]},{"url":"https://bugzilla.suse.com/1253593","tags":["report"]},{"url":"https://bugzilla.suse.com/1253922","tags":["report"]},{"url":"https://bugzilla.suse.com/1254051","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://bugzilla.suse.com/1240513","tags":["report"]},{"url":"https://bugzilla.suse.com/1254206","tags":["report"]},{"url":"https://bugzilla.suse.com/1232964","tags":["report"]},{"url":"https://bugzilla.suse.com/1233422","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://bugzilla.suse.com/1228324","tags":["report"]},{"url":"https://bugzilla.suse.com/1234595","tags":["report"]},{"url":"https://bugzilla.suse.com/1234794","tags":["report"]},{"url":"https://bugzilla.suse.com/1235211","tags":["report"]},{"url":"https://bugzilla.suse.com/1236528","tags":["report"]},{"url":"https://bugzilla.suse.com/1237679","tags":["report"]},{"url":"https://bugzilla.suse.com/1239341","tags":["report"]},{"url":"https://bugzilla.suse.com/1253924","tags":["report"]},{"url":"https://bugzilla.suse.com/1258047","tags":["report"]},{"url":"https://bugzilla.suse.com/1258048","tags":["report"]},{"url":"https://bugzilla.suse.com/1260311","tags":["report"]},{"url":"https://bugzilla.suse.com/1262956","tags":["report"]},{"url":"https://bugzilla.suse.com/1264177","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://bugzilla.suse.com/1227010","tags":["report"]},{"url":"https://bugzilla.suse.com/1232948","tags":["report"]},{"url":"https://bugzilla.suse.com/1234512","tags":["report"]},{"url":"https://bugzilla.suse.com/1235265","tags":["report"]},{"url":"https://bugzilla.suse.com/1237618","tags":["report"]},{"url":"https://bugzilla.suse.com/1239225","tags":["report"]},{"url":"https://bugzilla.suse.com/1239385","tags":["report"]},{"url":"https://bugzilla.suse.com/1240466","tags":["report"]},{"url":"https://bugzilla.suse.com/1241724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243633","tags":["report"]},{"url":"https://bugzilla.suse.com/1246151","tags":["report"]},{"url":"https://bugzilla.suse.com/1246730","tags":["report"]},{"url":"https://bugzilla.suse.com/1248897","tags":["report"]},{"url":"https://bugzilla.suse.com/1248937","tags":["report"]},{"url":"https://bugzilla.suse.com/1250625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://bugzilla.suse.com/1234582","tags":["report"]},{"url":"https://bugzilla.suse.com/1239422","tags":["report"]},{"url":"https://bugzilla.suse.com/1253918","tags":["report"]},{"url":"https://bugzilla.suse.com/1265920","tags":["report"]},{"url":"https://bugzilla.suse.com/1266794","tags":["report"]},{"url":"https://bugzilla.suse.com/1253563","tags":["report"]},{"url":"https://bugzilla.suse.com/1253864","tags":["report"]},{"url":"https://bugzilla.suse.com/1254023","tags":["report"]},{"url":"https://bugzilla.suse.com/1258591","tags":["report"]},{"url":"https://bugzilla.suse.com/1260696","tags":["report"]},{"url":"https://bugzilla.suse.com/1266158","tags":["report"]},{"url":"https://bugzilla.suse.com/1266596","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-11084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-34410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-34429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-34430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-41115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-41117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-41118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-41410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-41436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-41443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-44001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-44004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-44005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-51667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-56760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-56761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-63389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-63811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-36045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9804","tags":["web"]},{"url":"https://bugzilla.suse.com/1248946","tags":["report"]},{"url":"https://bugzilla.suse.com/1262269","tags":["report"]},{"url":"https://bugzilla.suse.com/1262952","tags":["report"]},{"url":"https://bugzilla.suse.com/1265799","tags":["report"]},{"url":"https://bugzilla.suse.com/1266179","tags":["report"]},{"url":"https://bugzilla.suse.com/1266639","tags":["report"]},{"url":"https://bugzilla.suse.com/1267176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272064","tags":["report"]},{"url":"https://bugzilla.suse.com/1276687","tags":["report"]},{"url":"https://bugzilla.suse.com/1278621","tags":["report"]},{"url":"https://bugzilla.suse.com/1279234","tags":["report"]},{"url":"https://bugzilla.suse.com/1279315","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-58181","title":"Unbounded memory consumption in golang.org/x/crypto/ssh","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T20:33:42.795Z","modified":"2025-11-20T17:14:59.856Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:37.027582Z"}],"euvd":[{"id":"EUVD-2025-198228","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T20:33:42Z","modified":"2025-11-20T17:14:59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:14.564249Z"}],"ghsa":[{"id":"GHSA-j5w8-q4qc-rx2x","title":"golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T23:01:20Z","modified":"2025-11-19T23:01:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2025-58181","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T21:15:50.85Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:11:46.009629Z"}],"osv":[{"id":"ALPINE-CVE-2025-58181","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T21:15:50.85Z","modified":"2026-11-03T06:33:00.805145467Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-58181","title":"Unbounded memory consumption in golang.org/x/crypto/ssh","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T20:33:42.795Z","modified":"2026-11-03T22:56:58.103786213Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T23:33:36.422322Z"},{"id":"DEBIAN-CVE-2025-58181","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T21:15:50.85Z","modified":"2026-10-23T18:04:36.97361677Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-j5w8-q4qc-rx2x","title":"golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T23:01:20Z","modified":"2026-09-10T03:50:30.983878807Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"OESA-2026-3398","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)","status":"published","published":"2026-08-13T14:02:50Z","modified":"2026-08-16T01:45:20.618925247Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3399","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)","status":"published","published":"2026-08-13T14:02:52Z","modified":"2026-08-16T01:45:20.42245005Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3400","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)","status":"published","published":"2026-08-13T14:02:54Z","modified":"2026-08-16T01:45:19.250274264Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3401","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)","status":"published","published":"2026-08-13T14:02:56Z","modified":"2026-08-16T01:45:20.294124292Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3879","title":"git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\r\n\r\nSecurity Fix(es):\n\nThe filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk\u0026apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)\n\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)\n\nIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\u0026quot;\u0026quot;, \u0026quot;.\u0026quot;, and \u0026quot;..\u0026quot;), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)\n\nWhen using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)\n\nThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \u0026quot;http://[::1]/\u0026quot;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)\n\nA vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as problematic.Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 1.25.2 eliminates this vulnerability.(CVE-2025-58183)\n\nParsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)\n\nDespite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \u0026quot;a=;\u0026quot;, an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)\n\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)\n\nWhen Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)\n\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)\n\nThe Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)\n\nThe net/url package in the Go standard library does not impose a limit on the number of query parameters in a query string. While the overall size of query parameters in URLs is generally constrained by the maximum request header size, the net/http.Request.ParseForm method is capable of parsing large URL-encoded forms. An attacker can exploit this by submitting a form containing an excessive number of unique query parameters, leading to disproportionate memory consumption and potentially causing a Denial of Service (DoS) condition in the affected application.(CVE-2025-61726)\n\nAn excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)\n\nWithin HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)\n\nDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.(CVE-2025-68121)\n\n[\u0026apos;announces:\u0026apos;, \u0026quot;We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n  * crypto/x509: incorrect enforcement of email constraints\\n\\n    When verifying a certificate chain which contains a certificate containing\\n    multiple email address constraints (composed of the full email address)\\n    which share common local portions (the portion of the address before the \u0026apos;@\u0026apos;\\n    character) but different domain portions (the portion of the address after\\n    the \u0026apos;@\u0026apos; character), these constraints will not be properly applied, and only\\n    the last constraint will be considered.\\n\\n    This can allow certificates in the chain containing email addresses which\\n    are either not permitted or excluded by the relevant constraints to be\\n    returned by calls to Certificate.Verify. Since the name constraint checks\\n    happen after chain building is complete, this only applies to certificate\\n    chains which chain to trusted roots (root certificates either in\\n    VerifyOptions.Roots or in the system root certificate pool), requiring a\\n    trusted CA to issue certificates containing either not permitted or\\n    excluded email addresses.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27137 and Go issue\u0026quot;, \u0026apos;.\\n\\n  * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n    Certificate verification can panic when a certificate in the chain has an\\n    empty DNS name and another certificate in the chain has excluded name\\n    constraints. This can crash programs that are either directly verifying\\n    X.509 certificate chains, or those that use TLS.\\n\\n    Since the name constraint checks happen after chain building is complete,\\n    this only applies to certificate chains which chain to trusted roots (root\\n    certificates either in VerifyOptions.Roots or in the system root certificate\\n    pool), requiring a trusted CA to issue certificates containing malformed DNS\\n    names.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27138 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * html/template: URLs in meta content attribute actions are not escaped\\n\\n    Actions which insert URLs into the content attribute of HTML meta tags are\\n    not escaped. This can allow XSS if the meta tag also has an http-equiv\\n    attribute with the value \u0026quot;refresh\u0026quot;.\\n\\n    A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n    used to disable escaping URLs in actions in the meta content attribute which\\n    follow \u0026quot;url=\u0026quot; by setting htmlmetacontenturlescape=0.\\n\\n    This is CVE-2026-27142 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * net/url: reject IPv6 literal not at start of host\\n\\n    The Go standard library function net/url.Parse insufficiently\\n    validated the host/authority component and accepted some invalid URLs\\n    by effectively treating garbage before an IP-literal as ignorable.\\n    The function should have rejected this as invalid.\\n\\n    To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n    that do not appear at the start of the host subcomponent of a URL.\\n\\n    Thanks to Masaki Hara (\u0026apos;, \u0026apos;) of Wantedly.\\n\\n    This is CVE-2026-25679 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * os: FileInfo can escape from a Root\\n\\n    On Unix platforms, when listing the contents of a directory using\\n    File.ReadDir or File.Readdir the returned FileInfo could reference\\n    a file outside of the Root in which the File was opened.\\n\\n    The contents of the FileInfo were populated using the lstat system\\n    call, which takes the path to the file as a parameter. If a component\\n    of the full path of the file described by the FileInfo is replaced with\\n    a symbolic link, the target of the lstat can be directed to another\\n    location on the filesystem.\\n\\n    The impact of this escape is limited to reading metadata provided by\\n    lstat from arbitrary locations on the filesystem. This could be used\\n    to p(CVE-2026-25679)\n\nWhen verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.(CVE-2026-27137)\n\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic(CVE-2026-27141)\n\nDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)\n\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-32281)\n\nOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.(CVE-2026-32282)\n\nWhen verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-33810)\n\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.(CVE-2026-33811)\n\nA vulnerability was found in the encoding/asn1 package in Go. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.(CVE-2026-33818)\n\nWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.(CVE-2026-42507)\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.(CVE-2026-46600)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.(CVE-2026-56853)\n\nA flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, causing the depth counter to reset and never fire, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)","status":"published","published":"2026-09-20T13:22:51Z","modified":"2026-09-20T13:30:21.787721587Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3880","title":"git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\r\n\r\nSecurity Fix(es):\n\nThe filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk\u0026apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)\n\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)\n\nIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\u0026quot;\u0026quot;, \u0026quot;.\u0026quot;, and \u0026quot;..\u0026quot;), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)\n\nWhen using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)\n\nThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \u0026quot;http://[::1]/\u0026quot;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)\n\nA vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as problematic.Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 1.25.2 eliminates this vulnerability.(CVE-2025-58183)\n\nParsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)\n\nDespite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \u0026quot;a=;\u0026quot;, an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)\n\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)\n\nWhen Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)\n\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)\n\nThe Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)\n\nThe net/url package in the Go standard library does not impose a limit on the number of query parameters in a query string. While the overall size of query parameters in URLs is generally constrained by the maximum request header size, the net/http.Request.ParseForm method is capable of parsing large URL-encoded forms. An attacker can exploit this by submitting a form containing an excessive number of unique query parameters, leading to disproportionate memory consumption and potentially causing a Denial of Service (DoS) condition in the affected application.(CVE-2025-61726)\n\nAn excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)\n\nWithin HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)\n\nDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.(CVE-2025-68121)\n\n[\u0026apos;announces:\u0026apos;, \u0026quot;We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n  * crypto/x509: incorrect enforcement of email constraints\\n\\n    When verifying a certificate chain which contains a certificate containing\\n    multiple email address constraints (composed of the full email address)\\n    which share common local portions (the portion of the address before the \u0026apos;@\u0026apos;\\n    character) but different domain portions (the portion of the address after\\n    the \u0026apos;@\u0026apos; character), these constraints will not be properly applied, and only\\n    the last constraint will be considered.\\n\\n    This can allow certificates in the chain containing email addresses which\\n    are either not permitted or excluded by the relevant constraints to be\\n    returned by calls to Certificate.Verify. Since the name constraint checks\\n    happen after chain building is complete, this only applies to certificate\\n    chains which chain to trusted roots (root certificates either in\\n    VerifyOptions.Roots or in the system root certificate pool), requiring a\\n    trusted CA to issue certificates containing either not permitted or\\n    excluded email addresses.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27137 and Go issue\u0026quot;, \u0026apos;.\\n\\n  * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n    Certificate verification can panic when a certificate in the chain has an\\n    empty DNS name and another certificate in the chain has excluded name\\n    constraints. This can crash programs that are either directly verifying\\n    X.509 certificate chains, or those that use TLS.\\n\\n    Since the name constraint checks happen after chain building is complete,\\n    this only applies to certificate chains which chain to trusted roots (root\\n    certificates either in VerifyOptions.Roots or in the system root certificate\\n    pool), requiring a trusted CA to issue certificates containing malformed DNS\\n    names.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27138 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * html/template: URLs in meta content attribute actions are not escaped\\n\\n    Actions which insert URLs into the content attribute of HTML meta tags are\\n    not escaped. This can allow XSS if the meta tag also has an http-equiv\\n    attribute with the value \u0026quot;refresh\u0026quot;.\\n\\n    A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n    used to disable escaping URLs in actions in the meta content attribute which\\n    follow \u0026quot;url=\u0026quot; by setting htmlmetacontenturlescape=0.\\n\\n    This is CVE-2026-27142 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * net/url: reject IPv6 literal not at start of host\\n\\n    The Go standard library function net/url.Parse insufficiently\\n    validated the host/authority component and accepted some invalid URLs\\n    by effectively treating garbage before an IP-literal as ignorable.\\n    The function should have rejected this as invalid.\\n\\n    To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n    that do not appear at the start of the host subcomponent of a URL.\\n\\n    Thanks to Masaki Hara (\u0026apos;, \u0026apos;) of Wantedly.\\n\\n    This is CVE-2026-25679 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * os: FileInfo can escape from a Root\\n\\n    On Unix platforms, when listing the contents of a directory using\\n    File.ReadDir or File.Readdir the returned FileInfo could reference\\n    a file outside of the Root in which the File was opened.\\n\\n    The contents of the FileInfo were populated using the lstat system\\n    call, which takes the path to the file as a parameter. If a component\\n    of the full path of the file described by the FileInfo is replaced with\\n    a symbolic link, the target of the lstat can be directed to another\\n    location on the filesystem.\\n\\n    The impact of this escape is limited to reading metadata provided by\\n    lstat from arbitrary locations on the filesystem. This could be used\\n    to p(CVE-2026-25679)\n\nWhen verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.(CVE-2026-27137)\n\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic(CVE-2026-27141)\n\nDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)\n\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-32281)\n\nOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.(CVE-2026-32282)\n\nWhen verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-33810)\n\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.(CVE-2026-33811)\n\nA vulnerability was found in the encoding/asn1 package in Go. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.(CVE-2026-33818)\n\nWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.(CVE-2026-42507)\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.(CVE-2026-46600)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.(CVE-2026-56853)\n\nA flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, causing the depth counter to reset and never fire, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)","status":"published","published":"2026-09-20T13:22:51Z","modified":"2026-09-20T13:30:21.883092864Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4068","title":"git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\r\n\r\nSecurity Fix(es):\n\nProcessing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)\n\nQUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)\n\nThe filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)\n\nCalling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)\n\nGit LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository\u0026apos;s working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk\u0026apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)\n\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)\n\nThe go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \u0026quot;go get\u0026quot;, are not affected.(CVE-2025-4674)\n\nGit GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-46835)\n\nIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\u0026quot;\u0026quot;, \u0026quot;.\u0026quot;, and \u0026quot;..\u0026quot;), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)\n\nWhen using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)\n\nThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \u0026quot;http://[::1]/\u0026quot;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48384)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)\n\nA vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as problematic.Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 1.25.2 eliminates this vulnerability.(CVE-2025-58183)\n\nParsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)\n\nDespite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \u0026quot;a=;\u0026quot;, an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)\n\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)\n\nValidating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.(CVE-2025-58188)\n\nWhen Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)\n\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)\n\nThe Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)\n\nThe ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.(CVE-2025-61725)\n\nThe net/url package in the Go standard library does not impose a limit on the number of query parameters in a query string. While the overall size of query parameters in URLs is generally constrained by the maximum request header size, the net/http.Request.ParseForm method is capable of parsing large URL-encoded forms. An attacker can exploit this by submitting a form containing an excessive number of unique query parameters, leading to disproportionate memory consumption and potentially causing a Denial of Service (DoS) condition in the affected application.