Event type spoofing via UntrustedType in github.com/google/go-eventlog
Go github.com/google/go-eventlog · Upgrade to 0.0.3-0.20261001001437-1991f15bc4b0 (pre-release) or later · < 0.0.3-0.20261001001437-1991f15bc4b0
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–6 of 6 matching · newest first
Go github.com/google/go-eventlog · Upgrade to 0.0.3-0.20261001001437-1991f15bc4b0 (pre-release) or later · < 0.0.3-0.20261001001437-1991f15bc4b0
npm filecoin-pin · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2026-62300 · GHSA-m5ph-mmg5-6w5h · amended
PyPI banks · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-61536 · GHSA-64vx-6h2c-rjh7 · amended
Go github.com/chainguard-dev/kaniko · Upgrade to 1.25.20 or later · < 1.25.20 · CVE-2026-105769 · GHSA-5q7h-w9jf-cx97 · amended
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260626085133-7cb96ac80a6d (pre-release) or later · >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d · CVE-2026-12411 · GHSA-hhf9-qw4v-72xp · amended
crates.io rmcp · Upgrade to 3.9.0 or later · >= 0.2.0, < 3.9.0 · GHSA-c9f9-cp8h-jcj5
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.