Remote exploitation of a design error vulnerability in Golang's Go could allow an attacker to conduct unspecified attacks on the targeted host.


The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20058-1 advisory.

    Changes in go-sendxmpp:

    - Update to 0.15.1:
      Added
      * Add XEP-0359 Origin-ID to messages (requires go-xmpp >= v0.2.18).
      Changed
      * HTTP upload: Ignore timeouts on disco IQs as some components do         not reply.
    - Upgrades the embedded golang.org/x/net to 0.46.0
      * Fixes: bsc#1251461, CVE-2025-47911: various algorithms with         quadratic complexity when parsing HTML documents
      * Fixes: bsc#1251677, CVE-2025-58190: excessive memory consumption         by 'html.ParseFragment' when processing specially crafted input

    - Update to 0.15.0:
      Added:
      * Add flag --verbose to show debug information.
      * Add flag --recipients to specify recipients by file.
      * Add flag --retry-connect to try after a waiting time if the connection fails.
      * Add flag --retry-connect-max to specify the amount of retry attempts.
      * Add flag --legacy-pgp for using XEP-0027 PGP encryption with Ox keys.
      * Add support for punycode domains.
      Changed:
      * Update gopenpgp library to v3.
      * Improve error detection for MUC joins.
      * Don't try to connect to other SRV record targets if error contains 'auth-failure'.
      * Remove support for old SSDP version (via go-xmpp v0.2.15).
      * Http-upload: Stop checking other disco items after finding upload component.
      * Increase default TLS version to 1.3.
    - bsc#1241814 (CVE-2025-22872): This update includes golang.org/x/net/html 0.43.0

    - Update to 0.14.1:
      * Use prettier date format for error messages.
      * Update XEP-0474 to version 0.4.0 (requires go-xmpp >= 0.2.10).

    - Update to 0.14.0:
      Added:
      * Add --fast-invalidate to allow invalidating the FAST token.
      Changed:
      * Don't create legacy Ox private key directory in ~/.local/share/go-sendxmpp/oxprivkeys.
      * Delete legacy Ox private key directory if it's empty.
      * Show proper error if saved FAST mechanism isn't usable with current TLS version (requires go-xmpp >=     0.2.9).
      * Print debug output to stdout, not stderr (requires go-xmpp >= 0.2.9).
      * Show RECV: and SEND: prefix for debug output (requires go-xmpp >= 0.2.9).
      * Delete stored fast token if --fast-invalidate and --fast-off are set.
      * Show error when FAST creds are stored but non-FAST mechanism is requested.

    - Update to 0.13.0:
      Added:
      * Add --anonymous to support anonymous authentication (requires go-xmpp >= 0.2.8).
      * Add XEP-0480: SASL Upgrade Tasks support (requires go-xmpp >= 0.2.8).
      * Add support for see-other-host stream error (requires go-xmpp >= 0.2.8).
      Changed:
      * Don't automatically try other auth mechanisms if FAST authentication fails.

    - Update to 0.12.1:
      Changed:
      * Print error instead of quitting if a message of type error is received.
      * Allow upload of multiple files.
      Added:
      * Add flag --suppress-root-warning to suppress the warning when go-sendxmpp is used by the root user.

    - Update to 0.12.0:
      Added:
      * Add possibility to look up direct TLS connection endpoint via hostmeta2 (requires xmppsrv >= 0.3.3).
      * Add flag --allow-plain to allow PLAIN authentication (requires go-xmpp >= 0.2.5).
      Changed:
      * Disable PLAIN authentication per default.
      * Disable PLAIN authentication after first use of a SCRAM auth mechanism (overrides --allow-plain)     (requires         go-xmpp >= 0.2.5).

    - Update to 0.11.4:
      * Fix bug in SCRAM-SHA-256-PLUS (via go-xmpp >= 0.2.4).

    - Update to 0.11.3:
      * Add go-xmpp library version to --version output (requires go-xmpp >= 0.2.2).
      * Fix XEP-0474: SASL SCRAM Downgrade Protection hash calculation bug (via go-xmpp >= v0.2.3).
      * [gocritic]: Improve code quality.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20044-1 advisory.