(CVE-2025-61726)\n\nAn excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)\n\nWithin HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)\n\nDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.(CVE-2025-68121)\n\n[\u0026apos;announces:\u0026apos;, \u0026quot;We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n  * crypto/x509: incorrect enforcement of email constraints\\n\\n    When verifying a certificate chain which contains a certificate containing\\n    multiple email address constraints (composed of the full email address)\\n    which share common local portions (the portion of the address before the \u0026apos;@\u0026apos;\\n    character) but different domain portions (the portion of the address after\\n    the \u0026apos;@\u0026apos; character), these constraints will not be properly applied, and only\\n    the last constraint will be considered.\\n\\n    This can allow certificates in the chain containing email addresses which\\n    are either not permitted or excluded by the relevant constraints to be\\n    returned by calls to Certificate.Verify. Since the name constraint checks\\n    happen after chain building is complete, this only applies to certificate\\n    chains which chain to trusted roots (root certificates either in\\n    VerifyOptions.Roots or in the system root certificate pool), requiring a\\n    trusted CA to issue certificates containing either not permitted or\\n    excluded email addresses.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27137 and Go issue\u0026quot;, \u0026apos;.\\n\\n  * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n    Certificate verification can panic when a certificate in the chain has an\\n    empty DNS name and another certificate in the chain has excluded name\\n    constraints. This can crash programs that are either directly verifying\\n    X.509 certificate chains, or those that use TLS.\\n\\n    Since the name constraint checks happen after chain building is complete,\\n    this only applies to certificate chains which chain to trusted roots (root\\n    certificates either in VerifyOptions.Roots or in the system root certificate\\n    pool), requiring a trusted CA to issue certificates containing malformed DNS\\n    names.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27138 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * html/template: URLs in meta content attribute actions are not escaped\\n\\n    Actions which insert URLs into the content attribute of HTML meta tags are\\n    not escaped. This can allow XSS if the meta tag also has an http-equiv\\n    attribute with the value \u0026quot;refresh\u0026quot;.\\n\\n    A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n    used to disable escaping URLs in actions in the meta content attribute which\\n    follow \u0026quot;url=\u0026quot; by setting htmlmetacontenturlescape=0.\\n\\n    This is CVE-2026-27142 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * net/url: reject IPv6 literal not at start of host\\n\\n    The Go standard library function net/url.Parse insufficiently\\n    validated the host/authority component and accepted some invalid URLs\\n    by effectively treating garbage before an IP-literal as ignorable.\\n    The function should have rejected this as invalid.\\n\\n    To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n    that do not appear at the start of the host subcomponent of a URL.\\n\\n    Thanks to Masaki Hara (\u0026apos;, \u0026apos;) of Wantedly.\\n\\n    This is CVE-2026-25679 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * os: FileInfo can escape from a Root\\n\\n    On Unix platforms, when listing the contents of a directory using\\n    File.ReadDir or File.Readdir the returned FileInfo could reference\\n    a file outside of the Root in which the File was opened.\\n\\n    The contents of the FileInfo were populated using the lstat system\\n    call, which takes the path to the file as a parameter. If a component\\n    of the full path of the file described by the FileInfo is replaced with\\n    a symbolic link, the target of the lstat can be directed to another\\n    location on the filesystem.\\n\\n    The impact of this escape is limited to reading metadata provided by\\n    lstat from arbitrary locations on the filesystem. This could be used\\n    to p(CVE-2026-25679)\n\nWhen verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.(CVE-2026-27137)\n\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic(CVE-2026-27141)\n\nDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)\n\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-32281)\n\nOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.(CVE-2026-32282)\n\nWhen verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-33810)\n\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.(CVE-2026-33811)\n\nA vulnerability was found in the encoding/asn1 package in Go. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.(CVE-2026-33818)\n\nWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.(CVE-2026-42507)\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.(CVE-2026-46600)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.(CVE-2026-56853)\n\nA flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, causing the depth counter to reset and never fire, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)","status":"published","published":"2026-09-25T01:28:01Z","modified":"2026-09-25T01:45:11.310843798Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:7291","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-14T10:08:50Z","modified":"2026-10-20T10:15:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7385","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-15T10:18:16Z","modified":"2026-10-20T10:15:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-APP-GOBINARY-CVE-2025-58181","title":"CVE-2025-58181 in golang.org/x/crypto - Patched by Root","description":"Root has patched CVE-2025-58181 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-22T09:47:50Z","modified":"2026-10-22T10:15:03.903334436Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2025-58181","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T21:15:00Z","modified":"2026-10-22T23:19:38.996132332Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"GO-2025-4134","title":"Unbounded memory consumption in golang.org/x/crypto/ssh","description":"SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.","status":"published","published":"2025-11-19T20:11:57Z","modified":"2026-05-15T10:59:24.784913658Z","updated_at":"2026-11-02T15:47:02.011123Z"},{"id":"MGASA-2026-0147","title":"Updated rclone packages fix security vulnerabilities","description":"This update bring new features, bugs and vulnerabilities fixed in rclone\nand golang components used to build it.\n","status":"published","published":"2026-05-18T19:12:53Z","modified":"2026-05-18T19:33:24.032777418Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-RU-2026:20010-1","title":"Recommended update for trivy","description":"This update for trivy fixes the following issues:\n\n- Update to version 0.68.2:\n  * release: v0.68.2 [release/v0.68] (#9950)\n  * fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)\n  * ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)\n","status":"withdrawn","published":"2026-01-08T14:37:24Z","modified":"2026-06-24T14:04:06.315733329Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2025:15761-1","title":"rclone-1.72.0-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.72.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-24T00:00:00Z","modified":"2026-03-23T04:54:10.274372Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15763-1","title":"cloudflared-2025.11.1-1.1 on GA media","description":"These are all security issues fixed in the cloudflared-2025.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-25T00:00:00Z","modified":"2026-03-23T04:54:10.287919Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15771-1","title":"git-bug-0.10.1-3.1 on GA media","description":"These are all security issues fixed in the git-bug-0.10.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2026-03-23T04:54:11.144405Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15773-1","title":"cheat-4.4.2-3.1 on GA media","description":"These are all security issues fixed in the cheat-4.4.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-27T00:00:00Z","modified":"2026-03-23T04:54:10.965197Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:15774-1","title":"netbird-0.60.3-1.1 on GA media","description":"These are all security issues fixed in the netbird-0.60.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-27T00:00:00Z","modified":"2026-03-23T04:54:11.23795Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:15841-1","title":"zk-0.15.2-1.1 on GA media","description":"These are all security issues fixed in the zk-0.15.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-22T00:00:00Z","modified":"2026-03-23T04:54:14.105514Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:20143-1","title":"Security update for git-bug","description":"This update for git-bug fixes the following issues:\n\nChanges in git-bug:\n\n- Revendor to include fixed version of depending libraries:\n  - GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade\n    golang.org/x/crypto to v0.43.0\n  - GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade\n    github.com/go-viper/mapstructure/v2 to v2.4.0\n  - GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous\n  - GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade\n    github.com/cloudflare/circl to v1.6.1\n  - GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade\n    golang.org/x/crypto/ssh to v0.45.0\n  - GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade\n    golang.org/x/crypto/ssh/agent to v0.45.0\n\n- Revendor to include golang.org/x/net/html v 0.45.0 to prevent\n  possible DoS by various algorithms with quadratic complexity\n  when parsing HTML documents (bsc#1251463, CVE-2025-47911 and\n  bsc#1251664, CVE-2025-58190).\n\nUpdate to version 0.10.1:\n\n  - cli: ignore missing sections when removing configuration (ddb22a2f)\n\nUpdate to version 0.10.0:\n\n  - bridge: correct command used to create a new bridge (9942337b)\n  - web: simplify header navigation (7e95b169)\n  - webui: remark upgrade + gfm + syntax highlighting (6ee47b96)\n  - BREAKING CHANGE: dev-infra: remove gokart (89b880bd)\n\nUpdate to version 0.10.0:\n\n  - bridge: correct command used to create a new bridge (9942337b)\n  - web: simplify header navigation (7e95b169)\n  - web: remark upgrade + gfm + syntax highlighting (6ee47b96)\n\nUpdate to version 0.9.0:\n\n  - completion: remove errata from string literal (aa102c91)\n  - tui: improve readability of the help bar (23be684a)\n\nUpdate to version 0.8.1+git.1746484874.96c7a111:\n\n  * docs: update install, contrib, and usage documentation (#1222)\n  * fix: resolve the remote URI using url.*.insteadOf (#1394)\n  * build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)\n  * chore: gofmt simplify gitlab/export_test.go (#1392)\n  * fix: checkout repo before setting up go environment (#1390)\n  * feat: bump to go v1.24.2 (#1389)\n  * chore: update golang.org/x/net (#1379)\n  * fix: use -0700 when formatting time (#1388)\n  * fix: use correct url for gitlab PATs (#1384)\n  * refactor: remove depdendency on pnpm for auto-label action (#1383)\n  * feat: add action: auto-label (#1380)\n  * feat: remove lifecycle/frozen (#1377)\n  * build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)\n  * feat: support new exclusion label: lifecycle/pinned (#1375)\n  * fix: refactor how gitlab title changes are detected (#1370)\n  * revert: \"Create Dependabot config file\" (#1374)\n  * refactor: rename //:git-bug.go to //:main.go (#1373)\n  * build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)\n  * fix: set GitLastTag to an empty string when git-describe errors (#1355)\n  * chore: update go-git to v5@masterupdate_mods (#1284)\n  * refactor: Directly swap two variables to optimize code (#1272)\n  * Update README.md Matrix link to new room (#1275)\n\n- Update to version 0.8.0+git.1742269202.0ab94c9:\n  * deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)\n\n- Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,\n  CVE-2025-22869).\n\n- Add missing Requires to completion subpackages.\n\nUpdate to version 0.8.0+git.1733745604.d499b6e:\n\n  * fix typos in docs (#1266)\n  * build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)\n\n- bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).\n","status":"published","published":"2025-12-04T13:08:26Z","modified":"2026-03-23T04:54:18.421872Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:20177-1","title":"Security update for cheat","description":"This update for cheat fixes the following issues:\n\n- Security:\n  * CVE-2025-47913: Fix client process termination (bsc#1253593)\n  * CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)\n  * CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)\n  * Replace golang.org/x/crypto=golang.org/x/crypto@v0.45.0\n  * Replace golang.org/x/net=golang.org/x/net@v0.47.0\n  * Replace golang.org/x/sys=golang.org/x/sys@v0.38.0\n\n- Packaging improvements:\n  * Drop Requires: golang-packaging. The recommended Go toolchain\n    dependency expression is BuildRequires: golang(API) \u003e= 1.x or\n    optionally the metapackage BuildRequires: go\n  * Use BuildRequires: golang(API) \u003e= 1.19 matching go.mod\n  * Build PIE with pattern that may become recommended procedure:\n    %%ifnarch ppc64 GOFLAGS=\"-buildmode=pie\" %%endif go build\n    A go toolchain buildmode default config would be preferable\n    but none exist at this time.\n  * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable\n  * Remove go build -o output binary location and name. Default\n    binary has the same name as package of func main() and is\n    placed in the top level of the build directory.\n  * Add basic %check to execute binary --help\n\n- Packaging improvements:\n  * Service go_modules replace dependencies with CVEs\n  * Replace github.com/cloudflare/circl=github.com/cloudflare/circl@v1.6.1\n    Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm\n  * Replace golang.org/x/net=golang.org/x/net@v0.36.0\n    Fixes GO-2025-3503 CVE-2025-22870\n  * Replace golang.org/x/crypto=golang.org/x/crypto@v0.35.0\n    Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8\n    Fixes GO-2025-3487 CVE-2025-22869\n  * Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/v5@v5.13.0\n    Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4\n    Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m\n  * Service tar_scm set mode manual from disabled\n  * Service tar_scm create archive from git so we can exclude\n    vendor directory upstream committed to git. Committed vendor\n    directory contents have build issues even after go mod tidy.\n  * Service tar_scm exclude dir vendor\n  * Service set_version set mode manual from disabled\n  * Service set_version remove param basename not needed\n","status":"published","published":"2025-12-18T00:17:52Z","modified":"2026-03-23T04:54:19.442051Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10013-1","title":"apptainer-1.4.5-1.1 on GA media","description":"These are all security issues fixed in the apptainer-1.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-07T00:00:00Z","modified":"2026-03-23T04:54:20.787857Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10042-1","title":"mcphost-0.32.0-1.1 on GA media","description":"These are all security issues fixed in the mcphost-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-13T00:00:00Z","modified":"2026-03-23T04:54:23.566561Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10127-1","title":"rekor-1.5.0-1.1 on GA media","description":"These are all security issues fixed in the rekor-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-30T00:00:00Z","modified":"2026-03-23T04:54:29.336551Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10142-1","title":"traefik-3.6.7-1.1 on GA media","description":"These are all security issues fixed in the traefik-3.6.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-03-23T04:54:30.156515Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10143-1","title":"traefik2-2.11.35-1.1 on GA media","description":"These are all security issues fixed in the traefik2-2.11.35-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-03-23T04:54:30.249336Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10230-1","title":"vexctl-0.4.1+git78.f951e3a-1.1 on GA media","description":"These are all security issues fixed in the vexctl-0.4.1+git78.f951e3a-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-19T00:00:00Z","modified":"2026-03-23T04:54:35.456666Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10232-1","title":"cosign-3.0.4-2.1 on GA media","description":"These are all security issues fixed in the cosign-3.0.4-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-20T00:00:00Z","modified":"2026-03-23T04:54:36.210057Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10255-1","title":"docker-stable-24.0.9_ce-17.1 on GA media","description":"These are all security issues fixed in the docker-stable-24.0.9_ce-17.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-25T00:00:00Z","modified":"2026-02-26T16:17:00.797025Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10543-1","title":"kubo-0.40.1-1.1 on GA media","description":"These are all security issues fixed in the kubo-0.40.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-14T00:00:00Z","modified":"2026-04-15T08:00:07.147418Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11781-1","title":"rz-pm-0.3.6-1.1 on GA media","description":"These are all security issues fixed in the rz-pm-0.3.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:04.994316216Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12295-1","title":"k3sup-0.13.14-1.1 on GA media","description":"These are all security issues fixed in the k3sup-0.13.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:14.299965913Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12299-1","title":"kubeseal-0.41.1-1.1 on GA media","description":"These are all security issues fixed in the kubeseal-0.41.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:14.309316579Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12300-1","title":"kumactl-3.0.0-1.1 on GA media","description":"These are all security issues fixed in the kumactl-3.0.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:14.296868365Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:20132-1","title":"Security update for elemental-register, elemental-toolkit","description":"This update for elemental-register, elemental-toolkit fixes the following issues:\n\nelemental-register was updated to 1.8.1:\n\nChanges on top of v1.8.1:\n\n  * Update headers to 2026\n  * Update questions to include SL Micro 6.2\n\nUpdate to v1.8.1:\n\n  * Install yip config files in before-install step\n  * Bump github.com/rancher-sandbox/go-tpm and its dependencies\n    This includes few CVE fixes:\n    * bsc#1241826 (CVE-2025-22872)\n    * bsc#1241857 (CVE-2025-22872)\n    * bsc#1251511 (CVE-2025-47911)\n    * bsc#1251679 (CVE-2025-58190)\n\nelemental-toolkit was updated to v2.3.2:\n\n  * Bump golang.org/x/crypto library\n    This includes few CVE fixes:\n    * bsc#1241826 (CVE-2025-22872)\n    * bsc#1241857 (CVE-2025-22872)\n    * bsc#1251511 (CVE-2025-47911)\n    * bsc#1251679 (CVE-2025-58190)\n    * bsc#1253581 (CVE-2025-47913)\n    * bsc#1253901 (CVE-2025-58181)\n    * bsc#1254079 (CVE-2025-47914)\n","status":"published","published":"2026-01-29T15:32:26Z","modified":"2026-03-23T04:54:45.260085Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20249-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- CVE-2025-58181: not validating the number of mechanisms can cause unlimited memory consumption (bsc#1253904).\n","status":"published","published":"2026-02-18T09:41:33Z","modified":"2026-03-23T04:54:48.482535Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20366-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- CVE-2025-58181: Fixed unbounded memory consumption. (bsc#1253904)\n- CVE-2025-30204: Fixed a bug in jwt-go which allows excessive memory allocation during header parsing. (bsc#1240513)\n","status":"published","published":"2026-03-16T15:57:03Z","modified":"2026-03-23T04:54:51.439082Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20386-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\nUpdate to version 3.0.5:\n\n- CVE-2026-24122: Fixed improper validation of certificates that outlive\n  expired CA certificates (bsc#1258542)\n- CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize receiver\n  in MultiScalarMult can produce invalid results and lead to undefined behavior\n  (bsc#1258612)\n- CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy TUF client\n  allows for arbitrary file writes with target cache path traversal\n  (bsc#1257139)\n- CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer URL\n  validation bypass can trigger SSRF to arbitrary internal services\n  (bsc#1256562)\n- CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial of\n  service due to invalid TUF metadata JSON returned by TUF repository\n  (bsc#1257080)\n- CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2: unauthorized\n  modification to TUF metadata files due to a compromised or misconfigured TUF\n  repository (bsc#1257085)\n- CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive\n  Information leak in logs (bsc#1250620)\n- CVE-2026-22703: Fixed that cosign verification accepts any valid Rekor entry\n  under certain conditions (bsc#1256496)\n- CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number of\n  mechanisms can cause unbounded memory consumption (bsc#1253913)\n","status":"published","published":"2026-03-18T11:29:30Z","modified":"2026-03-26T17:23:49.956196Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20620-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.73.5:\n  * Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * iclouddrive: fix 'directory not found' error when the directory contains accent marks\n  * Start v1.73.5-DEV development\n\n- Update to version 1.73.4:\n  * Version v1.73.4\n  * Update to go 1.25.9 to fix multiple CVEs\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * fix(docs): Fix link to not be language specific\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Start v1.73.4-DEV development\n\n- Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)\n  * Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * docs: added text to the label showing version-introduced info\n  * Start v1.73.3-DEV development\n  * docs: update sponsors\n\n- Update to version 1.73.2:\n  * Version v1.73.2\n  * Update to go 1.25.8 to fix multiple CVEs\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * docs: fix new drive flag typo in changelog\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * docs: note that --use-server-modtime only works on some backends\n  * internxt: fix Entry doesn't belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * docs: Fix headers hierarchy for mount.md\n  * webdav: escape reserved characters in URL path segments\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * docs: add instructions on how to update Go version\n  * buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229\n  * Start v1.73.2-DEV development\n\n- Update to version 1.73.1:\n  * Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * Start v1.73.1-DEV development\n\n- Update to version 1.73.0:\n  * Version v1.73.0\n  * drive: fix crash when trying to creating shortcut to a Google doc\n  * azureblob,azurefiles: factor the common auth into a library\n  * test: allow backends to return fs.ErrorCantListRoot to skip Root tests\n  * build: add privatebeta Makefile target\n  * docs: add Internxt as a sponsor\n  * internxt: remove use of CVE laden github.com/disintegration/imaging\n  * docs: fix Internxt docs after merge\n  * docs: update making a new backend docs\n  * docs: build overview page from the backend data\n  * docs: add tiering to the documentation - fixes #8873\n  * docs: add data about each backend in YAML format\n  * docs: add bin/manage_backends.py for managing the backend data files\n  * internxt: use rclone's http.Client to enable more features\n  * internxt: fix lint problems\n  * Add StarHack to contributors\n  * Add lullius to contributors\n  * Add jzunigax2 to contributors\n  * internxt: add Internxt backend - fixes #7610\n  * drive: add --drive-metadata-force-expansive-access flag - Fixes #8980\n  * test_all: allow drime more time to complete\n  * onedrive: fix permissions on onedrive Personal\n  * onedrive: fix require sign in for Onedrive Personal\n  * onedrive: Onedrive Personal no longer supports description\n  * onedrive: fix setting modification time on directories for onedrive Personal\n  * onedrive: fix cancelling multipart upload\n  * docs: fix WinFsp link in mount documentation\n  * cmount: make work under OpenBSD - fixes #1727\n  * vfs: make mount tests run on OpenBSD\n  * docs: improve alignment of icons\n  * protondrive: update to use forks of upstream modules\n  * Add hyusap to contributors\n  * Add Nick Owens to contributors\n  * Add Mikel Olasagasti Uranga to contributors\n  * docs: fix googlephotos custom client_id instructions\n  * cmount: fix OpenBSD mount support.