    Upgrade to version 1.12.1.


    Security issues fixed:

    - CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML     documents       (bsc#1251509).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251716).
    - CVE-2025-47913: golang.org/x/crypto: early client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253609).

    Other updates and bugfixes:

    - Version 1.12.1:
      * Bugfixes
        - update to Beyla 2.7.10.

    - Version 1.12.0:
      * Breaking changes
        - `prometheus.exporter.blackbox`, `prometheus.exporter.snmp` and `prometheus.exporter.statsd` now use     the component           ID instead of the hostname as their instance label in their exported metrics.
      * Features
        - (Experimental) Add an `otelcol.receiver.cloudflare` component to receive logs pushed by Cloudflare's     LogPush           jobs.
        - (Experimental) Additions to experimental `database_observability.mysql` component:
          - `explain_plans`
            - collector now changes schema before returning the connection to the pool.
            - collector now passes queries more permissively.
          - enable `explain_plans` collector by default
        - (Experimental) Additions to experimental `database_observability.postgres` component:
          - `explain_plans`
            - added the explain plan collector.
            - collector now passes queries more permissively.
          - `query_samples`
            - add user field to wait events within `query_samples` collector.
            - rework the query samples collector to buffer per-query execution state across scrapes and emit     finalized               entries.
            - process turned idle rows to calculate finalization times precisely and emit first seen idle     rows.
          - `query_details`
            - escape queries coming from `pg_stat_statements` with quotes.
          - enable `explain_plans` collector by default.
          - safely generate `server_id` when UDP socket used for database connection.
          - add table registry and include validated in parsed table name logs.
        - Add `otelcol.exporter.googlecloudpubsub` community component to export metrics, traces, and logs to     Google Cloud           Pub/Sub topic.
        - Add `structured_metadata_drop` stage for `loki.process` to filter structured metadata.
        - Send remote config status to the remote server for the `remotecfg` service.
        - Send effective config to the remote server for the `remotecfg` service.
        - Add a `stat_statements` configuration block to the `prometheus.exporter.postgres` component to     enable selecting           both the query ID and the full SQL statement. The new block includes one option to enable statement     selection,           and another to configure the maximum length of the statement text.
        - Add truncate stage for `loki.process` to truncate log entries, label values, and     `structured_metadata` values.
        - Add `u_probe_links` & `load_probe` configuration fields to alloy `pyroscope.ebpf` to extend     configuration of           the `opentelemetry-ebpf-profiler` to allow uprobe profiling and dynamic probing.
        - Add `verbose_mode` configuration fields to `alloy pyroscope.ebpf` to be enable `ebpf-profiler`     verbose mode.
        - Add `file_match` block to `loki.source.file` for built-in file discovery using glob patterns.
        - Add a regex argument to the `structured_metadata` stage in `loki.process` to extract labels matching     a regular           expression.
        - OpenTelemetry Collector dependencies upgraded from v0.134.0 to v0.139.0.
          - See the upstream             [core](https://github.com/open-telemetry/opentelemetry-collector/blob/v0.139.0/CHANGELOG.md)             and             [contrib](https://github.com/open-telemetry/opentelemetry-collector-     contrib/blob/v0.139.0/CHANGELOG.md)             changelogs for more details.
        - A new `mimir.alerts.kubernetes` component which discovers AlertmanagerConfig Kubernetes resources     and loads them           into a Mimir instance.
        - Mark `stage.windowsevent` block in the `loki.process` component as GA.
      * Enhancements
        - Add per-application rate limiting with the strategy attribute in the `faro.receiver` component, to     prevent one           application from consuming the rate limit quota of others.
        - Add support of tls in components `loki.source.(awsfirehose|gcplog|heroku|api)` and     `prometheus.receive_http` and           `pyroscope.receive_http`.
        - Remove `SendSIGKILL=no` from unit files and recommendations.
        - Reduce memory overhead of `prometheus.remote_write`'s WAL by lowering the size of the allocated     series storage.
        - Reduce lock wait/contention on the `labelstore.LabelStore` by removing unecessary usage from           `prometheus.relabel`.
        - `prometheus.exporter.postgres` dependency has been updated to v0.18.1.
        - Update Beyla component to 2.7.8.
        - Support delimiters in `stage.luhn`.
        - `pyroscope.java`: update `async-profiler` to 4.2.
        - `prometheus.exporter.unix`: Add an arp config block to configure the ARP collector.
        - `prometheus.exporter.snowflake` dependency has been updated to 20251016132346-6d442402afb2.
        - `loki.source.podlogs` now supports `preserve_discovered_labels` parameter to preserve discovered pod     metadata           labels for use by downstream components.
        - Rework underlying framework of Alloy UI to use Vite instead of Create React App.
        - Use POST requests for remote config requests to avoid hitting http2 header limits.
        - `loki.source.api` during component shutdown will now reject all the inflight requests with status     code 503 after           `graceful_shutdown_timeout` has expired.
        - `kubernetes.discovery`: Add support for attaching namespace metadata.
        - Add `meta_cache_address` to `beyla.ebpf` component.
      * Bugfixes
        - Stop `loki.source.kubernetes` discarding log lines with duplicate timestamps.
        - Fix direction of arrows for pyroscope components in UI graph.
        - Only log EOF errors for syslog port investigations in `loki.source.syslog` as Debug, not Warn.
        - Fix `prometheus.exporter.process` ignoring the `remove_empty_groups` argument.
        - Fix issues with unknown series ref when trying to add exemplar from `prometheus.remote_write` by     allowing           series ref links to be updated if they change.
        - Fix `loki.source.podlogs` component to register the Kubernetes field index for `spec.nodeName` when     node           filtering is enabled, preventing Index with name `field:spec.nodeName` does not exist errors.
        - Fix issue in `loki.source.file` where scheduling files could take too long.
        - Fix `loki.write` no longer includes internal labels __.
        - Fix missing native histograms custom buckets (NHCB) samples from `prometheus.remote_write`.
        - `otelcol.receiver.prometheus` now supports mixed histograms if `prometheus.scrape` has     `honor_metadata` set to           true.
        - `loki.source.file` has better support for non-UTF-8 encoded files.
        - Fix the `loki.write` endpoint block's `enable_http2` attribute to actually affect the client.
        - Optionally remove trailing newlines before appending entries in `stage.multiline`.
        - `loki.source.api` no longer drops request when relabel rules drops a specific stream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-openSUSE-RU-2026:20010-1 advisory.