\n  * fs: fix bwlimit: correctly report minutes\n  * fs: fix bwlimit: use %d instead of %q for ints\n  * mega: reverts TLS workaround\n  * docs: fix formatting\n  * docs: add faq entry about re-enabling old TLS ciphers\n  * Add Marc-Philip to contributors\n  * Add yy to contributors\n  * filen: swap to blake3 hashes\n  * docs: fix echo command syntax for password input\n  * docs: fix typos in comments and messages\n  * docs: fix use of removed rem macro\n  * uptobox: remove backend as service is no longer available\n  * rc: add operations/hashsumfile to sum a single file only\n  * docs: update sponsor link\n  * filen: add Filen backend - Fixes #6728\n  * sftp: fix proxy initialisation\n  * fstest: skip Copy mutation test with --sftp-copy-is-hardlink\n  * fstest: Make Copy mutation test work properly\n  * Add Qingwei Li to contributors\n  * Add Nicolas Dessart to contributors\n  * log: fix systemd adding extra newline - fixes #9086\n  * oracleobjectstorage, sftp: eliminate unnecessary heap allocation\n  * sftp,ftp: add http proxy authentication support\n  * Add Drime backend\n  * lib/rest: add opts.MultipartContentType to explicitly set Content-Type of attachements\n  * dircache: allow empty string as root parent id\n  * docs: update sponsors\n  * s3: add provider Bizfly Cloud Simple Storage\n  * docs: update sponsor logos\n  * Add sys6101 to contributors\n  * Add darkdragon-001 to contributors\n  * Add vupn0712 to contributors\n  * docs: add cloudinary to readme\n  * docs: fix headers hierarchy in mount docs\n  * s3: fix Copy ignoring storage class\n  * serve s3: make errors in --s3-auth-key fatal - fixes #9044\n  * Add masrlinu to contributors\n  * pcloud: add support for real-time updates in mount\n  * memory: add --memory-discard flag for speed testing - fixes #9037\n  * Add vyv03354 to contributors\n  * shade: Fix VFS test issues\n  * docs: mention use of ListR feature in ls docs\n  * build: bump actions/download-artifact from 6 to 7\n  * build: bump actions/upload-artifact from 5 to 6\n  * build: bump actions/cache from 4 to 5\n  * docs: reflects the fact that pCloud supports ListR\n  * S3: Linode: updated endpoints to use ISO 3166-1 alpha-2 standard\n  * sync: fix error propagation in tests (#9025)\n  * Changelog updates from Version v1.72.1\n  * s3: add more regions for Selectel\n  * Add jhasse-shade to contributors\n  * Add Shade backend\n  * log: fix backtrace not going to the --log-file #9014\n  * build: fix lint warning after linter upgrade\n  * Add Jonas Tingeborn to contributors\n  * Add Tingsong Xu to contributors\n  * configfile: add piped config support - fixes #9012\n  * fs/log: fix PID not included in JSON log output\n  * build: adjust lint rules to exclude new errors from linter update\n  * proxy: fix error handling in tests spotted by the linter\n  * Add Johannes Rothe to contributors\n  * Add Leo to contributors\n  * Add Vladislav Tropnikov to contributors\n  * Add Cliff Frey to contributors\n  * Add vicerace to contributors\n  * b2: Fix listing root buckets with unrestricted API key\n  * googlecloudstorage: improve endpoint parameter docs\n  * serve webdav: implement download-directory-as-zip\n  * s3: The ability to specify an IAM role for cross-account interaction\n  * azureblob: add metadata and tags support across upload and copy paths\n  * refactor: use strings.Cut to simplify code\n  * docs: note where a provider has an S3 compatible alternative\n  * Add Shade as sponsor\n  * Add Duncan Smart to contributors\n  * Add Diana to contributors\n  * docs: Clarify OAuth scopes for readonly Google Drive access\n  * b2: support authentication with new bucket restricted application keys\n  * docs: update sponsor logos\n  * docs: fix lint error in changelog\n  * Start v1.73.0-DEV development\n\n- Update to version 1.72.1:\n  * Version v1.72.1\n  * s3: add more regions for Selectel\n  * log: fix backtrace not going to the --log-file #9014\n  * build: fix lint warning after linter upgrade\n  * configfile: add piped config support - fixes #9012\n  * fs/log: fix PID not included in JSON log output\n  * build: adjust lint rules to exclude new errors from linter update\n  * proxy: fix error handling in tests spotted by the linter\n  * googlecloudstorage: improve endpoint parameter docs\n  * docs: note where a provider has an S3 compatible alternative\n  * Add Shade as sponsor\n  * docs: Clarify OAuth scopes for readonly Google Drive access\n  * docs: update sponsor logos\n  * docs: fix lint error in changelog\n  * Start v1.72.1-DEV development\n\n- Update to version 1.72.0:\n  * Version v1.72.0\n  * rc: fix formatting in job/batch\n  * test speed: fix formatting of help\n  * docs: update sponsor logos\n  * build: bump actions/checkout from 5 to 6\n  * s3: add multi-part-upload support for If-Match and If-None-Match\n  * rc: config/unlock: rename parameter to `configPassword` accept old as well\n  * rc: correct names of parameters in job/list output\n  * Add Nikolay Kiryanov to contributors\n  * rc: add `executeId` to job statuses - fixes #8972\n  * build: bump golang.org/x/crypto from 0.43.0 to 0.45.0 to fix CVE-2025-58181\n  * s3: fix single file copying behavior with low permission - Fixes #8975\n  * docs: onedrive: note how to backup up any user's data\n  * Add Dominik Sander to contributors\n  * Add jijamik to contributors\n  * box: allow to configure with config file contents\n  * http: add basic metadata and provide it via serve\n  * ftp: fix transfers from servers that return 250 ok messages\n  * b2: allow individual old versions to be deleted with --b2-versions - fixes #1626\n  * build: fix tls: failed to verify certificate: x509: negative serial number\n  * Add Sean Turner to contributors\n  * s3: add support for --upload-header If-Match and If-None-Match\n  * fix: comment typos\n  * dropbox: fix error moving just created objects - fixes #8881\n  * s3: add --s3-use-data-integrity-protections to fix  BadDigest error in Alibaba, Tencent\n  * rc: make sure fatal errors don't crash rclone - fixes #8955\n  * pacer: factor call stack searching into its own package\n  * rc: add osVersion, osKernel and osArch to core/version\n  * build: update all dependencies\n  * build(deps): bump golangci/golangci-lint-action from 8 to 9\n  * webdav: fix out of memory with sharepoint-ntlm when uploading large file\n  * testserver: fix owncloud test server startup\n  * Add aliaj1 to contributors\n  * ulozto: Fix downloads returning HTML error page\n  * docs: adjust spectra logic example endpoint name\n  * docs: update version introduced to v1.70 in doi docs\n  * testserver: fix HDFS server after run.bash adjustments\n  * testserver: remind developers about allocating a port\n  * testserver: make run.bash variables less likely to collide with scripts\n  * testserver: fix seafile servers messing up _connect string\n  * testserver: make sure TestWebdavInfiniteScale uses an assigned port\n  * testserver: make sure we don't overwrite the NAME variable set\n  * Add n4n5 to contributors\n  * Add Alex to contributors\n  * Add Copilot to contributors\n  * docs: update contributing docs regarding backend documentation\n  * rc: add jobs stats\n  * docs: fix alignment of some of the icons in the storage system dropdown\n  * docs: run markdownlint on _index.md\n  * docs: fix markdownlint issues and other styling improvements in backend command docs\n  * docs: fix markdownlint issue md046/code-block-style in backend command docs\n  * docs: fix missing punctuation in backend commands short description\n  * docs: fix markdownlint issues in backend command generated output\n  * build: improve backend docs autogenerated marker line\n  * backend/compress: add zstd compression\n  * sftp: fix zombie SSH processes with --sftp-ssh - Fixes #8929\n  * testserver: fix tests failing due to stopped servers\n  * docs: add new integration tester site link\n  * docs: update the method for running integration tests\n  * bisync: fix failing tests\n  * Add SublimePeace to contributors\n  * b2: fix \"expected a FileSseMode but found: ''\"\n  * docs: s3: clarify multipart uploads memory usage\n  * test_all: fix detection of running servers\n  * accounting: add AccountReadN for use in cluster\n  * fs: add NonDefaultRC for discovering options in use\n  * fs: move tests into correct files\n  * rc: add NewJobFromBytes for reading jobs from non HTTP transactions\n  * rc: add job/batch for sending batches of rc commands to run concurrently\n  * Add Ted Robertson to contributors\n  * Add Joseph Brownlee to contributors\n  * Add fries1234 to contributors\n  * Add Fawzib Rojas to contributors\n  * Add Riaz Arbi to contributors\n  * Add Lukas Krejci to contributors\n  * Add Adam Dinwoodie to contributors\n  * Add dulanting to contributors\n  * docs: add AppArmor restrictions to rclone mount\n  * check: improved reporting of differences in sizes and contents\n  * mega: implement 2FA login\n  * docs: change to light code block style to better match overall theme\n  * docs: fix various markdownlint issues\n  * build: restrict the markdown languages to use for code blocks\n  * docs: fix various markdownlint issues\n  * docs: fix markdownlint issue md013/line-length\n  * docs: change syntax hightlighting for command examples from sh to console\n  * docs: Clarify remote naming convention\n  * b2: Add Server-Side encryption support\n  * Added rclone archive command to create and read archive files\n  * accounting: add io.Seeker/io.ReaderAt support to accounting.Account\n  * operations: add ReadAt method to ReOpen\n  * fstest: add ResetRun to allow the remote to be reset in tests\n  * gcs: fix --gcs-storage-class to work with server side copy for objects\n  * ulozto: implement the about functionality\n  * local: add --skip-specials to ignore special files\n  * swift: Report disk usage in segment containers\n  * refactor: use strings.Builder to improve performance\n  * Archive backend to read archives on cloud storage.\n  * vfs: remove unecessary import in tests to fix import cycles\n  * Add Lakshmi-Surekha to contributors\n  * Add Andrew Gunnerson to contributors\n  * Add divinity76 to contributors\n  * build: enable support for aix/ppc64\n  * rc: fix name of \"queue\" JSON key in docs for vfs/cache\n  * cmount: windows: improve error message on missing winfsp\n  * docs: add the Provider to the options examples in the backend docs\n  * Add Aneesh Agrawal to contributors\n  * Add viocha to contributors\n  * Add reddaisyy to contributors\n  * fs: remove unnecessary Seek call on log file\n  * s3: make it easier to add new S3 providers\n  * build(deps): bump actions/upload-artifact from 4 to 5\n  * build(deps): bump actions/download-artifact from 5 to 6\n  * ftp: fix SOCK proxy support - fixes #8892 (#8918)\n  * webdav: Add Access-Control-Max-Age header for CORS preflight caching - fixes #5078\n  * webdav: use SpaceSepList to parse bearer token command\n  * refactor: use strings.Builder to improve performance\n  * docs: re-arrange sponsors page\n  * docs: add Spectra Logic as a sponsor\n  * Add Oleksandr Redko to contributors\n  * build: enable all govet checks (except fieldalignment and shadow) and fix issues.\n  * march: fix --no-traverse being very slow - fixes #8860\n  * Add vastonus to contributors\n  * s3: add new FileLu S5 endpoints\n  * build: remove obsolete build tag\n  * azurefiles: add ListP interface - #4788\n  * dropbox: add ListP interface - #4788\n  * webdav: add ListP interface - #4788\n  * pcloud: add ListP interface - #4788\n  * box: add ListP interface - #4788\n  * onedrive: add ListP interface - #4788\n  * drive: add ListP interface - #4788\n  * Add hunshcn to contributors\n  * webdav: optimize bearer token fetching with singleflight\n  * Changelog updates from Version v1.71.2\n  * lib/http: cleanup indentation and other whitespace in http serve template\n  * docs: improve formatting of http serve template parameters\n  * build: stop markdown linter leaving behind docker containers\n  * Add Marco Ferretti to contributors\n  * s3: add cubbit as provider\n  * s3: add servercore as a provider\n  * docs: update sponsors\n  * docs: update sponsor images\n  * docs: update privacy policy with a section on user data\n  * Add Dulani Woods to contributors\n  * Add spiffytech to contributors\n  * gcs: add region us-east5 - fixes #8863\n  * jottacloud: refactor service list from map to slice to get predefined order\n  * jottacloud: added support for traditional oauth authentication also for the main service\n  * oauthutil: improved debug logs from token refresh\n  * backend: add S3 provider for Hetzner object storage #8183\n  * jottacloud: improved token refresh handling\n  * s3: provider reordering\n  * index: add missing providers\n  * docs: add missing `\n  * s3: add rabata as a provider\n  * mega: fix 402 payment required errors - fixes #8758\n  * Add Andrew Ruthven to contributors\n  * Add Microscotch to contributors\n  * Add iTrooz to contributors\n  * build: Bump SwiftAIO container to a newer one\n  * build: Retry stopping the test server\n  * build: Increase attempts to connect to test server\n  * swift: If storage_policy isn't set, use the root containers policy\n  * proton: automated 2FA login with OTP secret key\n  * serve s3: fix log output to remove the EXTRA messages\n  * docs/jottacloud: update description of invalid_grant error according to changes\n  * jottacloud: add support for MediaMarkt Cloud as a whitelabel service\n  * s3: add FileLu S5 provider\n  * docs: fix variants of --user-from-header\n  * vfs: fix chunker integration test\n  * test_all: give TestZoho: extra time as it has been timing out\n  * test_all: give TestCompressDrive: extra time as it has been timing out\n  * rclone config string: reduce quoting with Human rendering for strings #8859\n  * Add juejinyuxitu to contributors\n  * docs/jottacloud: update documentation with new whitelabel services and changed configuration flow\n  * jottacloud: abort attempts to run unsupported rclone authorize command\n  * jottacloud: minor adjustment of texts in config ui\n  * jottacloud: add support for Let's Go Cloud (from MediaMarkt) as a whitelabel service\n  * jottacloud: fix authentication for whitelabel services from Elkj�p subsidiaries\n  * jottacloud: refactor config handling of whitelabel services to use openid provider configuration\n  * jottacloud: remove nil error object from error message\n  * jottacloud: fix legacy authentication\n  * docs: add remote setup page to main docs dropdown\n  * docs: update remote setup page\n  * docs: add link from authorize command docs to remote setup docs\n  * docs: lowercase internet and web browser instead of Internet browser\n  * docs: use the term backend name instead of fs name for authorize command\n  * add `rclone config string` for making connection strings #8859\n  * config: add more human readable configmap.Simple output\n  * serve http: download folders as zip\n  * s3: reorder providers to be in alphabetical order\n  * refactor: use strings.FieldsFuncSeq to reduce memory allocations\n  * accounting: add SetMaxCompletedTransfers method to fix bisync race #8815\n  * accounting: add RemoveDoneTransfers method to fix bisync race #8815\n  * bisync: fix race when CaptureOutput is used concurrently #8815\n  * build: update all dependencies\n  * Makefile: remove deprecated go mod usage\n  * azurefiles: Fix server side copy not waiting for completion -  fixes #8848\n  * Changelog updates from Version v1.71.1\n  * test_all: fix branch name in test report\n  * pacer: fix deadlock with --max-connections\n  * Revert \"azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\"\n  * Add Youfu Zhang to contributors\n  * Add Matt LaPaglia to contributors\n  * smb: optimize smb mount performance by avoiding stat checks during initialization\n  * pikpak: fix unnecessary retries by using URL expire parameter - fixes #8601\n  * serve http: fix: logging url on start\n  * docs: fix typo\n  * b2: fix 1TB+ uploads\n  * march: fix deadlock when using --fast-list on syncs - fixes #8811\n  * build: slices.Contains, added in go1.21\n  * build: use strings.CutPrefix introduced in go1.20\n  * build: use sequence Split introduced in go1.24\n  * build: use \"for i := range n\", added in go1.22\n  * build: modernize benchmark usage\n  * build: in tests use t.Context, added in go1.24\n  * build: replace interface{} by the 'any' type added in go1.18\n  * build: use the built-in min or max functions added in go1.21\n  * Add russcoss to contributors\n  * build: remove x := x made unnecessary by the new semantics of loops in go1.22\n  * lib/pool: fix unreliable TestPoolMaxBufferMemory test\n  * Update S-Pegg1 email\n  * Add Jean-Christophe Cura to contributors\n  * pool: fix flaky unreliability test\n  * copyurl: reworked code, added concurrency and tests\n  * copyurl: Added --url to read urls from csv file - #8127\n  * docs: HDFS: erasure coding limitation #8808\n  * fstest: fix slice bounds out of range error when using -remotes local\n  * local: fix time zones on tests\n  * s3: added SpectraLogic as a provider\n  * local: fix rmdir \"Access is denied\" on windows - fixes #8363\n  * bisync: fix error handling for renamed conflicts\n  * docs: pcloud: update root_folder_id instructions\n  * operations: fix partial name collisions for non --inplace copies\n  * drive: docs: update making your own client ID instructions\n  * swift: add ListP interface - #4788\n  * memory: add ListP interface - #4788\n  * oraceobjectstorage: add ListP interface - #4788\n  * B2: add ListP interface - #4788\n  * azureblob: add ListP interface - #4788\n  * googlecloudstorage: add ListP interface - Fixes #8763\n  * build: bump actions/github-script from 7 to 8\n  * build: bump actions/setup-go from 5 to 6\n  * bisync: fix chunker integration tests\n  * bisync: fix koofr integration tests\n  * internetarchive: fix server side copy files with spaces\n  * lib/rest: add URLPathEscapeAll to URL escape as many chars as possible\n  * Add alternate email for dougal to contributors\n  * test speed: add command to test a specified remotes speed\n  * docs: add link to MEGA S4 from MEGA page\n  * Add Robin Rolf to contributors\n  * Add anon-pradip to contributors\n  * s3: Add Intercolo provider\n  * gendocs: refactor and add logging of skipped command docs\n  * gendocs: ignore missing rclone_mount.md, rclone_nfsmount.md, rclone_serve_nfs.md on windows\n  * bin: add bisync.md generator\n  * fstest: refactor to decouple package from implementation\n  * gendocs: ignore missing rclone_mount.md on macOS\n  * bisync: ignore expected \"nothing to transfer\" differences on tests\n  * bisync: fix TestBisyncConcurrent ignoring -case\n  * bisync: make number of parallel tests configurable\n  * docs: clarify subcommand description in rclone usage\n  * docs: fix description of regex syntax of name transform\n  * docs: add some more details about supported regex syntax\n  * makefile: fix lib/transform docs not getting updated\n  * lib/pool: fix flaky test which was causing timeouts\n  * Add dougal to contributors\n  * vfs: fix SIGHUP killing serve instead of flushing directory caches\n  * bisync: use unique stats groups on tests\n  * fstest: stop errors in test cleanup changing the global stats\n  * Add Motte to contributors\n  * Add Claudius Ellsel to contributors\n  * build: add local markdown linting to make check\n  * lsf: add support for unix and unixnano time formats\n  * docs: remove broken links from rc to commands\n  * hashsum: changed output format when listing algorithms\n  * docs: add example of how to add date as suffix\n  * box: fix about after change in API return - fixes #8776\n  * Add skbeh to contributors\n  * Add Tilman Vogel to contributors\n  * docs: fix incorrectly escaped windows path separators\n  * build: restore error handling in gendocs\n  * combine: propagate SlowHash feature\n  * docs/oracleobjectstorage: add introduction before external links and remove broken link\n  * docs: fix markdown lint issues in backend docs\n  * docs: fix markdown lint issues in command docs\n  * docs: update markdown code block json indent size 2\n  * mount: do not log successful unmount as an error - fixes #8766\n  * Start v1.72.0-DEV development\n\n- Update to version 1.71.2:\n  * Version v1.71.2\n  * docs: update sponsors\n  * docs: update sponsor images\n  * docs: update privacy policy with a section on user data\n  * gcs: add region us-east5 - fixes #8863\n  * index: add missing providers\n  * docs: add missing `\n  * mega: fix 402 payment required errors - fixes #8758\n  * docs: fix variants of --user-from-header\n  * docs: add remote setup page to main docs dropdown\n  * docs: update remote setup page\n  * docs: add link from authorize command docs to remote setup docs\n  * docs: lowercase internet and web browser instead of Internet browser\n  * docs: use the term backend name instead of fs name for authorize command\n  * bisync: fix race when CaptureOutput is used concurrently #8815\n  * azurefiles: Fix server side copy not waiting for completion -  fixes #8848\n  * pikpak: fix unnecessary retries by using URL expire parameter - fixes #8601\n  * serve http: fix: logging url on start\n  * docs: fix typo\n  * b2: fix 1TB+ uploads\n  * Start v1.71.2-DEV development\n\n- Update to version 1.71.1:\n  * Version v1.71.1\n  * pacer: fix deadlock with --max-connections\n  * Revert \"azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\"\n  * march: fix deadlock when using --fast-list on syncs - fixes #8811\n  * docs: HDFS: erasure coding limitation #8808\n  * local: fix rmdir \"Access is denied\" on windows - fixes #8363\n  * bisync: fix error handling for renamed conflicts\n  * docs: pcloud: update root_folder_id instructions\n  * operations: fix partial name collisions for non --inplace copies\n  * drive: docs: update making your own client ID instructions\n  * internetarchive: fix server side copy files with spaces\n  * lib/rest: add URLPathEscapeAll to URL escape as many chars as possible\n  * docs: add link to MEGA S4 from MEGA page\n  * docs: clarify subcommand description in rclone usage\n  * docs: fix description of regex syntax of name transform\n  * docs: add some more details about supported regex syntax\n  * makefile: fix lib/transform docs not getting updated\n  * vfs: fix SIGHUP killing serve instead of flushing directory caches\n  * docs: remove broken links from rc to commands\n  * docs: add example of how to add date as suffix\n  * box: fix about after change in API return - fixes #8776\n  * docs: fix incorrectly escaped windows path separators\n  * build: restore error handling in gendocs\n  * combine: propagate SlowHash feature\n  * docs/oracleobjectstorage: add introduction before external links and remove broken link\n  * docs: fix markdown lint issues in backend docs\n  * docs: fix markdown lint issues in command docs\n  * docs: update markdown code block json indent size 2\n  * mount: do not log successful unmount as an error - fixes #8766\n  * Start v1.71.1-DEV development\n\n- Update to version 1.71.0:\n  * Version v1.71.0\n  * fs: tls: add --client-pass support for encrypted --client-key files\n  * ftp: make TLS config default to global TLS config - Fixes #6671\n  * fshttp: return *Transport rather than http.RoundTripper from NewTransport\n  * bisync: release from beta\n  * bisync: fix markdown formatting issues flagged by linter in docs\n  * bisync: fix --no-slow-hash settings on path2\n  * Add cui to contributors\n  * docs: add code of conduct\n  * lib/mmap: convert to using unsafe.Slice to avoid deprecated reflect.SliceHeader\n  * build: bump golangci/golangci-lint-action from 6 to 8\n  * build: update golangci-lint configuration\n  * build: ignore revive lint issue var-naming: avoid meaningless package names\n  * build: fix lint issue: should omit type error from declaration\n  * Revert \"build: downgrade linter to use go1.24 until it is fixed for go1.25\"\n  * build: migrate golangci-lint configuration to v2 format\n  * s3: add --s3-use-arn-region flag - fixes #8686\n  * Add Binbin Qian to contributors\n  * Add Lucas Bremgartner to contributors\n  * docs: add tips about outdated certificates\n  * FAQ: specify the availability of SSL_CERT_* env vars\n  * pikpak: add file name integrity check during upload\n  * bisync: skip TestBisyncConcurrent on non-local\n  * internetarchive: fix server side copy files with \u0026\n  * Revert \"s3: set useAlreadyExists to false for Alibaba