    - Update to version 0.68.2:
      * release: v0.68.2 [release/v0.68] (#9950)
      * fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)
      * ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0028-1 advisory.

    Upgrade to version 1.12.1.

    Security issues fixed:

    - CVE-2025-47911: golang.org/x/net/html: quadratic complexity algorithms used when parsing untrusted HTML     documents       (bsc#1251509).
    - CVE-2025-47913: golang.org/x/crypto: early client process termination when receiving an unexpected     message type in       response to a key listing or signing request (bsc#1253609).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251716).

    Other updates and bugfixes:

    - Version 1.12.1:
      * Bugfixes
        - update to Beyla 2.7.10.

    - Version 1.12.0:
      * Breaking changes
        - `prometheus.exporter.blackbox`, `prometheus.exporter.snmp` and `prometheus.exporter.statsd` now use     the component           ID instead of the hostname as their instance label in their exported metrics.
      * Features
        - (Experimental) Add an `otelcol.receiver.cloudflare` component to receive logs pushed by Cloudflare's     LogPush           jobs.
        - (Experimental) Additions to experimental `database_observability.mysql` component:
          - `explain_plans`
            - collector now changes schema before returning the connection to the pool.
            - collector now passes queries more permissively.
          - enable `explain_plans` collector by default
        - (Experimental) Additions to experimental `database_observability.postgres` component:
          - `explain_plans`
            - added the explain plan collector.
            - collector now passes queries more permissively.
          - `query_samples`
            - add user field to wait events within `query_samples` collector.
            - rework the query samples collector to buffer per-query execution state across scrapes and emit     finalized               entries.
            - process turned idle rows to calculate finalization times precisely and emit first seen idle     rows.
          - `query_details`
            - escape queries coming from `pg_stat_statements` with quotes.
          - enable `explain_plans` collector by default.
          - safely generate `server_id` when UDP socket used for database connection.
          - add table registry and include 'validated' in parsed table name logs.
        - Add `otelcol.exporter.googlecloudpubsub` community component to export metrics, traces, and logs to     Google Cloud           Pub/Sub topic.
        - Add `structured_metadata_drop` stage for `loki.process` to filter structured metadata.
        - Send remote config status to the remote server for the `remotecfg` service.
        - Send effective config to the remote server for the `remotecfg` service.
        - Add a `stat_statements` configuration block to the `prometheus.exporter.postgres` component to     enable selecting           both the query ID and the full SQL statement. The new block includes one option to enable statement     selection,           and another to configure the maximum length of the statement text.
        - Add truncate stage for `loki.process` to truncate log entries, label values, and     `structured_metadata` values.
        - Add `u_probe_links` & `load_probe` configuration fields to alloy `pyroscope.ebpf` to extend     configuration of           the `opentelemetry-ebpf-profiler` to allow uprobe profiling and dynamic probing.
        - Add `verbose_mode` configuration fields to `alloy pyroscope.ebpf` to be enable `ebpf-profiler`     verbose mode.
        - Add `file_match` block to `loki.source.file` for built-in file discovery using glob patterns.
        - Add a regex argument to the `structured_metadata` stage in `loki.process` to extract labels matching     a regular           expression.
        - OpenTelemetry Collector dependencies upgraded from v0.134.0 to v0.139.0.