OSS\"\n  * Add huangnauh to contributors\n  * smb: improve multithreaded upload performance using multiple connections\n  * bisync: fix data races on tests\n  * bisync: remove unused parameters\n  * bisync: deglobalize to fix concurrent runs via rc - fixes #8675\n  * mount: fix identification of symlinks in directory listings\n  * s3: fix Content-Type: aws-chunked causing upload errors with --metadata\n  * config: fix problem reading pasted tokens over 4095 bytes\n  * config: fix test failure on local machine with a config file\n  * log: add log rotation to --log-file - fixes #2259\n  * accounting: Fix stats (speed=0 and eta=nil) when starting jobs via rc\n  * docs: update overview table for oracle object storage\n  * Add praveen-solanki-oracle to contributors\n  * oracleobjectstorage: add read only metadata support - Fixes #8705\n  * doc: sync doesn't symlinks in dest without --link - Fixes #8749\n  * s3: sort providers in docs\n  * s3: add docs for Exaba Object Storage\n  * azureblob: fix double accounting for multipart uploads - fixes #8718\n  * pool: fix deadlock with --max-buffer-memory\n  * azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\n  * build: downgrade linter to use go1.24 until it is fixed for go1.25\n  * build: update all dependencies\n  * build: update to go1.25 and make go1.24 the minimum required version\n  * Add Timothy Jacobs to contributors\n  * bisync: fix time.Local data race on tests - fixes #8272\n  * googlecloudstorage: fix rateLimitExceeded error on bisync tests\n  * accounting: populate transfer snapshot with \"what\" value\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump actions/download-artifact from 4 to 5\n  * googlecloudstorage: enable bisync integration tests\n  * fstest: fix parsing of commas in -remotes\n  * azurefiles: fix hash getting erased when modtime is set\n  * bisync: disable --sftp-copy-is-hardlink on sftp tests\n  * local: fix --copy-links on Windows when listing Junction points\n  * operations: fix too many connections open when using --max-memory\n  * pool: fix deadlock with --max-memory and multipart transfers\n  * pool: unify memory between multipart and asyncreader to use one pool\n  * docs: update links to rcloneui\n  * docs: add MEGA S4 as a gold sponsor\n  * about: fix potential overflow of about in various backends\n  * box: fix about: cannot unmarshal number 1.0e+18 into Go struct field\n  * oauthutil: fix nil pointer crash when started with expired token\n  * rc: listremotes should send an empty array instead of nil\n  * config: add error if RCLONE_CONFIG_PASS was supplied but didn't decrypt config\n  * rc: add config/unlock to unlock the config file\n  * ftp: allow insecure TLS ciphers - fixes #8701\n  * s3: set useAlreadyExists to false for Alibaba OSS\n  * docs: update sponsors page\n  * fs: allow global variables to be overriden or set on backend creation\n  * fs: allow setting of --http_proxy from command line\n  * tests: cloudinary: remove test ignore after merging fix from #8707\n  * Add Antonin Goude to contributors\n  * Add Yu Xin to contributors\n  * Add houance to contributors\n  * Add Florent Vennetier to contributors\n  * Add n4n5 to contributors\n  * Add Albin Parou to contributors\n  * Add liubingrun to contributors\n  * sync: fix testLoggerVsLsf when backend only reads modtime\n  * sync: fix testLoggerVsLsf checking wrong fs\n  * docs: fix make opengraph tags absolute as not all sites understand relative\n  * docs: update contributing guide regarding markdown documentation\n  * build: add markdown linting to workflow\n  * build: add markdownlint configuration\n  * docs: minor format cleanup install.md\n  * docs: fix markdownlint issue md049/emphasis-style\n  * docs: fix markdownlint issue md036/no-emphasis-as-heading\n  * docs: fix markdownlint issue md033/no-inline-html\n  * docs: fix markdownlint issue md025/single-title\n  * docs: fix markdownlint issue md041/first-line-heading\n  * docs: fix markdownlint issue md001/heading-increment\n  * docs: fix markdownlint issue md003/heading-style\n  * docs: fix markdownlint issue md034/no-bare-urls\n  * docs: fix markdownlint issue md010/no-hard-tabs\n  * docs: fix markdownlint issue md013/line-length\n  * docs: fix markdownlint issue md038/no-space-in-code\n  * docs: fix markdownlint issue md040/fenced-code-language\n  * docs: fix markdownlint issue md046/code-block-style\n  * docs: fix markdownlint issue md037/no-space-in-emphasis\n  * docs: fix markdownlint issue md059/descriptive-link-text\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style\n  * docs: fix markdownlint issue md012/no-multiple-blanks\n  * docs: fix markdownlint issue md058/blanks-around-tables\n  * docs: fix markdownlint issue md022/blanks-around-headings\n  * docs: fix markdownlint issue md031/blanks-around-fences\n  * docs: fix markdownlint issue md032/blanks-around-lists\n  * docs: fix markdownlint issue md009/no-trailing-spaces\n  * docs: fix markdownlint issue md014/commands-show-output\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style (bin/update-authors.py)\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style (authors.md)\n  * docs: add opengraph tags for website social media previews\n  * mount: note that bucket based remotes can use directory markers\n  * pikpak: add docs for methods to clarify name collision handling and restrictions\n  * pikpak: enhance Copy method to handle name collisions and improve error management\n  * pikpak: enhance Move for better handling of error and name collision\n  * accounting: fix incorrect stats with --transfers=1 - fixes #8670\n  * rc: fix `operations/check` ignoring `oneWay` parameter\n  * s3: add OVHcloud Object Storage provider\n  * docs: rc: fix description of how to read local config\n  * build: limit check for edits of autogenerated files to only commits in a pull request\n  * build: extend check for edits of autogenerated files to all commits in a pull request\n  * smb: refresh Kerberos credentials when ccache file changes\n  * s3: fix multipart upload and server side copy when using bucket policy SSE-C\n  * backend/s3: Fix memory leak by cloning strings #8683\n  * purge: exit with a fatal error if filters are set on `rclone purge`\n  * docs: Add Backblaze as a Platinum sponsor\n  * Add Sam Pegg to contributors\n  * googlephotos: added warning for Google Photos compatability-fixes #8672\n  * test: remove flakey TestChunkerChunk50bYandex: test\n  * docs: Consolidate entries for Josh Soref in contributors\n  * docs: remove dead link to example of writing a plugin\n  * filescom: document that hashes need to be enabled - fixes #8674\n  * Add Sudipto Baral to contributors\n  * docs: fix incorrect json syntax in sample output\n  * docs: ignore author email piyushgarg80\n  * docs: fix header level for --dump option section\n  * docs: use stringArray as parameter type\n  * docs: use consistent markdown heading syntax\n  * imagekit: remove server side Copy method as it was downloading and uploading\n  * imagekit: don't low level retry uploads\n  * imagekit: return correct error when attempting to upload zero length files\n  * smb: add --smb-kerberos-ccache option to set kerberos ccache per smb backend\n  * test: fix smb kerberos integration tests\n  * Changelog updates from Version v1.70.3\n  * config: make parsing of duration options consistent\n  * docs: cleanup usage\n  * docs: break long lines\n  * docs: add option value type to header where missing\n  * docs: mention that identifiers in option values are case insensitive\n  * docs: rewrite dump option examples\n  * docs: use markdown inline code format for dump option headers that are real examples\n  * docs: change spelling from server side to server-side\n  * docs: cleanup header casing\n  * docs: rename OSX to macOS\n  * docs: fix list and code block issue\n  * docs: consistent markdown list format\n  * docs: split section with general description of options with that documenting actual main options\n  * docs: improve description of option types\n  * docs: use space instead of equal sign to separate option and value in headers\n  * docs: use comma to separate short and long option format in headers\n  * docs: remove use of uncommon parameter types\n  * docs: remove use of parameter type FILE\n  * docs: remove use of parameter type DIR\n  * docs: remove use of parameter type CONFIG_FILE\n  * docs: change use of parameter type N and NUMBER to int consistent with flags and cli help\n  * docs: change use of parameter type TIME to Duration consistent with flags and cli help\n  * docs: change use of parameter type BANDWIDTH_SPEC to BwTimetable consistent with flags and cli help\n  * docs: change use of parameter type SIZE to SizeSuffix consistent with flags and cli help\n  * docs: cleanup markdown header format\n  * docs: explain separated list parameters\n  * azureblob: fix server side copy error \"requires exactly one scope\"\n  * test: remove and ignore failing integration tests\n  * docs: explain the json log format in more detail\n  * check: fix difference report (was reporting error counts)\n  * serve sftp: add support for more hashes (crc32, sha256, blake3, xxh3, xxh128)\n  * serve sftp: extract function refactoring for handling hashsum commands\n  * sftp: add support for more hashes (crc32, sha256, blake3, xxh3, xxh128)\n  * local: configurable supported hashes\n  * hash: add support for BLAKE3, XXH3, XXH128\n  * vfs: make integration TestDirEntryModTimeInvalidation test more reliable\n  * smb: skip non integration tests when doing integration tests\n  * seafile: fix integration test errors by adding dot to encoding\n  * linkbox: fix upload error \"user upload file not exist\"\n  * build: remove integration tests which are too slow\n  * march: fix deadlock when using --no-traverse - fixes #8656\n  * pikpak: improve error handling for missing links and unrecoverable 500s\n  * pikpak: rewrite upload to bypass AWS S3 manager - fixes #8629\n  * test: fix TestSMBKerberos password expiring errors\n  * Add Vikas Bhansali to contributors\n  * Add Ross Smith II to contributors\n  * azureblob,azurefiles: add support for client assertion based authentication\n  * webdav: fix setting modtime to that of local object instead of remote\n  * build: set default shell to bash in build.yml\n  * docs: fix filescom/filelu link mixup\n  * Add Davide Bizzarri to contributors\n  * fix: b2 versionAt read metadata\n  * test: make TestWebdavInfiniteScale startup more reliable\n  * test_all: add _connect_delay for slow starting servers\n  * docs: update link for filescom\n  * test_all: make TestWebdav InfiniteScale integration tests run\n  * test_all: make SMB with Kerberos integration tests run properly\n  * test_all: allow an env parameter to set environment variables\n  * Changelog updates from Version v1.70.2\n  * Add Ali Zein Yousuf to contributors\n  * Add $@M@RTH_ to contributors\n  * docs: update client ID instructions to current Azure AD portal - fixes #8027\n  * s3: add Zata provider\n  * pacer: fix nil pointer deref in RetryError - fixes #8077\n  * docs: Remove Warp as a sponsor\n  * docs: add files.com as a Gold sponsor\n  * docs: add links to SecureBuild docker image\n  * Add curlwget to contributors\n  * convmv: fix moving to unicode-equivalent name - fixes #8634\n  * transform: add truncate_keep_extension and truncate_bytes\n  * convmv: make --dry-run logs less noisy\n  * sync: avoid copying dir metadata to itself\n  * docs: fix some function names in comments\n  * combine: fix directory not found errors with ListP interface - Fixes #8627\n  * local: fix --skip-links on Windows when skipping Junction points\n  * Add Marvin R�sch to contributors\n  * build: bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 to fix GHSA-vrw8-fxc6-2r93\n  * copy,copyto,move,moveto: implement logger flags to store result of sync\n  * log: fix deadlock when using systemd logging - fixes #8621\n  * docs: googlephotos: detail how to make your own client_id - fixes #8622\n  * Add necaran to contributors\n  * mega: fix tls handshake failure - fixes #8565\n  * Changelog updates from Version v1.70.1\n  * Add jinjingroad to contributors\n  * docs: DOI grammar error\n  * docs: lib/transform: cleanup formatting\n  * lib/transform: avoid empty charmap entry\n  * chore: fix function name\n  * convmv: fix spurious \"error running command echo\" on Windows\n  * docs: client-credentials is not support by all backends\n  * Start v1.71.0-DEV development\n\n- Update to version 1.70.3:\n  * Version v1.70.3\n  * azureblob: fix server side copy error \"requires exactly one scope\"\n  * docs: explain the json log format in more detail\n  * check: fix difference report (was reporting error counts)\n  * linkbox: fix upload error \"user upload file not exist\"\n  * march: fix deadlock when using --no-traverse - fixes #8656\n  * pikpak: improve error handling for missing links and unrecoverable 500s\n  * webdav: fix setting modtime to that of local object instead of remote\n  * fix: b2 versionAt read metadata\n  * Start v1.70.3-DEV development\n  * docs: fix filescom/filelu link mixup\n  * docs: update link for filescom\n\n- Update to version 1.70.2:\n  * Version v1.70.2\n  * docs: update client ID instructions to current Azure AD portal - fixes #8027\n  * mega: fix tls handshake failure - fixes #8565\n  * pacer: fix nil pointer deref in RetryError - fixes #8077\n  * convmv: fix moving to unicode-equivalent name - fixes #8634\n  * convmv: make --dry-run logs less noisy\n  * sync: avoid copying dir metadata to itself\n  * combine: fix directory not found errors with ListP interface - Fixes #8627\n  * local: fix --skip-links on Windows when skipping Junction points\n  * build: bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 to fix GHSA-vrw8-fxc6-2r93\n  * log: fix deadlock when using systemd logging - fixes #8621\n  * docs: googlephotos: detail how to make your own client_id - fixes #8622\n  * pikpak: fix uploads fail with \"aws-chunked encoding is not supported\" error\n  * Start v1.70.2-DEV development\n  * docs: Remove Warp as a sponsor\n  * docs: add files.com as a Gold sponsor\n  * docs: add links to SecureBuild docker image\n\n- Update to version 1.70.1:\n  * Version v1.70.1\n  * docs: DOI grammar error\n  * docs: lib/transform: cleanup formatting\n  * lib/transform: avoid empty charmap entry\n  * chore: fix function name\n  * convmv: fix spurious \"error running command echo\" on Windows\n  * docs: client-credentials is not support by all backends\n  * Start v1.70.1-DEV development\n\n- Update to version 1.70.0:\n  * Version v1.70.0\n  * ftp: add --ftp-http-proxy to connect via HTTP CONNECT proxy\n  * pcloud: fix \"Access denied. You do not have permissions to perform this operation\" on large uploads\n  * operations: fix TransformFile when can't server-side copy/move\n  * fstest: fix -verbose flag after logging revamp\n  * googlecloudstorage: fix directory marker after // changes in #5858\n  * s3: fix directory marker after // changes in #5858\n  * azureblob: fix directory marker after // changes in #5858\n  * tests: ignore some more habitually failing tests\n  * googlephotos: fix typo in error message - Fixes #8600\n  * s3: MEGA S4 support\n  * Add Ser-Bul to contributors\n  * chunker: fix double-transform\n  * docs: mailru: added note about permissions level choice for the  apps password\n  * tests: ignore habitually failing tests and backends\n  * docs: link to asciinema rather than including the js\n  * docs: target=\"_blank\" must have rel=\"noopener\"\n  * sync: fix testLoggerVsLsf when dst is local\n  * docs: fix FileLu docs\n  * build: update all dependencies\n  * onedrive: fix crash if no metadata was updated\n  * Add kingston125 to contributors\n  * Add Flora Thiebaut to contributors\n  * Add FileLu cloud storage backend\n  * doi: add new doi backend\n  * build: fix check_autogenerated_edits.py flagging up files that didn't exist\n  * docs: rc: add more info on how to discover _config and _filter parameters #8584\n  * s3: add Exaba provider\n  * convmv: add convmv command\n  * lib/transform: add transform library and --name-transform flag\n  * march: split src and dst\n  * Add ahxxm to contributors\n  * Add Nathanael Demacon to contributors\n  * b2: use file id from listing when not presented in headers - fixes #8113\n  * fs: fix goroutine leak and improve stats accounting process\n  * march: fix syncing with a duplicate file and directory\n  * Add PrathameshLakawade to contributors\n  * Add Oleksiy Stashok to contributors\n  * docs: fix page_facing_up typo next to Lyve Cloud in README.md\n  * backend/s3: require custom endpoint for Lyve Cloud v2 support\n  * backend: skip hash calculation when the hashType is None - fixes #8518\n  * azureblob: fix multipart server side copies of 0 sized files\n  * Add Jeremy Daer to contributors\n  * Add wbulot to contributors\n  * s3: add Pure Storage FlashBlade provider support (#8575)\n  * backend/gofile: update to use new direct upload endpoint\n  * log: add --windows-event-log-level to support Windows Event Log\n  * fs: Remove github.com/sirupsen/logrus and replace with log/slog\n  * Add fhuber to contributors\n  * cmd serve s3: fix ListObjectsV2 response\n  * Changelog updates from Version v1.69.3\n  * onedrive: re-add --onedrive-upload-cutoff flag\n  * onedrive: fix \"The upload session was not found\" errors\n  * Add Germ�n Casares to contributors\n  * Add Jeff Geerling to contributors\n  * googlephotos: update read only and read write scopes to meet Google's requirements.\n  * build: update github.com/ebitengine/purego to v0.8.3 to fix mac_amd64 build\n  * docs: add hint about config touch and config file not found\n  * docs: add FAQ for dismissing 'rclone.conf not found'\n  * docs: document how to keep an out of tree backend\n  * Add Cl�ment Wehrung to contributors\n  * iclouddrive: fix panic and files potentially downloaded twice\n  * docs: move --max-connections documentation to the correct place\n  * Add Ben Boeckel to contributors\n  * Add Tho Neyugn to contributors\n  * docs: fix typo in s3/storj docs\n  * serve s3: remove redundant handler initialization\n  * Changelog updates from Version 1.69.2\n  * sftp: add --sftp-http-proxy to connect via HTTP CONNECT proxy\n  * Add Jugal Kishore to contributors\n  * docs: correct SSL docs anchor link from #ssl-tls to #tls-ssl\n  * drive: metadata: fix error when setting copy-requires-writer-permission on a folder\n  * docs: Update contributors\n  * build: bump golang.org/x/net from 0.36.0 to 0.38.0\n  * Update README.md\n  * docs: fix typos via codespell\n  * webdav: add an ownCloud Infinite Scale vendor that enables tus chunked upload support\n  * onedrive: fix metadata ordering in permissions\n  * Add Ben Alex to contributors\n  * Add simwai to contributors\n  * iclouddrive: fix so created files are writable\n  * cmd/authorize: show required arguments in help text\n  * cloudinary: var naming convention - #8416\n  * cloudinary: automatically add/remove known media files extensions #8416\n  * Add Markus Gerstel to contributors\n  * Add Enduriel to contributors\n  * Add huanghaojun to contributors\n  * Add simonmcnair to contributors\n  * Add Samantha Bowen to contributors\n  * s3: documentation regression - fixes #8438\n  * hash: add SHA512 support for file hashes\n  * vfs: fix inefficient directory caching when directory reads are slow\n  * docs: update fuse version in docker docs\n  * fs/config: Read configuration passwords from stdin even when terminated with EOF - fixes #8480\n  * cmd/gitannex: Reject unknown layout modes in INITREMOTE\n  * cmd/gitannex: Add configparse.go and refactor\n  * cmd/gitannex: Permit remotes with options\n  * serve ftp: add serve rc interface\n  * serve sftp: add serve rc interface\n  * serve restic: add serve rc interface\n  * serve s3: add serve rc interface\n  * serve dlna: add serve rc interface\n  * serve webdav: add serve rc interface - fixes #4505\n  * serve http: add serve rc interface\n  * serve nfs: add serve rc interface\n  * serve: Add rc control for serve commands #4505\n  * configstruct: add SetAny to parse config from the rc\n  * rc: In options/info make FieldName contain a \".\" if it should be nested\n  * serve restic: convert options to new style\n  * serve s3: convert options to new style\n  * serve http: convert options to new style\n  * serve webdav: convert options to new style\n  * auth proxy: convert options to new style\n  * auth proxy: add VFS options parameter for use for default VFS\n  * serve: make the servers self registering\n  * lib/http: fix race between Serve() and Shutdown()\n  * lib/http: add Addr() method to return the first configured server address\n  * Add Danny Garside to contributors\n  * docs: fix minor typo in box docs\n  * sync: implement --list-cutoff to allow on disk sorting for reduced memory use\n  * march: Implement callback based syncing\n  * list: add ListDirSortedFn for callback oriented directory listing\n  * list: Implement Sorter to sort directory entries\n  * cache: mark ListP as not supported yet\n  * hasher: implement ListP interface\n  * compress: implement ListP interface\n  * chunker: mark ListP as not supported yet\n  * union: mark ListP as not supported yet\n  * crypt: implement ListP interface\n  * combine: implement ListP interface\n  * s3: Implement paged listing interface ListP\n  * list: add WithListP helper to implement List for ListP backends\n  * walk: move NewListRHelper into list.Helper to avoid circular dependency\n  * fs: define ListP interface for paged listing #4788\n  * accounting: Add listed stat for number of directory entries listed\n  * walk: factor Listing helpers into their own file and add tests\n  * serve nfs: make metadata files have special file handles\n  * serve nfs: change the format of --nfs-cache-type symlink file handles\n  * vfs: add --vfs-metadata-extension to expose metadata sidecar files\n  * docs: Add rcloneui.com as Silver Sponsor\n  * Add Klaas Freitag to contributors\n  * Add eccoisle to contributors\n  * Add Fernando Fern�ndez to contributors\n  * Add alingse to contributors\n  * Add J�rn Friedrich Dreyer to contributors\n  * docs: replace option --auto-filename-header with --header-filename\n  * build: update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to fix CVE-2025-30204\n  * docs/googlephotos: fix typos\n  * build: bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2\n  * operations: fix call fmt.Errorf with wrong err\n  * webdav: retry propfind on 425 status\n  * Add --max-connections to control maximum backend concurrency\n  * rc: fix debug/* commands not being available over unix sockets\n  * cmd/gitannex: Prevent tests from hanging when assertion fails\n  * cmd/gitannex: Add explicit timeout for mock stdout reads in tests\n  * http: correct root if definitely pointing to a file - fixes #8428\n  * pool: add --max-buffer-memory to limit total buffer memory usage\n  * filter: Add `--hash-filter` to deterministically select a subset of files\n  * build: update golang.org/x/net to 0.36.0. to fix CVE-2025-22869\n  * rc: add add short parameter to core/stats to not return transferring and checking\n  * fs: fix corruption of SizeSuffix with \"B\" suffix in config (eg --min-size)\n  * filters: show --min-size and --max-size in --dump filters\n  * build: check docs for edits of autogenerated sections\n  * Add jack to contributors\n  * docs: fix incorrect mentions of vfs-cache-min-free-size\n  * fs/object: fix memory object out of bounds Seek\n  * serve nfs: fix unlikely crash\n  * docs: update minimum OS requirements for go1.24\n  * cmd/gitannex: Tweak parsing of \"rcloneremotename\" config\n  * cmd/gitannex: Drop var rebindings now that we have go1.23\n  * docs: add note for using rclone cat for slicing out a byte range from a file\n  * rcserver: improve content-type check\n  * build: modernize Go usage\n  * build: update all dependencies and fix deprecations\n  * build: update golang.org/x/crypto to v0.35.0 to fix CVE-2025-22869\n  * build: make go1.23 the minimum go version\n  * cmd/gitannex: Add to integration tests\n  * cmd/gitannex: Simplify verbose failures in tests\n  * cmd/gitannex: Port unit tests to fstest\n  * vfs: fix integration test failures\n  * azureblob: fix errors not being retried when doing single part copy\n  * azureblob: handle retry error codes more carefully\n  * touch: make touch obey --transfers\n  * Add luzpaz to contributors\n  * Add Dave Vasilevsky to contributors\n  * docs: fix various typos Found via\n  * dropbox: Retry link without expiry\n  * Dropbox: Support Dropbox Paper\n  * chore: update contributor email\n  * docs: correct stable release workflow\n  * Add Lorenz Brun to contributors\n  * Add Michael Kebe to contributors\n  * vfs: fix directory cache serving stale data\n  * build: fix docker plugin build - fixes #8394\n  * docs: improved sftp limitations\n  * Changelog updates from Version v1.69.1\n  * docs: add FileLu as sponsors