          - See the upstream             [core](https://github.com/open-telemetry/opentelemetry-collector/blob/v0.139.0/CHANGELOG.md)             and             [contrib](https://github.com/open-telemetry/opentelemetry-collector-     contrib/blob/v0.139.0/CHANGELOG.md)             changelogs for more details.
        - A new `mimir.alerts.kubernetes` component which discovers AlertmanagerConfig Kubernetes resources     and loads them           into a Mimir instance.
        - Mark `stage.windowsevent` block in the `loki.process` component as GA.
      * Enhancements
        - Add per-application rate limiting with the strategy attribute in the `faro.receiver` component, to     prevent one           application from consuming the rate limit quota of others.
        - Add support of tls in components `loki.source.(awsfirehose|gcplog|heroku|api)` and     `prometheus.receive_http` and           `pyroscope.receive_http`.
        - Remove `SendSIGKILL=no` from unit files and recommendations.
        - Reduce memory overhead of `prometheus.remote_write`'s WAL by lowering the size of the allocated     series storage.
        - Reduce lock wait/contention on the `labelstore.LabelStore` by removing unecessary usage from           `prometheus.relabel`.
        - `prometheus.exporter.postgres` dependency has been updated to v0.18.1.
        - Update Beyla component to 2.7.8.
        - Support delimiters in `stage.luhn`.
        - `pyroscope.java`: update `async-profiler` to 4.2.
        - `prometheus.exporter.unix`: Add an arp config block to configure the ARP collector.
        - `prometheus.exporter.snowflake` dependency has been updated to 20251016132346-6d442402afb2.
        - `loki.source.podlogs` now supports `preserve_discovered_labels` parameter to preserve discovered pod     metadata           labels for use by downstream components.
        - Rework underlying framework of Alloy UI to use Vite instead of Create React App.
        - Use POST requests for remote config requests to avoid hitting http2 header limits.
        - `loki.source.api` during component shutdown will now reject all the inflight requests with status     code 503 after           `graceful_shutdown_timeout` has expired.
        - `kubernetes.discovery`: Add support for attaching namespace metadata.
        - Add `meta_cache_address` to `beyla.ebpf` component.
      * Bugfixes
        - Stop `loki.source.kubernetes` discarding log lines with duplicate timestamps.
        - Fix direction of arrows for pyroscope components in UI graph.
        - Only log EOF errors for syslog port investigations in `loki.source.syslog` as Debug, not Warn.
        - Fix `prometheus.exporter.process` ignoring the `remove_empty_groups` argument.
        - Fix issues with 'unknown series ref when trying to add exemplar' from `prometheus.remote_write` by     allowing           series ref links to be updated if they change.
        - Fix `loki.source.podlogs` component to register the Kubernetes field index for `spec.nodeName` when     node           filtering is enabled, preventing 'Index with name `field:spec.nodeName` does not exist' errors.
        - Fix issue in `loki.source.file` where scheduling files could take too long.
        - Fix `loki.write` no longer includes internal labels __.
        - Fix missing native histograms custom buckets (NHCB) samples from `prometheus.remote_write`.
        - `otelcol.receiver.prometheus` now supports mixed histograms if `prometheus.scrape` has     `honor_metadata` set to           true.
        - `loki.source.file` has better support for non-UTF-8 encoded files.
        - Fix the `loki.write` endpoint block's `enable_http2` attribute to actually affect the client.
        - Optionally remove trailing newlines before appending entries in `stage.multiline`.
        - `loki.source.api` no longer drops request when relabel rules drops a specific stream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4482-1 advisory.

    grafana was updated from version 11.5.5 to 11.5.10:

    - Security issues fixed:

      * CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client (version     11.5.10)         (bsc#1254113)
      * CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)
      * CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)
      * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
      * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
      * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
      * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version     11.5.6)                        (bsc#1245302)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4479-1 advisory.

    release-notes-susemanager:

    - Update to SUSE Manager 4.3.16.2
      * SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled
      * CVEs Fixed:
        CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190         CVE-2025-62349, CVE-2025-62348
      * Bugs mentioned:
        bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20160-1 advisory.

    - Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,       bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,       bsc#1248937, CVE-2025-58058):
      * bump github.com/containerd/containerd (#474)
      * another fix to tests for new tests (#472)
      * fixed typo in testdata (#471)
      * fixed/cleaned new tests (#470)
      * trying a new way for hauler testing (#467)
      * update for cosign v3 verify (#469)
      * added digests view to info (#465)
      * bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory     (#457)
      * update oras-go to v1.2.7 for security patches (#464)
      * update cosign to v3.0.2+hauler.1 (#463)
      * fixed homebrew directory deprecation (#462)
      * add registry logout command (#460)

    - Update to version 1.3.0:
      * bump the go_modules group across 1 directory with 2 updates (#455)
      * upgraded versions/dependencies/deprecations (#454)
      * allow loading of docker tarballs (#452)
      * bump the go_modules group across 1 directory with 2 updates (#449)

    - update to 1.2.5 (bsc#1246722, CVE-2025-46569):
      * Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in         the go_modules group across 1 directory (CVE-2025-46569)
      * deprecate auth from hauler store copy
      * Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the         go_modules group across 1 directory
      * Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0         in the go_modules group across 1 directory
      * upgraded go and dependencies versions

    - Update to version 1.2.5:
      * upgraded go and dependencies versions (#444)
      * Bump github.com/go-viper/mapstructure/v2 (#442)
      * bump github.com/cloudflare/circl (#441)
      * deprecate auth from hauler store copy (#440)
      * Bump github.com/open-policy-agent/opa (#438)

    - update to 1.2.4 (CVE-2025-22872, bsc#1241804):
      * Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules         group across 1 directory
      * minor tests updates

    - Update to version 1.2.3:
      * formatting and flag text updates
      * add keyless signature verification (#434)
      * bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
      * add --only flag to hauler store copy (for images) (#429)
      * fix tlog verification error/warning output (#428)

    - Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):
      * cleanup new tlog flag typos and add shorthand (#426)
      * default public transparency log verification to false to be airgap friendly but allow override (#425)
      * bump github.com/golang-jwt/jwt/v4 (#423)
      * bump the go_modules group across 1 directory with 2 updates (#422)
      * bump github.com/go-jose/go-jose/v3 (#417)
      * bump github.com/go-jose/go-jose/v4 (#415)
      * clear default manifest name if product flag used with sync (#412)
      * updates for v1.2.0 (#408)
      * fixed remote code (#407)
      * added remote file fetch to load (#406)
      * added remote and multiple file fetch to sync (#405)
      * updated save flag and related logs (#404)
      * updated load flag and related logs [breaking change] (#403)
      * updated sync flag and related logs [breaking change] (#402)
      * upgraded api update to v1/updated dependencies (#400)
      * fixed consts for oci declarations (#398)
      * fix for correctly grabbing platform post cosign 2.4 updates (#393)
      * use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
      * Bump the go_modules group across 1 directory with 2 updates (#385)
      * replace mholt/archiver with mholt/archives (#384)
      * forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
      * cleaned up registry and improved logging (#378)
      * Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)
    - bump net/html dependencies (bsc#1235332, CVE-2024-45338)

    - Update to version 1.1.1:
      * fixed cli desc for store env var (#374)
      * updated versions for go/k8s/helm (#373)
      * updated version flag to internal/flags (#369)
      * renamed incorrectly named consts (#371)
      * added store env var (#370)
      * adding ignore errors and retries for continue on error/fail on error (#368)
      * updated/fixed hauler directory (#354)
      * standardize consts (#353)
      * removed cachedir code (#355)
      * removed k3s code (#352)
      * updated dependencies for go, helm, and k8s (#351)
      * [feature] build with boring crypto where available (#344)
      * updated workflow to goreleaser builds (#341)
      * added timeout to goreleaser workflow (#340)
      * trying new workflow build processes (#337)
      * improved workflow performance (#336)
      * have extract use proper ref (#335)
      * yet another workflow goreleaser fix (#334)
      * even more workflow fixes (#333)
      * added more fixes to github workflow (#332)
      * fixed typo in hauler store save (#331)
      * updates to fix build processes (#330)
      * added integration tests for non hauler tarballs (#325)
      * bump: golang >= 1.23.1 (#328)
      * add platform flag to store save (#329)
      * Update feature_request.md
      * updated/standardize command descriptions (#313)
      * use new annotation for 'store save' manifest.json (#324)
      * enable docker load for hauler tarballs (#320)
      * bump to cosign v2.2.3-carbide.3 for new annotation (#322)
      * continue on error when adding images to store (#317)
      * Update README.md (#318)
      * fixed completion commands (#312)
      * github.com/rancherfederal/hauler => hauler.dev/go/hauler (#311)
      * pages: enable go install hauler.dev/go/hauler (#310)
      * Create CNAME
      * pages: initial workflow (#309)
      * testing and linting updates (#305)
      * feat-273: TLS Flags (#303)
      * added list-repos flag (#298)
      * fixed hauler login typo (#299)
      * updated cobra function for shell completion (#304)
      * updated install.sh to remove github api (#293)
      * fix image ref keys getting squashed when containing sigs/atts (#291)
      * fix missing versin info in release build (#283)
      * bump github.com/docker/docker in the go_modules group across 1 directory (#281)
      * updated install script (`install.sh`) (#280)
      * fix digest images being lost on load of hauls (Signed). (#259)
      * feat: add readonly flag (#277)
      * fixed makefile for goreleaser v2 changes (#278)
      * updated goreleaser versioning defaults (#279)
      * update feature_request.md (#274)
      * updated old references
      * updated actions workflow user
      * added dockerhub to github actions workflow
      * removed helm chart
      * added debug container and workflow
      * updated products flag description
      * updated chart for release
      * fixed workflow errors/warnings
      * fixed permissions on testdata
      * updated chart versions (will need to update again)
      * last bit of fixes to workflow
      * updated unit test workflow
      * updated goreleaser deprecations
      * added helm chart release job
      * updated github template names
      * updated imports (and go fmt)
      * formatted gitignore to match dockerignore
      * formatted all code (go fmt)
      * updated chart tests for new features
      * Adding the timeout flag for fileserver command
      * Configure chart commands to use helm clients for OCI and private registry support
      * Added some documentation text to sync command
      * Bump golang.org/x/net from 0.17.0 to 0.23.0
      * fix for dup digest smashing in cosign
      * removed vagrant scripts
      * last bit of updates and formatting of chart
      * updated hauler testdata
      * adding functionality and cleaning up
      * added initial helm chart
      * removed tag in release workflow
      * updated/fixed image ref in release workflow
      * updated/fixed platforms in release workflow
      * updated/cleaned github actions (#222)
      * Make Product Registry configurable (#194)
      * updated fileserver directory name (#219)
      * fix logging for files
      * add extra info for the tempdir override flag
      * tempdir override flag for load
      * deprecate the cache flag instead of remove
      * switch to using bci-golang as builder image
      * fix: ensure /tmp for hauler store load
      * added the copy back for now
      * remove copy at the image sync not needed with cosign update
      * removed misleading cache flag
      * better logging when adding to store
      * update to v2.2.3 of our cosign fork
      * add: dockerignore
      * add: Dockerfile
      * Bump google.golang.org/protobuf from 1.31.0 to 1.33.0
      * Bump github.com/docker/docker
      * updated and added new logos
      * updated github files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20143-1 advisory.