and tidy sponsor logos\n  * accounting: fix percentDiff calculation -- fixes #8345\n  * vfs: fix the cache failing to upload symlinks when --links was specified\n  * Add jbagwell-akamai to contributors\n  * Add ll3006 to contributors\n  * doc: add note on concurrency of rclone purge\n  * s3: add latest Linode Object Storage endpoints\n  * cmd: fix crash if rclone is invoked without any arguments - Fixes #8378\n  * build: disable docker builds on PRs \u0026 add missing dockerfile changes\n  * sync: copy dir modtimes even when copyEmptySrcDirs is false - fixes #8317\n  * sync: add tests to check dir modtimes are kept when syncing\n  * fix golangci-lint errors\n  * bisync: fix false positive on integration tests\n  * s3: split the GCS quirks into -s3-use-x-id and -s3-sign-accept-encoding #8373\n  * Add Joel K Biju to contributors\n  * stats: fix the speed not getting updated after a pause in the processing\n  * opendrive: added --opendrive-access flag to handle permissions\n  * bisync: fix listings missing concurrent modifications - fixes #8359\n  * Added parallel docker builds and caching for go build in the container\n  * smb: improve connection pooling efficiency\n  * lib/oauthutil: fix redirect URL mismatch errors - fixes #8351\n  * b2: fix \"fatal error: concurrent map writes\" - fixes #8355\n  * Add Alexander Minbaev to contributors\n  * Add Zachary Vorhies to contributors\n  * Add Jess to contributors\n  * s3: add IBM IAM signer - fixes #7617\n  * serve nfs: update docs to note Windows is not supported - fixes #8352\n  * cmd/config(update remote): introduce --no-output option\n  * s3: add DigitalOcean regions SFO2, LON1, TOR1, BLR1\n  * sync: fix cpu spinning when empty directory finding with leading slashes\n  * s3: fix handling of objects with // in #5858\n  * azureblob: fix handling of objects with // in #5858\n  * fstest: add integration tests objects with // on bucket based backends #5858\n  * fs/list: tweak directory listing assertions after allowing // names\n  * lib/bucket: fix tidying of // in object keys #5858\n  * lib/bucket: add IsAllSlashes function\n  * azureblob: remove uncommitted blocks on InvalidBlobOrBlock error\n  * azureblob: implement multipart server side copy\n  * azureblob: speed up server side copies for small files #8249\n  * azureblob: cleanup uncommitted blocks on upload errors\n  * azureblob: factor readMetaData into readMetaDataAlways returning blob properties\n  * Add b-wimmer to contributors\n  * azurefiles: add --azurefiles-use-az and --azurefiles-disable-instance-discovery\n  * onedrive: mark German (de) region as deprecated\n  * Add Trevor Starick to contributors\n  * Add hiddenmarten to contributors\n  * Add Corentin Barreau to contributors\n  * Add Bruno Fernandes to contributors\n  * Add Moises Lima to contributors\n  * Add izouxv to contributors\n  * Add Robin Schneider to contributors\n  * Add Tim White to contributors\n  * Add Christoph Berger to contributors\n  * azureblob: add support for `x-ms-tags` header\n  * rc: disable the metrics server when running `rclone rc`\n  * internetarchive: add --internetarchive-metadata=\"key=value\" for setting item metadata\n  * lib/batcher: Deprecate unused option: batch_commit_timeout\n  * s3: Added new storage class to magalu provider\n  * http servers: add --user-from-header to use for authentication\n  * b2: add SkipDestructive handling to backend commands - fixes #8194\n  * vfs: close the change notify channel on Shutdown\n  * Docker image: Add label org.opencontainers.image.source for release notes in Renovate dependency updates\n  * docs: add OneDrive Impersonate instructions - fixes #5610\n  * docs: explain the stringArray flag parameter descriptor\n  * iclouddrive: add notes on ADP and Missing PCS cookies - fixes #8310\n  * docs: fix typos found by codespell in docs and code comments\n  * fs: fix confusing \"didn't find section in config file\" error\n  * vfs: fix race detected by race detector\n  * Add Jonathan Giannuzzi to contributors\n  * Add Spencer McCullough to contributors\n  * Add Matt Ickstadt to contributors\n  * smb: add support for kerberos authentication\n  * drive: added `backend moveid` command\n  * docs: fix reference to serves3 setting disable_multipart_uploads which was renamed\n  * docs: fix link to Rclone Serve S3\n  * serve s3: fix list objects encoding-type\n  * build: update gopkg.in/yaml.v2 to v3\n  * build: update all dependencies\n  * bisync: fix go vet problems with go1.24\n  * build: update to go1.24rc1 and make go1.22 the minimum required version\n  * version: add --deps flag to show dependencies and other build info\n  * doc: make man page well formed for whatis - fixes #7430\n  * Start v1.70.0-DEV development\n\n- Install completion files in the right place.\n\n- Update to version 1.69.3:\n  * build: update github.com/ebitengine/purego to work around bug in go1.24.3\n  * build: reapply update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to fix CVE-2025-30204\n\n- Update to version 1.69.2:\n  - Bug fixes\n    - accounting: Fix percentDiff calculation -- (Anagh Kumar\n      Baranwal)\n    - build\n      - Update github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 to\n        fix CVE-2025-30204 (dependabot[bot])\n      - Update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to\n        fix CVE-2025-30204 (dependabot[bot])\n      - Update golang.org/x/crypto to v0.35.0 to fix CVE-2025-22869\n        (Nick Craig-Wood)\n      - Update golang.org/x/net from 0.36.0 to 0.38.0 to fix\n        CVE-2025-22870 (dependabot[bot])\n      - Update golang.org/x/net to 0.36.0. to fix CVE-2025-22869\n        (dependabot[bot])\n      - Stop building with go \u003c go1.23 as security updates forbade\n        it (Nick Craig-Wood)\n      - Fix docker plugin build (Anagh Kumar Baranwal)\n    - cmd: Fix crash if rclone is invoked without any arguments\n      (Janne Hellsten)\n    - config: Read configuration passwords from stdin even when\n      terminated with EOF (Samantha Bowen)\n    - doc fixes (Andrew Kreimer, Danny Garside, eccoisle, Ed\n      Craig-Wood, emyarod, jack, Jugal Kishore, Markus Gerstel,\n      Michael Kebe, Nick Craig-Wood, simonmcnair, simwai, Zachary\n      Vorhies)\n    - fs: Fix corruption of SizeSuffix with \"B\" suffix in config\n      (eg --min-size) (Nick Craig-Wood)\n    - lib/http: Fix race between Serve() and Shutdown() (Nick\n      Craig-Wood)\n    - object: Fix memory object out of bounds Seek (Nick\n      Craig-Wood)\n    - operations: Fix call fmt.Errorf with wrong err (alingse)\n    - rc\n      - Disable the metrics server when running rclone rc\n        (hiddenmarten)\n      - Fix debug/* commands not being available over unix sockets\n        (Nick Craig-Wood)\n    - serve nfs: Fix unlikely crash (Nick Craig-Wood)\n    - stats: Fix the speed not getting updated after a pause in the\n      processing (Anagh Kumar Baranwal)\n    - sync\n      - Fix cpu spinning when empty directory finding with leading\n        slashes (Nick Craig-Wood)\n      - Copy dir modtimes even when copyEmptySrcDirs is false\n        (ll3006)\n  - vfs\n    - Fix directory cache serving stale data (Lorenz Brun)\n    - Fix inefficient directory caching when directory reads are\n      slow (huanghaojun)\n    - Fix integration test failures (Nick Craig-Wood)\n  - Drive\n    - Metadata: fix error when setting\n      copy-requires-writer-permission on a folder (Nick Craig-Wood)\n  - Dropbox\n    - Retry link without expiry (Dave Vasilevsky)\n  - HTTP\n    - Correct root if definitely pointing to a file (nielash)\n  - Iclouddrive\n    - Fix so created files are writable (Ben Alex)\n  - Onedrive\n    - Fix metadata ordering in permissions (Nick Craig-Wood)\n\n- Update to version 1.69.1:\n  * Version v1.69.1\n  * build: disable docker builds on PRs \u0026 add missing dockerfile changes\n  * Added parallel docker builds and caching for go build in the container\n  * docs: add FileLu as sponsors and tidy sponsor logos\n  * vfs: fix the cache failing to upload symlinks when --links was specified\n  * doc: add note on concurrency of rclone purge\n  * s3: add latest Linode Object Storage endpoints\n  * fix golangci-lint errors\n  * bisync: fix listings missing concurrent modifications - fixes #8359\n  * lib/oauthutil: fix redirect URL mismatch errors - fixes #8351\n  * b2: fix \"fatal error: concurrent map writes\" - fixes #8355\n  * serve nfs: update docs to note Windows is not supported - fixes #8352\n  * s3: add DigitalOcean regions SFO2, LON1, TOR1, BLR1\n  * onedrive: mark German (de) region as deprecated\n  * s3: Added new storage class to magalu provider\n  * vfs: close the change notify channel on Shutdown\n  * docs: add OneDrive Impersonate instructions - fixes #5610\n  * docs: explain the stringArray flag parameter descriptor\n  * iclouddrive: add notes on ADP and Missing PCS cookies - fixes #8310\n  * docs: fix typos found by codespell in docs and code comments\n  * fs: fix confusing \"didn't find section in config file\" error\n  * vfs: fix race detected by race detector\n  * docs: fix reference to serves3 setting disable_multipart_uploads which was renamed\n  * docs: fix link to Rclone Serve S3\n  * serve s3: fix list objects encoding-type\n  * doc: make man page well formed for whatis - fixes #7430\n  * Start v1.69.1-DEV development\n\n- Update to version 1.69.0:\n  https://rclone.org/changelog/#v1-69-0-2025-01-12\n\n  Rclone is using golang.org/x/net but was not affected to\n  CVE-2024-45337 and CVE-2024-45338.\n\n  * Version v1.69.0\n  * test_all: disable docker plugin tests\n  * docs: fix typo\n  * accounting: fix race stopping/starting the stats counter\n  * docs: add github.com/icholy/gomajor to RELEASE for updating major versions\n  * ftp: fix ls commands returning empty on \"Microsoft FTP Service\" servers\n  * s3: add docs on data integrity\n  * webdav: make --webdav-auth-redirect to fix 401 unauthorized on redirect\n  * rest: make auth preserving redirects an option\n  * box: fix panic when decoding corrupted PEM from JWT file\n  * size: make output compatible with -P\n  * vfs: add remote name to vfs cache log messages - fixes #7952\n  * dropbox: fix return status when full to be fatal error\n  * rc: add relative to vfs/queue-set-expiry\n  * vfs: fix open files disappearing from directory listings\n  * docker serve: parse all remaining mount and VFS options\n  * smb: fix panic if stat fails\n  * googlephotos: fix nil pointer crash on upload - fixes #8233\n  * iclouddrive: tweak docs\n  * serve dlna: sort the directory entries by directories first then alphabetically by name\n  * serve nfs: fix missing inode numbers which was messing up ls -laR\n  * serve nfs: implement --nfs-cache-type symlink\n  * azureblob,oracleobjectstorage,s3: quit multipart uploads if the context is cancelled\n  * http: fix incorrect URLs with initial slash\n  * build: update `github.com/shirou/gopsutil` to v4\n  * Replace Windows-specific NewLazyDLL with NewLazySystemDLL\n  * lib/oauthutil: don't require token to exist for client credentials flow\n  * fs/operations: make log messages consistent for mkdir/rmdir at INFO level\n  * Add Francesco Frassinelli to contributors\n  * smb: Add support for Kerberos authentication.\n  * docs: smb: link to CloudSoda/go-smb2 fork\n  * cloudinary: add cloudinary backend - fixes #7989\n  * operations: fix eventual consistency in TestParseSumFile test\n  * Add TAKEI Yuya to contributors\n  * docs: Remove Backblaze as a Platinum sponsor\n  * docs: add RcloneView as silver sponsor\n  * serve docker: fix incorrect GID assignment\n  * serve s3: fix Last-Modified timestamp\n  * Add ToM to contributors\n  * Add Henry Lee to contributors\n  * Add Louis Laureys to contributors\n  * docs: filtering: mention feeding --files-from from standard input\n  * docs: filtering: fix --include-from copypaste error\n  * s3: rename glacier storage class to flexible retrieval\n  * b2: add daysFromStartingToCancelingUnfinishedLargeFiles to backend lifecycle command\n  * build: update golang.org/x/net to v0.33.0 to fix CVE-2024-45338\n  * azurefiles: fix missing x-ms-file-request-intent header\n  * Add Thomas ten Cate to contributors\n  * docs: Document --url and --unix-socket on the rc page\n  * docs: link to the outstanding vfs symlinks issue\n  * Add Yxxx to contributors\n  * Add hayden.pan to contributors\n  * docs: update pcloud doc to avoid puzzling token error when use remote rclone authorize\n  * pikpak: add option to use original file links - fixes #8246\n  * rc/job: use mutex for adding listeners thread safety\n  * docs: mention in serve tls options when value is path to file - fixes #8232\n  * build: update all dependencies\n  * accounting: fix debug printing when debug wasn't set\n  * Add Filipe Azevedo to contributors\n  * fs: make --links flag global and add new --local-links and --vfs-links flag\n  * vfs: add docs for -l/--links flag\n  * nfsmount,serve nfs: introduce symlink support #2975\n  * mount2: introduce symlink support #2975\n  * mount: introduce symlink support #2975\n  * cmount: introduce symlink support #2975\n  * vfstest: make VFS test suite support symlinks\n  * vfs: add symlink support to VFS\n  * vfs: add ELOOP error\n  * vfs: Add link permissions\n  * vfs: Add VFS --links command line switch\n  * vfs: add vfs.WriteFile to match os.WriteFile\n  * fs: Move link suffix to fs\n  * cmount: fix problems noticed by linter\n  * mount2: Fix missing . and .. entries\n  * sftp: fix nil check when using auth proxy\n  * Add Martin Hassack to contributors\n  * serve sftp: resolve CVE-2024-45337\n  * googlecloudstorage: typo fix in docs\n  * onedrive: add support for OAuth client credential flow - fixes #6197\n  * lib/oauthutil: add support for OAuth client credential flow\n  * lib/oauthutil: return error messages from the oauth process better\n  * bin/test_backend_sizes.py fix compile flags and s3 reporting\n  * test makefiles: add --flat flag for making directories with many entries\n  * Add divinity76 to contributors\n  * Add Ilias Ozgur Can Leonard to contributors\n  * Add remygrandin to contributors\n  * Add Michael R. Davis to contributors\n  * cmd/mountlib: better snap mount error message\n  * vfs: with --vfs-used-is-size value is calculated and then thrown away - fixes #8220\n  * serve sftp: fix loading of authorized keys file with comment on last line - fixes #8227\n  * oracleobjectstorage: make specifying compartmentid optional\n  * plcoud: fix failing large file uploads - fixes #8147\n  * docs: add docker volume plugin troubleshooting steps\n  * docs: fix missing `state` parameter in `/auth` link in instructions\n  * build: fix build failure on ubuntu\n  * docs: upgrade fontawesome to v6\n  * s3: fix multitenant multipart uploads with CEPH\n  * Add David Seifert to contributors\n  * Add vintagefuture to contributors\n  * use better docs\n  * googlecloudstorage: update docs on service account access tokens\n  * test_all: POSIX head/tail invocations\n  * icloud: Added note about app specific password not working\n  * s3: fix download of compressed files from Cloudflare R2 - fixes #8137\n  * s3: fix testing tiers which don't exist except on AWS\n  * Changelog updates from Version v1.68.2\n  * local: fix permission and ownership on symlinks with --links and --metadata\n  * Revert \"Merge commit from fork\"\n  * Add Dimitrios Slamaris to contributors\n  * Merge commit from fork\n  * onedrive: fix integration tests after precision change\n  * operations: fix TestRemoveExisting on crypt backends by shortening the file name\n  * bisync: fix output capture restoring the wrong output for logrus\n  * serve sftp: update github.com/pkg/sftp to v1.13.7 and fix deadlock in tests\n  * build: fix comments after golangci-lint upgrade\n  * build: update all dependencies\n  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1\n  * pikpak: fix fatal crash on startup with token that can't be refreshed\n  * yandex: fix server side copying over existing object\n  * sugarsync: fix server side copying over existing object\n  * putio: fix server side copying over existing object\n  * onedrive: fix server side copying over existing object\n  * dropbox: fix server side copying over existing object\n  * operations: add RemoveExisting to safely remove an existing file\n  * gofile: fix server side copying over existing object\n  * test_all: try to fix mailru rate limits in integration tests\n  * Add shenpengfeng to contributors\n  * Add Dimitar Ivanov to contributors\n  * docs: fix function name in comment\n  * sftp: allow inline ssh public certificate for sftp\n  * serve s3: fix excess locking which was making serve s3 single threaded\n  * lib/oauthutil: allow the browser opening function to be overridden\n  * Add Moises Lima to contributors\n  * lib/http: disable automatic authentication skipping for unix sockets\n  * onedrive: fix Retry-After handling to look at 503 errors also\n  * s3: Storj provider: fix server-side copy of files bigger than 5GB\n  * s3: add Selectel as a provider\n  * fs: fix Don't know how to set key \"chunkSize\" on upload errors in tests\n  * drive: implement rclone backend rescue to rescue orphaned files\n  * Add tgfisher to contributors\n  * Add Diego Monti to contributors\n  * Add Randy Bush to contributors\n  * Add Alexandre Hamez to contributors\n  * Add Simon Bos to contributors\n  * docs: mention that inline comments are not supported in a filter-file\n  * s3: add Wasabi eu-south-1 region\n  * docs: fix forward refs in step 9 of using your own client id\n  * docs: fix Scaleway Glacier website URL\n  * dlna: fix loggingResponseWriter disregarding log level\n  * build: remove required property on boolean inputs\n  * build: use inputs context in github workflow\n  * s3: fix crash when using --s3-download-url after migration to SDKv2\n  * docs: update overview to show pcloud can set modtime\n  * Add Andr� Tran to contributors\n  * Add Matthias Gatto to contributors\n  * Add lostb1t to contributors\n  * Add Noam Ross to contributors\n  * Add Benjamin Legrand to contributors\n  * s3: add Outscale provider\n  * Add ICloud Drive backend\n  * drive: add support for markdown format\n  * accounting: fix global error acounting\n  * onedrive: fix time precision for OneDrive personal\n  * Add RcloneView as a sponsor\n  * Add Leandro Piccilli to contributors\n  * cache: skip bisync tests\n  * bisync: allow blank hashes on tests\n  * box: fix server-side copying a file over existing dst - fixes #3511\n  * sync: add tests for copying/moving a file over itself\n  * fs/cache: fix parent not getting pinned when remote is a file\n  * gcs: add access token auth with --gcs-access-token\n  * accounting: write the current bwlimit to the log on SIGUSR2\n  * accounting: fix wrong message on SIGUSR2 to enable/disable bwlimit\n  * gphotos: implment --gphotos-proxy to allow download of full resolution media\n  * googlephotos: remove noisy debugging statements\n  * docs: add note to CONTRIBUTING that the overview needs editing in 2 places\n  * test_all: add ignoretests parameter for skipping certain tests\n  * build: replace \"golang.org/x/exp/slices\" with \"slices\" now go1.21 is required\n  * Changelog updates from Version v1.68.1\n  * Makefile: Fail when doc recipes create dir named '$HOME'\n  * Makefile: Prevent `doc` recipe from creating dir named '$HOME'\n  * pikpak: fix cid/gcid calculations for fs.OverrideRemote\n  * bisync: change exit code from 2 to 7 for critically aborted run\n  * cmd: change exit code from 1 to 2 for syntax and usage errors\n  * local: fix --copy-links on macOS when cloning\n  * azureblob: add --azureblob-use-az to force the use of the Azure CLI for auth\n  * azureblob: add --azureblob-disable-instance-discovery\n  * s3: add initial --s3-directory-bucket to support AWS Directory Buckets\n  * Add Lawrence Murray to contributors\n  * backend/protondrive: improve performance of Proton Drive backend\n  * ftp: implement --ftp-no-check-upload to allow upload to write only dirs\n  * docs: document that fusermount3 may be needed when mounting/unmounting\n  * Add rishi.sridhar to contributors\n  * Add quiescens to contributors\n  * docs/zoho: update options\n  * zoho: make upload cutoff configurable\n  * zoho: add support for private spaces\n  * zoho: try to handle rate limits a bit better\n  * zoho: print clear error message when missing oauth scope\n  * zoho: switch to large file upload API for larger files, fix missing URL encoding of filenames for the upload API\n  * zoho: use download server to accelerate downloads\n  * opendrive: add about support to backend\n  * pikpak: fix login issue where token retrieval fails\n  * webdav: nextcloud: implement backoff and retry for 423 LOCKED errors\n  * s3: fix rclone ignoring static credentials when env_auth=true\n  * fs: fix setting stringArray config values from environment variables\n  * rc: fix default value of --metrics-addr\n  * fs: fix --dump filters not always appearing\n  * docs: correct notes on docker manual build\n  * Add ttionya to contributors\n  * build: fix docker release build - fixes #8062\n  * docs: add section for improving performance for s3\n  * onedrive: fix spurious \"Couldn't decode error response: EOF\" DEBUG\n  * Add Divyam to contributors\n  * serve docker: add missing vfs-read-chunk-streams option in docker volume driver\n  * Start v1.69.0-DEV development\n\n- Update to version 1.68.2:\n  * Version v1.68.2\n  * s3: fix multitenant multipart uploads with CEPH\n  * local: fix permission and ownership on symlinks with --links and --metadata\n    CVE-2024-52522 boo#1233422\n  * bisync: fix output capture restoring the wrong output for logrus\n  * build: fix comments after golangci-lint upgrade\n  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1\n  * pikpak: fix fatal crash on startup with token that can't be refreshed\n  * serve s3: fix excess locking which was making serve s3 single threaded\n  * onedrive: fix Retry-After handling to look at 503 errors also\n  * s3: Storj provider: fix server-side copy of files bigger than 5GB\n  * docs: mention that inline comments are not supported in a filter-file\n  * docs: fix forward refs in step 9 of using your own client id\n  * docs: fix Scaleway Glacier website URL\n  * dlna: fix loggingResponseWriter disregarding log level\n  * s3: fix crash when using --s3-download-url after migration to SDKv2\n  * docs: update overview to show pcloud can set modtime\n  * Add RcloneView as a sponsor\n  * accounting: fix wrong message on SIGUSR2 to enable/disable bwlimit\n  * pikpak: fix cid/gcid calculations for fs.OverrideRemote\n  * local: fix --copy-links on macOS when cloning\n  * Start v1.68.2-DEV development\n\n- CVE-2024-51744: updated jwt to v4.5.1 (bsc#1232964).\n","status":"published","published":"2026-04-23T16:22:47Z","modified":"2026-05-19T06:28:55.290679412Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20730-1","title":"Security update for apptainer","description":"This update for apptainer fixes the following issues:\n\nChanges in apptainer:\n\n- Fix CVE-2026-34986 (bsc#1262956)\n      * github.com/go-jose/go-jose/v4@v4.1.4\n      CVE-2026-33186 GO-2026-4762 (bsc#1260311)\n      * google.golang.org/grpc@v1.79.3\n      CVE-2026-24137 GO-2026-4358 (bsc#1264177)\n      * github.com/sigstore/sigstore@v1.10.4\n        Fix fallout:\n\tgithub.com/moby/go-archive@v0.1.0\n\tgithub.com/containers/image/v5=github.com/containers/image/v5@v5.36.0\n\n- Fix HTML parser misimplementation of a part of the HTML\n  specification for table related tags (CVE-2025-58190,\n  GO-2026-4441, bsc#1258048).\n- Fix issue where the HTML parser takes a very long time or\n  even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).\n\n- Update ot 1.4.5\n  * Fix for moderate severity GO-2025-4176 / CVE-2025-65105 /\n    GHSA-j3rw-fx6g-q46j (bsc#1255462):\n    Ineffective application of selinux / apparmor --security option.\n    Updates of a few dependent go libraries for related security fixes.\n  * Other fix\n    Run FUSE processes in a separate process group. This detaches them\n    from the main process so they don't receive signals such as interrupts\n    sent to a terminal there. This was not a problem with interactive\n    shells because they start their own group, but was a problem with\n    some programs with interactive Read/Eval/Print/Loops such as python.\n    An interrupt there would kill the FUSE processes.\n- From 1.4.4\n  * By applying patches to the bundled fuse2fs, allow again the possibility\n    of using a non-writable ext3 image file as an overlay. Fixes regression\n    introduced in 1.4.3.\n  * If an overlay or bound data image is asked to be mounted writable but\n    the user has no write access to the image, show a warning message\n    instead of silently switching to readonly.\n  * Avoid a fatal error when starting fakeroot from suid mode while\n    in an NFS directory.\n  * Fix 32-bit builds which were accidentally broken by a library\n    upgrade that was done for a minor security issue.\n- Fix CVEs:\n  * GO-2025-4135 - CVE-2025-47914\n    Malformed constraint may cause denial of service in\n    golang.org/x/crypto/ssh/agent.\n  * GO-2025-4134 - CVE-2025-58181 - bsc#1253924\n    Unbounded memory consumption in golang.org/x/crypto/ssh.\n  * GO-2025-4116 - CVE-2025-47913\n    Potential denial of service in golang.org/x/crypto/ssh/agent.\n  * GO-2025-3595 - CVE-2025-22872\n   Incorrect Neutralization of Input During Web Page Generation\n   in x/net.\n  * GO-2025-3503 - CVE-2025-22870\n    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.\n  * GO-2025-3487 - CVE-2025-22869\n    Potential denial of service in golang.org/x/crypto.\n  * GO-2025-3485 - CVE-2025-27144\n    DoS in go-jose Parsing in github.com/go-jose/go-jose.\n  * GO-2025-3754 - CVE-2025-8556\n    CIRCL-Fourq: Missing and wrong validation can lead to\n    incorrect results in github.com/cloudflare/circl.\n\n- No need for binutils-gold for aarch64\n\n- Update to 1.4.3\n  * Corrected the mconfig -s option for statically building apptainer\n    and starter binaries.\n  * Resolved an issue where the Makefile generated by mconfig -b\n    failed when the build directory was not a subdirectory of the\n    Apptainer source code.\n  * Fixed %files in definition files to correctly copy symlinks\n    pointing above the destination directory but within the\n    destination stage root filesystem.\n  * Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was\n    corrected to libnvoptix.so).\n  * Prevented timeouts during cleanup after building\n    gocryptfs-encrypted SIF files.\n  * Fixed a bug that prevented build with --passphrase or --pem-path\n    (without --encrypt) from implying fakeroot.\n  * Resolved a hang when copying files between build stages while\n    using suid mode without user namespaces.\n  * Fixed issues with running and building containers of different\n    architectures than the host via binfmt_misc when using rootless\n    fakeroot.\n  * Corrected \"target: no such file or directory\" errors when\n    extracting layers from certain OCI images that manipulate hard\n    links across layers.\n  * Fixed a crash when executing a privilege-encrypted container as\n    root.\n  * Improved documentation for the remote list command.\n  * Removed the fakerootcallback functionality.\n  * Updated the default pacman confURL for Bootstrap: arch container\n    builds.\n  * Updated bundled fuse programs to their latest releases.\n  * Changed the default message level from silent to normal in\n    nested apptainer executions of a build's %post section, and\n    suppressed an unnecessary warning.\n  * Invalid environment variables are now ignored when pulling\n    oci/docker containers.\n- Add definition file for SLE 16 (SLE-16.def).\n- Remove definition files for SLE15 SP5 (SLE-15SP5.def) and\n  SP6 (SLE-15SP6.def).\n\n- Update to 1.4.2\n  * Restore looking for registry mirrors in /etc/containers/registry.conf\n    and related files. This had been inadvertently dropped beginning in 1.4.0.\n  * Fix use of the image cache when the home directory contains @ characters.\n    Previously it would assume that it was the start of a digest in the oci-dir.\n  * Fix signature verification failures on unsigned images.\n  * Add additional .deb packages to the release assets that include the label\n    trixie+ to indicate that they are for installing on Debian 13 or later.\n    Those packages are necessary to work with the new libfuse3 library in\n    Debian13. They also support libsubid, unlike the default packages because\n    they are built on Debian 11 which doesn't have that library.\n  * Add automatic triggering of Ubuntu PPA builds whenever there's a new\n    apptainer release.\n\n- Update to 1.4.1\n  * Fix the use of libsubid which had been broken by the revision\n    applied in 1.4.0-rc.2.\n  * Fix a bug introduced in 1.4.0 that caused arm64 to be\n    mis-converted to arm64v8 and resulted in a failure when pulling\n    OCI containers.\n  * Fix user database lookup in master process preventing instance\n    from starting correctly on systems using winbind.\n  * Check for existence of `/run/systemd/system` when verifying\n    cgroups can be used via systemd manager.\n  * Add a clear error message if someone tries to use privileged\n    network options while not using setuid mode.\n  * Allow multi-arch oci-archive files that have a nested index\n    with the manifest. This is the default format (both for Docker\n    and OCI) when using `nerdctl save`.\n  * Test if docker-archive is actually an oci-archive (since Docker\n    version 25), and if it is oci then use the OCI parser to avoid\n    bugs in the Docker parser. Save the daemon-daemon references\n    to a temporary docker-archive, to benefit from the same\n    improvements also for those references. Parse as oci-archive.\n\n- New Features \u0026 Functionality in from ineherited 1.4.0\n  * Add new build option `--mksquashfs-args` to pass additional\n    arguments to the `mksquashfs` command when building SIF files.\n    If a compression method other than gzip is selected, the SIF\n    file might not work with older installations of Apptainer\n    or Singularity, so an INFO message about that is printed. On\n    the other hand, an INFO message that was printed (twice) when\n    running an image with non-gzip compression has been removed.\n  * If the `mksquashfs` version is new enough (version 4.6 in\n    Leaep 16.0), then show a percentage progress bar (with ETA)\n    during SIF creation in the default log level. If the `mksquashfs`\n    version is older, then in verbose or debug log level show the\n    output of mksquashfs with its own progress bar.\n  * Statistics are now normally available for instances that are\n    started by non-root users on cgroups v2 systems. The instance\n    will be started in the current cgroup. Information about\n    configuration issues that prevent collection of statistics are\n    displayed as INFO messages by default.\n  * Add a `--sandbox` option to `apptainer pull`.\n  * Add configuration file binding to the `--nv` option. Files\n    that are recognized in the NVIDIA Container Toolkit, including\n    files for EGL ICD, were added to the default `nvliblist.conf`.\n  * It is now possible to use multiple environment variable files\n    using the `--env-file` flag. Files can be specified as a\n    comma-separated list or by using the flag multiple times.\n    Variables defined in later files take precedence over earlier\n    files.\n  * The registry login and registry logout commands now support a\n    `--authfile \u003cpath\u003e` option, which causes OCI credentials to be\n    written to / removed from a custom file located at `\u003cpath\u003e`\n    instead of the default location (`$HOME/.apptainer/docker-config.json`).\n    The commands `pull`, `push`, `run`, `exec`, `shell` and\n    instance start can now also be passed a `--authfile \u003cpath\u003e`\n    option, to read OCI registry credentials from this custom file.\n  * A new `--netns-path` option takes a path to a network\n    namespace to join when starting a container. The root user\n    may join any network namespace. An unprivileged user can only\n    join a network namespace specified in the new `allow netns\n    paths` directive in `apptainer.conf`, if they are also listed\n    in `allow net users` / `allow net groups` and apptainer is\n    installed with setuid privileges. Not supported with\n    `--fakeroot`.\n  * `apptainer.conf` now accepts setting the following options:\n        `allow ipc ns` -- Default value is `yes`; when set to `no`,\n\tit will disable the use of the `--ipc` flag.\n        `allow uts ns` -- Default value is `yes`; when set to `no`,\n\tit will invalidate the use of the `--uts` and `--hostname`\n\tflags.\n        `allow user ns` -- Default value is `yes`; when set to\n\t`no`, it will disable creation of user namespaces. Note\n\tthat this will prevent execution of containers with the\n\t`--userns` or `--fakeroot` flags and with unprivileged\n\tinstallations of Apptainer.\n- Changed defaults / behaviours\n  * Label the starter process seen in `ps` with the image filename,\n    for example: Apptainer runtime parent: `example.sif`.\n  * Remove runtime and compute libraries from `rocmliblist.conf`.\n    They should instead be provided by the container image.\n  * Allow overriding the build architecture with `--arch` and\n    `--arch-variant`, to build images for another architecture\n    than the current host arch. This requires that the host has\n    been set up to support multiple architectures (`binfmt_misc`).\n  * Complete the previously partial support for the riscv64\n    architecture.\n  * Show a warning message if changing directory to the cwd\n    fails, instead of silently switching to the home directory\n    or `/`.\n  * Write starter messages to stderr when an instance fails to\n    start. Previously they were incorrectly written to stdout.\n  * Skip attempting to bind inaccessible mount points when\n    handling the `mount hostfs = yes` configuration option.\n  * Fix storage of credentials for `docker.io` to behave the same\n    as for `index.docker.io`.\n  * Change message log level from warning to debug when environment\n    variables set inside a container or by `APPTAINERENV` have a\n    different value than the environment variable on the host.\n  * Change the default message level from silent to the normal\n    level in the nested apptainer that executes a build's `%post`\n    section, and suppress an unnecessary warning message.\n  * Ignore invalid environment variables when pulling oci/docker\n    containers.\n  * Remove the little-known `fakerootcallback` functionality.\n  * Update the default pacman confURL for `Bootstrap: arch`\n    container builds.\n  * Update the bundled fuse programs to their latest releases.\n- Bug fixes\n  * Fix the `mconfig -s` option to build the apptainer and starter\n    binaries statically as documented.\n  * `%files from` in a definition file will now correctly copy\n    symlinks that `%point` to a target above the destination\n    directory but inside the `%destination` stage root filesystem.\n  * Fixed typo in `nvliblist.conf` (`libnvoptix.so.1` -\u003e `libnvoptix.so`).\n  * Avoid timeouts when cleaning up from building gocryptfs-encrypted\n    SIF files.\n  * Fix bug that prevented build with `--passphrase` or\n    `--pem-path` but without `--encrypt` from implying fakeroot.\n  * Fix hang when copying files between build stages while using\n    suid mode without user namespaces.\n  * Fix running and building containers of different architectures\n    than the host via binfmt_misc when using rootless fakeroot.\n  * Fix `target: no such file or directory` error when extracting\n    layers from certain OCI images that manipulate hard links\n    across layers.\n  * Fix the crash that happened when executing a privilege-encrypted\n    container as root.\n\n- Fix CVE-2024-45338, CVE-2025-22870, CVE-2024-45337, CVE-2025-22869, CVE-2025-27144 CVE-2024-41110\n  * GO-2024-3333 CVE-2024-45338 (bsc#1234794)\n    GO-2025-3503 CVE-2025-22870 (bsc#1238611):\n    Update to: golang.org/x/net@v0.36.0\n  * GO-2024-3321 CVE-2024-45337 (bsc#1234595)\n    GO-2025-3487 CVE-2025-22869 (bsc#1239341):\n    Update to: golang.org/x/crypto@v0.35.0\n  * GO-2025-3485 CVE-2025-27144 (bsc#1237679):\n    Update to: github.com/go-jose/go-jose/v3@v3.0.4\n  * GO-2024-3005 CVE-2024-41110 (bsc#1228324):\n    Update to: github.com/docker/docker@v25.0.6+incompatible\n\n- Update golang.org/x/net to v0.23 to fix CVE-2023-45288 (bnc#1236528).\n\n- Update to version 1.3.6\n  * Avoid using kernel overlayfs when the lower layer is a sandbox\n    on an incompatible filesystem type such as GPFS or Lustre.\n    For those cases use fuse-overlayfs instead. This fixes a\n    regression introduced in 1.3.0. The regression didn't much\n    impact Lustre because kernel overlayfs refused to try to use\n    it and Apptainer proceeded to use fuse-overlayfs anyway, but\n    with GPFS the kernel overlayfs allowed mounting but returned\n    stale file handle errors.\n\n- Version 1.3.5\n  * Fix a regression introduced in 1.3.4 that overwrote existing\n    standard `/.singularity.d` files such as `runscript` in\n    container images even if they had been modified.\n  * Skip attempting to bind inaccessible mount points when\n    handling the `mount hostfs = yes` configuration option.\n  * Support parsing nested variables defined inside `%arguments`\n    section of definition files.\n  * Ignore invalid environment variables when pulling oci/docker\n    containers.\n\n- Version 1.3.4\n  * Fixed sif-embedded overlay partitions for containers that are\n    larger than 2 gigabytes.\n  * Fixed the failure when starting apptainer with\n    `instance --fakeroot`.\n  * `apptainer build -B ...` can now be used to mount custom\n    resolv.conf and hosts files from non-standard outside locations.\n    This can be used to run `apptainer build` in a nix-build sandbox\n    that has no `/etc/resolv.conf`.\n  * Fixed failing builds from local images that have symbolic links\n    for paths that are part of the base container environment (e.g.\n    /var/tmp -\u003e /tmp).\n  * Show info messages suggesting to use\n    `enable underlay = preferred` or the `--underlay` flag when\n    overlay is implied for bind mounts but the kernel is too old\n    to support fuse mounts in user namespaces and so tries to use\n    fusermount.\n  * When someone uses a `yum` bootstrap to build a container\n    without using subuid-based fakeroot or root, warn that it is\n    unlikely to work.\n  * Allow a writable `--overlay` to be used with `--nvccli` instead\n    of `--writable-tmpfs`.\n  * If an error \"no descriptor found for reference\" is seen while\n    getting an oci container, retry the operation up to five times.\n  * Make fakeroot Recommended for SUSE rpms instead of Required.\n  * Allow bind mounts onto existing files on r/o NFS filesystems.\n  * If an error is seen in the %post section when building a\n    container using fakeroot mode 3 (with the fakeroot command)\n    then show a message suggesting using `--ignore-fakeroot-command`\n    and referring to the documentation about how to install and use\n    it inside the container definition file.\n  * Show a more helpful error message when using fakeroot in suid\n    mode and there's an `/etc/subuid` mapping even though user\n    namespaces are not available (user namespaces are required for\n    `/etc/subuid` mapping).\n\n- Version 1.3.3\n  * Added libcudadebugger.so to nvliblist.conf to support cuda-gdb\n    in CUDA 12+.\n  * Ensure opened/kept file descriptors in stage 1 are not closed\n    during the Go garbage collection to avoid \"bad file descriptor\"\n    errors at startup.\n  * Fixed a segmentation violation issue when running Apptainer\n    checkpoint.\n  * Fixed an issue that Apptainer won't read default docker\n    credentials.\n\n- Version 1.3.2\n  * Fix for\n    [CVE-2024-3727](https://bugzilla.suse.com/show_bug.cgi?id=1224114)\n    in a dependent library which describes a flaw that can allow\n    attackers to trigger unexpected authenticated registry accesses\n    due to object digest values not being validated in all cases.\n  * Fixed the issue when nesting `apptainer instance start` inside\n    a container on cgroups-v2 capable host.\n  * Fixed the issue that oras download progress bar gets stuck\n    when downloading large images.\n\n- Version 1.3.1\n  * Make 'apptainer build' work with signed Docker containers.\n  * Fixed regression introduced in 1.3.0 that prevented closing\n    cryptsetup and the corresponding loop device after running\n    an encrypted sif container file in suid mode.\n  * Stopped binding over the default timezone in the container\n    with the host's timezone, which led to unexpected behavior if\n    the application changed timezones.\n  * Added progress bars for `oras://` push and pull.\n  * Hide `Instance stats will not be available` message under\n    `--sharens` mode.\n  * Fix problem where credentials locally stored with\n    `registry login` command were not usable in some execution\n    flows. Run `registry login` again with latest version to ensure\n    credentials are stored correctly.\n  * Make runscript timeout configurable.\n  * Return invalid bind path mount options during bind path\n    parsing.\n  * Make the INFO message more helpful when a running background\n    process at exit time causes a FUSE mount to not shut down\n    cleanly.\n  * Fixed the wrong mediaType in the oras push manifest.\n- Add Apptainer definition template for SLE15-SP7.\n\n- Make sure, build is reproducible by setting the GNU build ID to one\n  derived from the Go one. See https://pkg.go.dev/cmd/link.\n\n- Use go-jose version with fix for CVE-2024-28180 (bsc#1235211).\n","status":"published","published":"2026-05-14T16:09:31Z","modified":"2026-05-16T08:19:17.133144Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20788-1","title":"Security update for mcphost","description":"This update for mcphost fixes the following issues\n\n- CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data\n  Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or (bsc#1265274).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1265275).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253952).\n- CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260224).\n\nChanges for mcphost:\n\n- Updated to version 0.34.0\n * Features:\n - Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)\n - Add Google Vertex AI support for Claude models\n - Add new models.\n * Fixes:\n - Eliminate escape sequence leak from spinner tea.Program instances.\n - Fix anthropic api issue.\n - Convert JSON Schema draft-07 exclusive bounds to draft-04 format.\n * Upgrade all dependencies to latest versions, resolve security issues\n and to obtain Go 1.26 compatibility.\n","status":"published","published":"2026-05-22T11:50:52Z","modified":"2026-05-26T18:24:15.174834861Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.68.2:\n\nSecurity fixes:\n\n - CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).\n - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).\n - CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).\n - CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).\n - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).\n - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).\n - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).\n - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).\n - CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).\n - CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).\n - CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).\n - CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).\n - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).\n - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).\n - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).\n - CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).\n - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).\n - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).\n - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input (bsc#1251547).\n\nOther fixes:\n\n - Update installation.md (#8979)\n - chore(alpine): add EOL date for Alpine 3.21 (#8221)\n - chore(alpine): add EOL date for Alpine 3.22 (#8992)\n - chore(cli): Remove Trivy Cloud (#9847)\n - chore(deps): Bump trivy-checks (#7819)\n - chore(deps): Bump trivy-checks (#8310)\n - chore(deps): Bump trivy-checks (#8619)\n - chore(deps): Bump trivy-checks (#8934)\n - chore(deps): Bump trivy-checks to v1.7.1 (#8467)\n - chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n - chore(deps): Switch to go-viper/mapstructure (#9579)\n - chore(deps): Update trivy-checks (#8798)\n - chore(deps): Upgrade trivy-checks (#8018)\n - chore(deps): bump Go to `v1.23.5` (#8341)\n - chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)\n - chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)\n - chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n - chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)\n - chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n - chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)\n - chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)\n - chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)\n - chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 (#9764)\n - chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)\n - chore(deps): bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5 (#9763)\n - chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)\n - chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)\n - chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)\n - chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n - chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)\n - chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n - chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)\n - chore(deps): bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 (#9778)\n - chore(deps): bump github.com/quic-go/quic-go from 0.52.0 to 0.54.1 (#9694)\n - chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)\n - chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)\n - chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n - chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#9827)\n - chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)\n - chore(deps): bump golangci-lint to v2.1.2 (#8766)\n - chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)\n - chore(deps): bump the aws group across 1 directory with 5 updates (#8652)\n - chore(deps): bump the aws group across 1 directory with 6 updates (#8074)\n - chore(deps): bump the aws group across 1 directory with 6 updates (#8163)\n - chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n - chore(deps): bump the aws group across 1 directory with 7 updates (#8468)\n - chore(deps): bump the aws group with 6 updates (#7902)\n - chore(deps): bump the aws group with 6 updates (#9383)\n - chore(deps): bump the aws group with 6 updates (#9481)\n - chore(deps): bump the aws group with 6 updates (#9547)\n - chore(deps): bump the aws group with 7 updates (#8299)\n - chore(deps): bump the aws group with 7 updates (#9311)\n - chore(deps): bump the aws group with 7 updates (#9419)\n - chore(deps): bump the aws group with 7 updates (#9691)\n - chore(deps): bump the common group across 1 directory with 10 updates (#8566)\n - chore(deps): bump the common group across 1 directory with 10 updates (#8817)\n - chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)\n - chore(deps): bump the common group across 1 directory with 11 updates (#8381)\n - chore(deps): bump the common group across 1 directory with 13 updates (#8491)\n - chore(deps): bump the common group across 1 directory with 14 updates (#8126)\n - chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n - chore(deps): bump the common group across 1 directory with 20 updates (#9840)\n - chore(deps): bump the common group across 1 directory with 23 updates (#8733)\n - chore(deps): bump the common group across 1 directory with 24 updates (#9228)\n - chore(deps): bump the common group across 1 directory with 24 updates (#9507)\n - chore(deps): bump the common group across 1 directory with 26 updates (#9063)\n - chore(deps): bump the common group across 1 directory with 26 updates (#9347)\n - chore(deps): bump the common group across 1 directory with 29 updates (#8261)\n - chore(deps): bump the common group across 1 directory with 7 updates (#9590)\n - chore(deps): bump the common group across 1 directory with 9 updates (#8887)\n - chore(deps): bump the common group across 1 directory with 9 updates (#9153)\n - chore(deps): bump the common group with 12 updates (#8301)\n - chore(deps): bump the common group with 4 updates (#7949)\n - chore(deps): bump the common group with 6 updates (#7904)\n - chore(deps): bump the common group with 6 updates (#8162)\n - chore(deps): bump the common group with 6 updates (#8411)\n - chore(deps): bump the common group with 7 updates (#9382)\n - chore(deps): bump the docker group across 1 directory with 3 updates (#8127)\n - chore(deps): bump the docker group across 1 directory with 3 updates (#8762)\n - chore(deps): bump the docker group with 3 updates (#9545)\n - chore(deps): bump the docker group with 3 updates (#9776)\n - chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n - chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)\n - chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)\n - chore(deps): bump the github-actions group across 1 directory with 9 updates (#9563)\n - chore(deps): bump the github-actions group with 3 updates (#8473)\n - chore(deps): bump the github-actions group with 4 updates (#9739)\n - chore(deps): bump the testcontainers group with 2 updates (#8650)\n - chore(deps): bump the testcontainers group with 2 updates (#9506)\n - chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)\n - chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)\n - chore(deps): remove missed replace of `trivy-db` (#8492)\n - chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)\n - chore(deps): update Go to 1.24 and switch to go-version-file (#8388)\n - chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n - chore(deps): update go-rustaudit location (#8450)\n - chore(deps): update to module-compatible docker-credential-gcr/v2 (#9591)\n - chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)\n - chore(k8s): enhance k8s scan log (#6997)\n - chore(k8s): update comments with deprecated command format (#8964)\n - chore(license): add missed spdx exceptions: (#9147)\n - chore(secret): add reported issues related to secrets in junit template (#8193)\n - chore(terraform): add accessors to underlying raw hcl values (#8306)\n - chore(terraform): assign *terraform.Module 'parent' field (#8444)\n - chore(terraform): export module path on terraform modules (#8374)\n - chore(terraform): option to pass in instanced logger  (#8738)\n - chore(terraform): remove os.OpenPath call from terraform file functions (#8737)\n - chore(vex): suppress CVE-2024-45337 (#8101)\n - chore(vex): suppress CVE-2024-45338 (#8137)\n - chore: Update release flow to include chocolatey (#9460)\n - chore: Update release workflow to trigger version updates (#9162)\n - chore: add an issue template for maintainers (#8838)\n - chore: add context to the cache interface (#9565)\n - chore: add debug log to show image source location (#9163)\n - chore: add modernize tool integration for code modernization (#9251)\n - chore: bump Go to 1.24.7 (#9435)\n - chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)\n - chore: bump containerd to v2.0.0 (#7875)\n - chore: bump go to 1.23.4 (#8123)\n - chore: bump golangci-lint to v1.61.0 (#7853)\n - chore: bump up Go version to 1.24.4 (#9031)\n - chore: downgrade the failed block expand message to debug (#7964)\n - chore: drop FreeBSD 32-bit support (#9102)\n - chore: enable int-conversion from perfsprint (#8194)\n - chore: enable staticcheck (#8815)\n - chore: fix errors and typos in docs (#8963)\n - chore: fix some function names in comment (#9314)\n - chore: implement process-safe temp file cleanup (#9241)\n - chore: lint `errors.Join` (#7845)\n - chore: migrate protoc setup from Docker to buf CLI (#9184)\n - chore: remove Go checks (#7907)\n - chore: remove aws iam related scripts (#8179)\n - chore: remove debug prints (#8347)\n - chore: remove mockery (#8417)\n - chore: replace deprecated tenv linter with usetesting (#8504)\n - chore: trigger the trivy-www workflow (#9737)\n - chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)\n - chore: update Docker lib (#8681)\n - chore: update code owners (#8303)\n - chore: update template URL for brew formula (#9221)\n - chore: update the rpm download Update (#9202)\n - chore: use go.mod for managing Go tools (#8493)\n - chore: use require.ErrorContains when possible (#8291)\n - ci(deps): add 3-day cooldown period for Dependabot updates (#9475)\n - ci(helm): auto public Helm chart after PR merged (#7526)\n - ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n - ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)\n - ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)\n - ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)\n - ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)\n - ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)\n - ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)\n - ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)\n - ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)\n - ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)\n - ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)\n - ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)\n - ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)\n - ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)\n - ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)\n - ci(helm): bump Trivy version to 0.67.0 for Trivy Helm Chart 0.19.0 (#9554)\n - ci(helm): bump Trivy version to 0.67.2 for Trivy Helm Chart 0.19.1 (#9641)\n - ci(helm): create a helm branch for patches from main (#8673)\n - ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)\n - ci(vuln): reduce github action script injection attack risk (#8610)\n - ci: add API diff workflow (#9600)\n - ci: add auto-ready-for-review workflow (#9179)\n - ci: add workflow to restrict direct PRs to release branches (#8240)\n - ci: delete cache after artifacts upload in canary workflow (#9177)\n - ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)\n - ci: fix path to main dir for canary builds (#8231)\n - ci: get base_sha using base.ref (#9704)\n - ci: improve PR title validation workflow (#8720)\n - ci: migrate GitHub Actions from version tags to SHA pinning (#9405)\n - ci: move runner.os context from job-level env to step-level in canary workflow (#9233)\n - ci: optimize golangci-lint performance with cache-based strategy (#9173)\n - ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)\n - ci: remove unused preinstalled software/images for build tests to free up disk space. (#9814)\n - ci: skip undefined labels in discussion triage action (#9175)\n - ci: specify repository for `gh cache delete` in canary worklfow (#9240)\n - ci: update GitHub Actions cache to v4 (#8475)\n - ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)\n - ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)\n - ci: use environment variables in GitHub Actions for improved security (#9433)\n - ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)\n - ci: use merge commit for apidiff to avoid false positives (#9622)\n - ci: use pull_request_target for apidiff workflow to support fork PRs (#9605)\n - docs(cli): improve flag value display format (#8560)\n - docs(java):  Update info about dev deps in gradle lock (#8830)\n - docs(java): add info about supported scopes (#7842)\n - docs(k8s): add a note about multi-container pods (#7815)\n - docs(misconf): Remove duplicate sections (#9819)\n - docs(misconf): Reorganize misconfiguration scan pages (#8206)\n - docs(misconf): simplify misconfiguration docs (#9030)\n - docs(python): Mention pip-compile (#8484)\n - docs(python): fix type with METADATA file name (#9090)\n - docs(report): Improve SARIF reporting doc (#7655)\n - docs(report): add nuanses about secret/license scanner in summary table (#9442)\n - docs(report): fix reporting doc format (#7671)\n - docs(server): fix info about scanning licenses on the client side. (#9805)\n - docs(vex): use debian minor version in examples (#8166)\n - docs(vuln): remove OSV for Python from data sources (#8841)\n - docs: Add info about helm charts release (#8640)\n - docs: Fix broken link to \"Built-in Checks\" (#9375)\n - docs: Fix broken links (#7900)\n - docs: Fix typo in terraform docs (#9492)\n - docs: Fix typos and linguistic errors in documentation / hacktoberfest (#9586)\n - docs: Fix typos in documentation (#8361)\n - docs: Update maintainer docs (#8674)\n - docs: Updated JSON schema version 2 in the trivy documentation (#8188)\n - docs: add Headlamp to the Trivy Ecosystem page (#7916)\n - docs: add PR review policy for maintainers (#9032)\n - docs: add Windows install instructions (#7800)\n - docs: add `overview` page for `others` (#7972)\n - docs: add abbreviation list (#8453)\n - docs: add commercial content (#8030)\n - docs: add example of creating whitelist of checks (#7821)\n - docs: add explanation for how to use non-system certificates (#9081)\n - docs: add info about `java-db` subdir (#9706)\n - docs: add info that `SSL_CERT_FILE` works on `Unix systems other than macOS` only (#9772)\n - docs: add note about disabled DS016 check (#7724)\n - docs: add note about temporary podman socket (#7921)\n - docs: add partners page (#8988)\n - docs: add section on customizing default check data (#9114)\n - docs: add terminology page to explain Trivy concepts (#7996)\n - docs: add vulnerability database contribution guide (#9667)\n - docs: apt-transport-https is a transitional package (#7678)\n - docs: bump pygments from 2.18.0 to 2.19.2 (#9596)\n - docs: catch some missed docs -\u003e guide (#9850)\n - docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)\n - docs: change SecObserve URLs in documentatio (#9771)\n - docs: change in java.md: fix the Trity -to-\u003e Trivy typo (#8813)\n - docs: clarify inline ignore limitations for resource-less checks (#9537)\n - docs: combine trivy.dev into trivy docs (#7884)\n - docs: correct Ruby documentation (#8402)\n - docs: document eol supportability (#9434)\n - docs: drop AWS account scanning (#7997)\n - docs: fix a broken link (#8546)\n - docs: fix assets with versioning (#8996)\n - docs: fix dead links (#7998)\n - docs: fix mistakes/typos (#7942)\n - docs: fix modules path and update code example (#9539)\n - docs: fix navigate links (#8336)\n - docs: improve databases documentation (#7732)\n - docs: improve documentation for scanning raw IaC configurations (#9571)\n - docs: improve skipping files documentation (#8749)\n - docs: move info about `detection priority` into coverage section (#9469)\n - docs: partners page content updates (#9149)\n - docs: remove slack (#8565)\n - docs: replace short codes with Unicode emojis (#8296)\n - docs: restructure docs for new hosting (#9799)\n - docs: trivy partners page updates (#9133)\n - docs: update VEX documentation index page (#8458)\n - docs: update links to Semaphore pages (#9352)\n - docs: update vulnerability reporting guidelines in SECURITY.md (#9395)\n - feat(alma): add AlmaLinux 10 support (#9207)\n - feat(alpine): add maintainer field extraction for APK packages (#8930)\n - feat(aws): Add support for dualstack ECR endpoints (#9862)\n - feat(cli): Add available version checking (#8553)\n - feat(cli): Add trivy cloud suppport (#9637)\n - feat(cli): add `trivy auth` (#7664)\n - feat(cli): add version constraints to annoucements (#9023)\n - feat(cli): change --list-all-pkgs default to true (#9510)\n - feat(cli): error out when ignore file cannot be found (#7624)\n - feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n - feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)\n - feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)\n - feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n - feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)\n - feat(db): append errors (#7843)\n - feat(db): enable concurrent access to vulnerability database (#9750)\n - feat(dotnet): add dependency graph support for .deps.json files (#9726)\n - feat(echo): Add Echo Support (#8833)\n - feat(flag): add `--cacert` flag (#9781)\n - feat(flag): add schema validation for `--server` flag (#9270)\n - feat(fs): change artifact type to repository when git info is detected (#9613)\n - feat(fs): optimize scanning performance by direct file access for known paths (#8525)\n - feat(fs): use git commit hash as cache key for clean repositories (#8278)\n - feat(go): construct dependencies in the parser (#7973)\n - feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n - feat(go): fix parsing main module version for go \u003e= 1.24 (#8433)\n - feat(go): support license scanning in both GOPATH and vendor (#8843)\n - feat(image): add Docker context resolution (#9166)\n - feat(image): add RepoTags support for Docker archives (#9690)\n - feat(image): add Sigstore bundle SBOM support (#9516)\n - feat(image): pass global context to docker/podman image save func (#9733)\n - feat(image): prevent scanning oversized container images (#8178)\n - feat(image): return error early if total size of layers exceeds limit (#8294)\n - feat(image): save layers metadata into report (#8394)\n - feat(java): add support remote repositories from settings.xml files (#9708)\n - feat(java): dereference all maven settings.xml env placeholders (#9024)\n - feat(k8s): add default commands for unknown platform (#7863)\n - feat(k8s): add support for controllers (#8614)\n - feat(k8s): get components from namespaced resources (#8918)\n - feat(k8s): improve artifact selections for specific namespaces (#8248)\n - feat(license): Support compound licenses (licenses using SPDX operators) (#8816)\n - feat(license): improve work text licenses with custom classification (#8888)\n - feat(license): improve work with custom classification of licenses from config file (#8861)\n - feat(license): observe pkg types option in license scanner (#9091)\n - feat(license): scan vendor directory for license for go.mod files (#8689)\n - feat(license): use separate SPDX ids to ignore SPDX expressions (#9087)\n - feat(minimos): Add support for MinimOS (#8792)\n - feat(misconf): Add RoleAssignments attribute (#9396)\n - feat(misconf): Add support for `Minimum Trivy Version` (#8880)\n - feat(misconf): Add support for aws_ami (#8499)\n - feat(misconf): Add support for configurable Rego error limit (#9657)\n - feat(misconf): Show misconfig ID in output (#7762)\n - feat(misconf): Update AppService schema (#9792)\n - feat(misconf): Update Azure Compute schema (#9675)\n - feat(misconf): Update Azure Container Schema (#9673)\n - feat(misconf): Update Azure network schema for new checks (#9791)\n - feat(misconf): Update SecurityCenter schema (#9674)\n - feat(misconf): Update azure storage schema (#9728)\n - feat(misconf): adapt AWS::DynamoDB::Table (#8529)\n - feat(misconf): adapt AWS::EC2::VPC (#8534)\n - feat(misconf): adapt aws_default_security_group (#8538)\n - feat(misconf): adapt aws_opensearch_domain (#8550)\n - feat(misconf): add OpenTofu file extension support (#8747)\n - feat(misconf): add agentpools to azure container schema (#9714)\n - feat(misconf): add misconfiguration location to junit template (#8793)\n - feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)\n - feat(misconf): add private ip google access attribute to subnetwork (#9199)\n - feat(misconf): added audit config attribute (#9249)\n - feat(misconf): added logging and versioning to the gcp storage bucket (#9226)\n - feat(misconf): convert AWS managed policy to document (#8757)\n - feat(misconf): export raw Terraform data to Rego (#8741)\n - feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n - feat(misconf): generate placeholders for random provider resources (#8051)\n - feat(misconf): include map key in manifest snippet for diagnostics (#9681)\n - feat(misconf): log causes of HCL file parsing errors (#7634)\n - feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)\n - feat(misconf): public network support for Azure Storage Account (#7601)\n - feat(misconf): render causes for Terraform (#8360)\n - feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n - feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)\n - feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)\n - feat(misconf): support for ignoring by inline comments for Helm (#8138)\n - feat(misconf): support https_traffic_only_enabled in Az storage account (#9784)\n - feat(nodejs): add a bun.lock analyzer (#8897)\n - feat(nodejs): add bun.lock parser (#8851)\n - feat(nodejs): add root and workspace for `yarn` packages (#8535)\n - feat(nodejs): respect peer dependencies for dependency tree (#7989)\n - feat(oracle): add `flavors` support (#7858)\n - feat(parser): ignore white space in pom.xml files (#7747)\n - feat(python): add support for poetry dev dependencies (#8152)\n - feat(python): add support for uv (#8080)\n - feat(python): add support for uv dev and optional dependencies (#8134)\n - feat(redhat): Add EOL date for RHEL 10. (#8910)\n - feat(redhat): add os-release detection for RHEL-based images (#9458)\n - feat(repo): add git repository metadata to reports (#9252)\n - feat(report): add CVSS vectors in sarif report (#9157)\n - feat(report): add fingerprint generation for vulnerabilities (#9794)\n - feat(report): add image reference to report metadata (#9729)\n - feat(report): switch ReportID from UUIDv4 to UUIDv7 (#9749)\n - feat(report): update gitlab template to populate operating_system value (#7735)\n - feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)\n - feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)\n - feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)\n - feat(sbom): add support for SPDX attestations (#9829)\n - feat(sbom): added support for CoreOS (#9448)\n - feat(sbom): use SPDX license IDs list to validate SPDX IDs  (#9569)\n - feat(seal): add seal support (#9370)\n - feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n - feat(secret): implement streaming secret scanner with byte offset tracking (#9264)\n - feat(suse): Add new openSUSE, Micro and SLES releases end of life dates (#9788)\n - feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n - feat(terraform): add partial evaluation for policy templates (#8967)\n - feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)\n - feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)\n - feat(ubuntu): add eol date for 20.04-ESM (#8981)\n - feat(vuln): add Root.io support for container image scanning (#9073)\n - feat: Update registry fallbacks (#7679)\n - feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n - feat: add ArtifactID field to uniquely identify scan targets (#9663)\n - feat: add Bottlerocket OS package analyzer (#8653)\n - feat: add HTTP request/response tracing support (#9125)\n - feat: add JSONC support for comments and trailing commas (#8862)\n - feat: add ReportID field to scan reports (#9670)\n - feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)\n - feat: add `--vuln-severity-source` flag (#8269)\n - feat: add `workspaceRelationship` (#7889)\n - feat: add a examples field to check metadata (#8068)\n - feat: add cvss v4 score and vector in scan response (#7968)\n - feat: add documentation URL for database lock errors (#9531)\n - feat: add end of life date for Ubuntu 24.10 (#7787)\n - feat: add graceful shutdown with signal handling (#9242)\n - feat: add report summary table (#8177)\n - feat: add support for registry mirrors (#8244)\n - feat: add timeout handling for cache database operations (#9307)\n - feat: allow ignoring findings by type in Rego (#9578)\n - feat: include registry and repository in artifact ID calculation (#9689)\n - feat: reject unsupported artifact types in remote image retrieval (#9052)\n - feat: replace TinyGo with standard Go for WebAssembly modules (#8496)\n - feat: terraform parser option to set current working directory (#8909)\n - fix(alma): parse epochs from rpmqa file (#9101)\n - fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)\n - fix(alpine): add `UID` for removed packages (#7887)\n - fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n - fix(aws): update amazon linux 2 EOL date (#9176)\n - fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)\n - fix(cli): Add more non-sensitive flags to telemetry (#9110)\n - fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)\n - fix(cli): Handle empty ignore files more gracefully (#7962)\n - fix(cli): `clean --all` deletes only relevant dirs (#7704)\n - fix(cli): add config name to skip-policy-update alias (#7820)\n - fix(cli): add some values to the telemetry call (#9056)\n - fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)\n - fix(cli): don't use allow values for `--compliance` flag (#8881)\n - fix(cli): ensure correct command is picked by telemetry (#9260)\n - fix(cli): panic: attempt to get os.Args[1] when len(os.Args) \u003c 2 (#9206)\n - fix(conda): memory leak by adding closure method for `package.json` file (#9349)\n - fix(cyclonedx): handle multiple license types (#9378)\n - fix(db): Dowload database when missing but metadata still exists (#9393)\n - fix(db): fix case when 2 trivy-db were copied at the same time (#8452)\n - fix(db): fix javadb downloading error handling (#7642)\n - fix(debian): don't include empty licenses for `dpkgs` (#8623)\n - fix(debian): infinite loop (#7928)\n - fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)\n - fix(flag): remove viper.SetDefault to fix IsSet() for config-only flags (#9732)\n - fix(flag): skip hidden flags for `--generate-default-config` command (#8046)\n - fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n - fix(fs): avoid shadowing errors in file.glob (#9286)\n - fix(fs): check postAnalyzers for StaticPaths (#8543)\n - fix(fs): fix cache key generation to use UUID (#8275)\n - fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n - fix(go): merge nested flags into string for ldflags for Go binaries (#8368)\n - fix(helm): properly handle multiple archived dependencies (#7782)\n - fix(image): disable AVD-DS-0007 for history scanning (#8366)\n - fix(image): use standardized HTTP client for ECR authentication (#9322)\n - fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n - fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)\n - fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n - fix(java): exclude dev dependencies in gradle lockfile (#8803)\n - fix(java): update order for resolving package fields from multiple demManagement (#9575)\n - fix(java): use `true` as default value for Repository Release|Snapshot Enabled in pom.xml and settings.xml files (#9751)\n - fix(julia): add `Relationship` field support (#8939)\n - fix(k8s)!: support k8s multi container (#7444)\n - fix(k8s): add missed option `PkgRelationships` (#8442)\n - fix(k8s): check all results for vulnerabilities (#7946)\n - fix(k8s): correct compare artifact versions (#8682)\n - fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)\n - fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)\n - fix(k8s): remove using `last-applied-configuration` (#8791)\n - fix(k8s): show report for `--report all` (#8613)\n - fix(k8s): skip passed misconfigs for the summary report (#8684)\n - fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)\n - fix(k8s): skip resources without misconfigs (#7797)\n - fix(k8s): support kubernetes v1.31 (#7810)\n - fix(k8s): use in-memory cache backend during misconfig scanning (#8873)\n - fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)\n - fix(license): always trim leading and trailing spaces for licenses (#8095)\n - fix(license): don't normalize `unlicensed` licenses into `unlicense` (#9611)\n - fix(license): fix license normalization for Universal Permissive License (#7766)\n - fix(license): handle SPDX WITH exceptions as single license in category detection (#9380)\n - fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)\n - fix(misconf): .Config.User always takes precedence over USER in .History (#9050)\n - fix(misconf): Check values wholly prior to evalution (#8604)\n - fix(misconf): Improve logging for unsupported checks (#8634)\n - fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n - fix(misconf): add ephemeral block type to config schema (#8513)\n - fix(misconf): add missing variable as unknown (#8683)\n - fix(misconf): allow null values only for tf variables (#8112)\n - fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n - fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n - fix(misconf): check if for-each is known when expanding dyn block (#8808)\n - fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)\n - fix(misconf): check if metadata is not nil (#8647)\n - fix(misconf): check if property is not nil before conversion (#7578)\n - fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)\n - fix(misconf): correctly adapt azure storage account (#9138)\n - fix(misconf): correctly handle all YAML tags in K8S templates (#8259)\n - fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)\n - fix(misconf): disable git terminal prompt on tf module load (#8026)\n - fix(misconf): do not erase variable type for child modules (#7941)\n - fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)\n - fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)\n - fix(misconf): do not skip loading documents from subdirectories (#8526)\n - fix(misconf): do not use cty.NilVal for non-nil values (#8567)\n - fix(misconf): ecs include enhanced for container insights (#8326)\n - fix(misconf): ensure boolean metadata values are correctly interpreted (#9770)\n - fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)\n - fix(misconf): ensure module source is known (#9404)\n - fix(misconf): ensure value used as ignore marker is non-null and known (#9835)\n - fix(misconf): filter null nodes when parsing json manifest (#8785)\n - fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n - fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)\n - fix(misconf): fix log bucket in schema (#9235)\n - fix(misconf): handle heredocs in dockerfile instructions (#8284)\n - fix(misconf): handle null properties in CloudFormation templates (#7813)\n - fix(misconf): handle tofu files in module detection (#9486)\n - fix(misconf): handle unsupported experimental flags in Dockerfile (#9769)\n - fix(misconf): identify the chart file exactly by name (#8590)\n - fix(misconf): load full Terraform module (#7925)\n - fix(misconf): map healthcheck start period flag to --start-period instead of --startPeriod (#9837)\n - fix(misconf): move disabled checks filtering after analyzer scan (#9002)\n - fix(misconf): perform operations on attribute safely (#8774)\n - fix(misconf): populate context correctly for module instances (#8656)\n - fix(misconf): preserve original paths of remote submodules from .terraform (#9294)\n - fix(misconf): properly expand dynamic blocks (#7612)\n - fix(misconf): properly resolve local Terraform cache (#7983)\n - fix(misconf): reduce log noise on incompatible check (#9029)\n - fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)\n - fix(misconf): skip Azure CreateUiDefinition (#8503)\n - fix(misconf): skip rewriting expr if attr is nil (#9113)\n - fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)\n - fix(misconf): strip build metadata suffixes from image history (#9498)\n - fix(misconf): unmark cty values before access (#9495)\n - fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)\n - fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)\n - fix(misconf): use log instead of fmt for logging (#8033)\n - fix(misconf): wrap AWS EnvVar to iac types (#7407)\n - fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)\n - fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)\n - fix(nodejs): don't use prerelease logic for compare npm constraints  (#9208)\n - fix(nodejs): fix npmjs parser.pkgNameFromPath() panic issue (#9688)\n - fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)\n - fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)\n - fix(nodejs): use the default ID format to match licenses in pnpm packages. (#9661)\n - fix(oracle): add architectures support for advisories (#4809)\n - fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n - fix(os): Add photon 5.0 in supported OS (#9724)\n - fix(os): add mapping OS aliases (#8466)\n - fix(plugin): don't remove plugins when updating index.yaml file (#9358)\n - fix(python): add `poetry` v2 support (#8323)\n - fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)\n - fix(python): impove package name normalization  (#9290)\n - fix(python): skip dev group's deps for poetry (#8106)\n - fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n - fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)\n - fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)\n - fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)\n - fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n - fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n - fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n - fix(redhat): include arch in PURL qualifiers (#7654)\n - fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n - fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)\n - fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)\n - fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)\n - fix(repo): `git clone` output to Stderr (#7561)\n - fix(repo): preserve RepoMetadata on FS cache hit (#9389)\n - fix(repo): sanitize git repo URL before inserting into report metadata (#9391)\n - fix(report): Fix invalid URI in SARIF report (#7645)\n - fix(report): clean buffer after flushing (#8725)\n - fix(report): correct field order in SARIF license results (#9712)\n - fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)\n - fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n - fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)\n - fix(rootio): check full version to detect `root.io` packages (#9117)\n - fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)\n - fix(rootio): fix severity selection (#9181)\n - fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n - fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n - fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)\n - fix(sbom): add `buildInfo` info as properties (#9683)\n - fix(sbom): add options for DBs in private registries (#7660)\n - fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n - fix(sbom): add support for `file` component type of `CycloneDX` (#9372)\n - fix(sbom): attach nested packages to Application (#8144)\n - fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n - fix(sbom): don’t panic on SBOM format if scanned CycloneDX file has empty metadata (#9562)\n - fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)\n - fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n - fix(sbom): improve logic for binding direct dependency to parent component (#8489)\n - fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)\n - fix(sbom): preserve OS packages from multiple SBOMs (#8325)\n - fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)\n - fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)\n - fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)\n - fix(sbom): use correct field for licenses in CycloneDX reports (#9057)\n - fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)\n - fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n - fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)\n - fix(secret): fix line numbers for multiple-line secrets (#9104)\n - fix(secret): ignore .dist-info directories during secret scanning (#8646)\n - fix(server): add HTTP transport setup to server mode (#9217)\n - fix(server): add missed Relationship field for `rpc` (#8872)\n - fix(server): fix redis key when trying to delete blob (#8649)\n - fix(server): secrets inspectation for the config analyzer in client server mode (#8418)\n - fix(spdx): init `pkgFilePaths` map for all formats (#8380)\n - fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)\n - fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)\n - fix(suse): SUSE - update OSType constants and references for compatility (#8236)\n - fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n - fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)\n - fix(terraform): `for_each` on a map returns a resource for every key (#9156)\n - fix(terraform): apply parser options to submodule parsing (#8377)\n - fix(terraform): hcl object expressions to return references (#8271)\n - fix(terraform): set null value as fallback for missing variables (#7669)\n - fix(vex): don't  suppress vulns for packages with infinity loop (#9465)\n - fix(vex): don't use reused BOM (#9604)\n - fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)\n - fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)\n - fix(vex): use a separate `visited` set for each DFS path (#9760)\n - fix(vuln): compare `nuget` package names in lower case (#9456)\n - fix(wolfi): support new APK database location (#8937)\n - fix: Add missing version check flags (#8951)\n - fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)\n - fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)\n - fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n - fix: Correctly check for semver versions for trivy version check (#8948)\n - fix: Improve version comparisons when build identifiers are present (#7873)\n - fix: Trim the end-of-range suffix (#9618)\n - fix: Updated twitter icon (#7772)\n - fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow (#9636)\n - fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)\n - fix: add `buildInfo` for `BlobInfo` in `rpc` package (#9608)\n - fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)\n - fix: also check `filepath` when removing duplicate packages (#9142)\n - fix: check post-analyzers for StaticPaths (#8904)\n - fix: close all opened resources if an error occurs (#9665)\n - fix: close file descriptors and pipes on error paths (#9536)\n - fix: create temp file under composite fs dir (#9387)\n - fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)\n - fix: don't show corrupted trivy-db warning for first run (#8991)\n - fix: don't use `scope` for `trivy registry login` command (#8393)\n - fix: early-return, indent-error-flow and superfluous-else rules from revive  (#8796)\n - fix: enable err-error and errorf rules from perfsprint linter (#7859)\n - fix: enable usestdlibvars linter (#7770)\n - fix: filter all files when processing files installed from package managers (#8842)\n - fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)\n - fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n - fix: improve conversion of image config to Dockerfile (#8308)\n - fix: julia parser panicing (#8883)\n - fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)\n - fix: more revive rules (#8814)\n - fix: octalLiteral from go-critic (#8811)\n - fix: persistent flag option typo (#9374)\n - fix: prevent graceful shutdown message on normal exit (#9244)\n - fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)\n - fix: restore compatibility for google.protobuf.Value (#9559)\n - fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)\n - fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)\n - fix: suppress debug log for context cancellation errors (#9298)\n - fix: testifylint last issues (#8768)\n - fix: unused-parameter rule from revive (#8794)\n - fix: update all documentation links (#8045)\n - fix: update all documentation links (#9777)\n - fix: update cosing settings for GoReleaser after bumping cosing to v3 (#9863)\n - fix: use `--file-patterns` flag for all post analyzers (#7365)\n - fix: use context for analyzers (#9538)\n - fix: use-any from revive (#8810)\n - fix: using SrcVersion instead of Version for echo detector (#9552)\n - fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)\n - fix: validate backport branch name (#9548)\n - fix: wasm module test (#8099)\n - perf(misconf): parse input for Rego once (#8483)\n - perf(misconf): retrieve check metadata from annotations once (#8478)\n - perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)\n - perf: avoid heap allocation in applier findPackage (#7883)\n - refactor(cli): Update the cloud config command (#9676)\n - refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)\n - refactor(db): change logic to detect wrong DB (#8864)\n - refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)\n - refactor(flag): improve flag system architecture and extensibility (#8718)\n - refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)\n - refactor(k8s): add v prefix for Go packages (#7839)\n - refactor(k8s): scan config files as a folder (#7690)\n - refactor(license): improve license expression normalization (#8257)\n - refactor(license): simplify compound license scanning (#8896)\n - refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n - refactor(misconf): Remove unused options (#7896)\n - refactor(misconf): Simplify misconfig checks bundle parsing (#8533)\n - refactor(misconf): add ID to scan.Rule (#9573)\n - refactor(misconf): add ManifestFromYAML for unified manifest parsing (#9680)\n - refactor(misconf): decouple input fs and track extracted files with fs references (#9281)\n - refactor(misconf): get a block or attribute without calling HasChild (#8586)\n - refactor(misconf): introduce generic scanner (#7515)\n - refactor(misconf): make Rego scanner independent of config type (#7517)\n - refactor(misconf): mark AVDID fields as deprecated and use ID internally (#9576)\n - refactor(misconf): migrate from custom Azure JSON parser (#9222)\n - refactor(misconf): parse azure_policy_enabled to addonprofile.azurepolicy.enabled (#9851)\n - refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)\n - refactor(misconf): remove unused methods for ec2.Instance (#8536)\n - refactor(misconf): remove unused methods from iac types (#8782)\n - refactor(misconf): remove unused methods from providers (#8781)\n - refactor(misconf): remove unused terraform attribute methods (#8657)\n - refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)\n - refactor(misconf): rewrite Rego module filtering using functional filters (#9061)\n - refactor(misconf): set Trivy version by default in Rego scanner (#9001)\n - refactor(misconf): simplify k8s scanner (#7717)\n - refactor(misconf): switch to x/json  (#8719)\n - refactor(misconf): type-safe parser results in generic scanner (#9685)\n - refactor(misconf): use OPA v1 (#8518)\n - refactor(misconf): use atomic.Int32 (#9385)\n - refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)\n - refactor(report): write tables after rendering all results (#8357)\n - refactor(sbom): simplify relationship generation (#7985)\n - refactor(secret): clarify secret scanner messages (#9409)\n - refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n - refactor(server): change custom advisory and vulnerability data types fr… (#8923)\n - refactor(terraform): make Scan method of Terraform plan scanner private (#9272)\n - refactor(terraform): remove result sorting from scanner (#8928)\n - refactor(terraform): simplify AllReferences method signature in Attribute (#8906)\n - refactor(ubuntu): update time handling for fixing time (#8780)\n - refactor(vex): improve SBOM reference handling with project standards (#8457)\n - refactor: add case-insensitive string set implementation (#9720)\n - refactor: add generic Set implementation (#8149)\n - refactor: add hook interface for extended functionality (#8585)\n - refactor: centralize HTTP transport configuration (#9058)\n - refactor: export `systemFileFiltering` Post Handler (#9359)\n - refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)\n - refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)\n - refactor: move the aws config (#9617)\n - refactor: remove aws flag helper message (#9080)\n - refactor: remove google/wire dependency and implement manual DI (#9509)\n - refactor: remove support for custom Terraform checks (#7901)\n - refactor: rename scanner to service (#8584)\n - refactor: simplify Detect function signature (#9280)\n - refactor: switch to stable azcontainerregistry SDK package (#9319)\n - refactor: use slices package instead of custom function (#8172)\n - refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)\n - refactor: use trivy-checks/pkg/specs package (#8226)\n - release: v0.56.2 [release/v0.56] (#7694)\n - release: v0.57.0 [main] (#7710)\n - release: v0.57.1 [release/v0.57] (#7943)\n - release: v0.58.0 [main] (#7874)\n - release: v0.58.1 [release/v0.58] (#8120)\n - release: v0.58.2 [release/v0.58] (#8216)\n - release: v0.59.0 [main] (#8041)\n - release: v0.59.1 [release/v0.59] (#8334)\n - release: v0.60.0 [main] (#8327)\n - release: v0.61.0 [main] (#8507)\n - release: v0.61.1 [release/v0.61] (#8704)\n - release: v0.62.0 [main] (#8669)\n - release: v0.62.1 [release/v0.62] (#8825)\n - release: v0.63.0 [main] (#8809)\n - release: v0.64.0 [main] (#8955)\n - release: v0.64.1 [release/v0.64] (#9122)\n - release: v0.65.0 [main] (#9108)\n - release: v0.66.0 [main] (#9289)\n - release: v0.67.0 [main] (#9432)\n - release: v0.67.1 [release/v0.67] (#9614)\n - release: v0.67.2 [release/v0.67] (#9639)\n - release: v0.68.0 [main] (#9549)\n - release: v0.68.1 [main] (#9867)\n - release: v0.68.2 [release/v0.68] (#9950)\n - style: Fix MD syntax in self-hosting.md (#8523)\n - test(go): refactor mod_test.go to use txtar format (#9775)\n - test(go): set `GOPATH` for tests (#9785)\n - test(helm): bump up Yamale dependency for Helm chart-testing-action (#9653)\n - test(k8s): update k8s integrtion test (#9725)\n - test(k8s): use a specific bundle for k8s misconfig scan (#9633)\n - test(misconf): drop gcp iam test covered by another case (#9285)\n - test(misconf): move terraform scan tests to integration tests (#9271)\n - test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)\n - test(server): replace mock driver with memory cache in server tests (#8416)\n - test: add HTTP basic authentication to git test server (#9407)\n - test: add end-to-end testing framework with image scan and proxy tests (#9231)\n - test: change branch in spdx schema link to check in integration tests (#7935)\n - test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n - test: define constants for test images (#7739)\n - test: improve and extend tests for iac/adapters/arm (#9028)\n - test: improve golden file management in integration tests (#9699)\n - test: include integration tests in linting and fix all issues (#9060)\n - test: replace Go checks with Rego (#7867)\n - test: replace mock with memory cache and fix non-deterministic tests (#8410)\n - test: replace mock with memory cache in scanner tests (#8413)\n - test: save `containerd` image into archive and use in tests (#7816)\n - test: set dummy value for NUGET_PACKAGES (#8107)\n - test: update golden files for TestRepository* integration tests (#9684)\n - test: use `aquasecurity` repository for test images (#8677)\n - test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)\n - test: use forked images (#7755)\n - test: use memory cache (#8403)\n - test: use table-driven tests in Helm scanner tests (#8592)\n","status":"published","published":"2026-02-13T16:33:52Z","modified":"2026-05-29T18:24:10.235720339Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20893-1","title":"Security update for cloudflared","description":"This update for cloudflared fixes the following issues:\n\nChanges in cloudflared:\n\n- Update version to 2026.5.2\n  * Add more information to proxy-dns removal message\n  * Update tail command to use /management/logs endpoint\n  * Add cloudflared management token command\n  * Fix bugs\n  * Update golang.org/x/net to 0.55.0 (boo#1266794, boo#1265920, CVE-2026-39821\n    CVE-2026-33814)\n\n- Update version to 2026.2.0\n  * Fix bugs\n\n- Update version to 2025.11.1\n  * bump coredns to solve CVE\n  * add vulncheck to cloudflared\n  * Remove references to cloudflare-go\n  * Add logging format as JSON\n  * Centralize UDP origin proxy dialing as ingress service\n  * Add virtual DNS service\n  * Add OriginDialerService to include TCP\n  * Add --dns-resolver-addrs flag\n  * Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences\n  * Bump go-boring from 1.24.2 to 1.24.4\n  * Add metrics for virtual DNS origin\n  * set proper url and hostname for cloudflared tail command\n  * Add support for login interstitial auto closure\n  * update fed callback url for login helper\n  * Correct QUIC connection management for datagram handlers\n  * Set endpoint in tunnel credentials when generating locally managed tunnel\n    with a Fed token\n  * Migrate cloudflared-ci pipelines to Gitlab CI\n  * Add support for FedRAMP in originRequest Access config\n  * Add buffers for UDP and ICMP datagrams in datagram v3\n  * Add write deadline for UDP origin writes\n  * Improve metrics for datagram v3\n  * Force usage of go-boring 1.24\n  * Fix import of GPG keys when two keys are provided\n  * Fix parameter order when uploading RPM .repo file to R2\n  * Add new datagram v3 feature flag\n  * Bump datagram v3 write channel capacity\n  * Fix upload of RPM repo file during double signing\n  * Fix the cloudflared binary path used in the component test\n  * Fix typo causing r2-release-next deployment to fail\n  * Update from go1.24.6 to go1.24.9\n  * Fix systemd service installation hanging\n  * Add cf-proxy-* to control response headers\n  * Add pipelines for linux packaging\n  * Prefix gitlab steps with operating system\n  * Fix docker hub push step\n  * Fix CVE-2025-58181 boo#1253918\n  * Fix CVE-2025-22869 boo#1239422\n\n- Update version to 2025.6.0\n  * Remove dynamic reloading of features for datagram v3\n  * Add metric for unsupported RPC commands for datagram v3\n  * Add dynamic loading of features to connections via ConnectionOptionsSnapshot\n  * Use is_default_network instead of is_default to create vnet's\n  * Update go to 1.24\n\n- Update version to 2025.4.2\n  * emit explicit errors for the service command on unsupported OSes\n  * Fix some issues\n\n- Update version to 2024.12.1\n  * TUN-8748: Migrated datagram V3 flows to use migrated context\n  * TUN-8737: update metrics server port selection\n  * TUN-8731: Implement diag/system endpoint\n  * TUN-8728: implement diag/tunnel endpoint\n  * TUN-8730: implement diag/configuration\n  * TUN-8735: add managed/local log collection\n  * TUN-8733: add log collection for docker\n  * TUN-8734: add log collection for kubernetes\n  * TUN-8640: Refactor ICMPRouter to support new ICMPResponders\n  * TUN-8729: implement network collection for diagnostic procedure\n  * TUN-8727: implement metrics, runtime, system, and tunnelstate in diagnostic\n    http client\n  * TUN-8726: implement compression routine to be used in diagnostic procedure\n  * TUN-8732: implement port selection algorithm\n  * TUN-8762: fix argument order when invoking tracert and modify network info\n    output parsing\n  * TUN-8769: fix k8s log collector arguments\n  * TUN-8727: extend client to include function to get cli configuration\n    and tunnel configuration\n  * TUN-8725: implement diagnostic procedure\n  * TUN-8767: include raw output from network collector in diagnostic zip file\n  * TUN-8770: add cli configuration and tunnel configuration to diagnostic zipfile\n  * TUN-8768: add job report to diagnostic zipfile\n  * TUN-8775: Make sure the session Close can only be called once\n  * TUN-8781: Add Trixie, drop Buster. Default to Bookworm\n  * TUN-8640: Add ICMP support for datagram V3\n  * TUN-8789: make python package installation consistent\n  * TUN-8795: update createrepo to createrepo_c to fix the release_pkgs.py\n    script\n- fix CVE-2024-45337 and boo#1234582\n\n- Update version to 2024.11.1\n  * Add cloudflared tunnel health command\n  * PPIP-2310: Update quick tunnel disclaimer\n  * TUN-8621: Prevent QUIC connection from closing before grace period\n    after unregistering\n  * TUN-8484: Print response when QuickTunnel can't be unmarshalled\n  * TUN-8592: Use metadata from the edge to determine if request body is\n    empty for QUIC transport\n  * TUN-8621: Fix cloudflared version in change notes to account for\n    release date\n  * TUN-8638: Add datagram v3 serializers and deserializers\n  * TUN-8685: Bump coredns dependency\n  * TUN-8688: Correct UDP bind for IPv6 edge connectivity on macOS\n  * TUN-8694: Fix github release script\n  * TUN-8694: Rework release script\n  * TUN-8661: Refactor connection methods to support future different\n    datagram muxing methods\n  * TUN-8692: remove dashes from session id\n  * TUN-8708: Bump python min version to 3.10\n  * TUN-8667: Add datagram v3 session manager\n  * TUN-8553: Bump go to 1.22.5 and go-boring 1.22.5-1\n  * TUN-8700: Add datagram v3 muxer\n  * TUN-8646: Allow experimental feature support for datagram v3\n  * TUN-8641: Expose methods to simplify V3 Datagram parsing on the edge\n  * VULN-66059: remove ssh server tests\n  * TUN-8709: Add session migration for datagram v3\n  * TUN-8701: Add metrics and adjust logs for datagram v3\n  * add: new go-fuzz targets\n  * TUN-8701: Simplify flow registration logs for datagram v3\n","status":"published","published":"2026-06-02T17:46:55Z","modified":"2026-06-04T09:00:05.940129575Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:20902-1","title":"Security update for keybase-client","description":"This update for keybase-client fixes the following issues:\n\nChanges in keybase-client:\n\n- golang.org/x/crypto/ssh: Fixed multiple issues:\n  CVE-2026-39827, CVE-2026-39834, CVE-2026-39828, CVE-2026-39829, CVE-2026-39831,\n  CVE-2026-42508, CVE-2026-39833, CVE-2026-39830, CVE-2026-39832, CVE-2026-46597,\n  CVE-2026-46598, CVE-2026-46595, CVE-2026-39835 (boo#1266158)\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels\n  allows for validation bypass and privilege escalation (boo#1266596).\n\n- Update to version 6.6.2\n  * Improve git default branch handling\n\n- CVE-2026-33809: golang.org/x/image/tiff: excessive resource consumption due to\n  large allocation attempt when decoding maliciously crafted TIFF file (bsc#1260696)\n- Switch to go1.25 as required by update go image library.\n\n- Update to version 6.6.0\n  * Various bug fixes and performance improvements\n\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult\n  can produce invalid results and lead to undefined behavior (bsc#1258591).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic\n  due to an out of bounds read (bsc#1254023).\n- CVE-2025-58181: keybase-client: golang.org/x/crypto/ssh: invalidated number of mechanisms\n  can cause unbounded memory consumption (bsc#1253864).\n- CVE-2025-47913: keybase-client: golang.org/x/crypto/ssh/agent: client process termination\n  when receiving an unexpected message type in response to a key listing or signing request (bsc#1253563).\n\n- Update to version 6.5.1\n  * Fix team deletion not working\n  * Chat attachments improvements\n  * Miscellaneous bugfixes\n","status":"published","published":"2026-06-03T17:44:01Z","modified":"2026-06-06T18:24:23.494336976Z","updated_at":"2026-11-02T16:58:41.885092Z"}]},"sources_more":{"osv":35}}