    Changes in git-bug:

    - Revendor to include fixed version of depending libraries:
      - GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade         golang.org/x/crypto to v0.43.0
      - GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade         github.com/go-viper/mapstructure/v2 to v2.4.0
      - GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous
      - GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade         github.com/cloudflare/circl to v1.6.1
      - GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade         golang.org/x/crypto/ssh to v0.45.0
      - GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade         golang.org/x/crypto/ssh/agent to v0.45.0

    - Revendor to include golang.org/x/net/html v 0.45.0 to prevent       possible DoS by various algorithms with quadratic complexity       when parsing HTML documents (bsc#1251463, CVE-2025-47911 and       bsc#1251664, CVE-2025-58190).

    Update to version 0.10.1:

      - cli: ignore missing sections when removing configuration (ddb22a2f)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - webui: remark upgrade + gfm + syntax highlighting (6ee47b96)
      - BREAKING CHANGE: dev-infra: remove gokart (89b880bd)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - web: remark upgrade + gfm + syntax highlighting (6ee47b96)

    Update to version 0.9.0:

      - completion: remove errata from string literal (aa102c91)
      - tui: improve readability of the help bar (23be684a)

    Update to version 0.8.1+git.1746484874.96c7a111:

      * docs: update install, contrib, and usage documentation (#1222)
      * fix: resolve the remote URI using url.*.insteadOf (#1394)
      * build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)
      * chore: gofmt simplify gitlab/export_test.go (#1392)
      * fix: checkout repo before setting up go environment (#1390)
      * feat: bump to go v1.24.2 (#1389)
      * chore: update golang.org/x/net (#1379)
      * fix: use -0700 when formatting time (#1388)
      * fix: use correct url for gitlab PATs (#1384)
      * refactor: remove depdendency on pnpm for auto-label action (#1383)
      * feat: add action: auto-label (#1380)
      * feat: remove lifecycle/frozen (#1377)
      * build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)
      * feat: support new exclusion label: lifecycle/pinned (#1375)
      * fix: refactor how gitlab title changes are detected (#1370)
      * revert: Create Dependabot config file (#1374)
      * refactor: rename //:git-bug.go to //:main.go (#1373)
      * build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)
      * fix: set GitLastTag to an empty string when git-describe errors (#1355)
      * chore: update go-git to v5@masterupdate_mods (#1284)
      * refactor: Directly swap two variables to optimize code (#1272)
      * Update README.md Matrix link to new room (#1275)

    - Update to version 0.8.0+git.1742269202.0ab94c9:
      * deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)

    - Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,       CVE-2025-22869).

    - Add missing Requires to completion subpackages.

    Update to version 0.8.0+git.1733745604.d499b6e:

      * fix typos in docs (#1266)
      * build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)

    - bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20118-1 advisory.

    Changes in gitea-tea:

    - update to 0.11.1:
      * 61d4e57 Fix Pr Create crash (#823)
      * 4f33146 add test for matching logins (#820)
      * 08b8398 Update README.md (#819)

    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially crafted input (boo#1251663)
    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents (boo#1251471)

    - update to 0.11.0:
      * Fix yaml output single quote (#814)
      * generate man page (#811)
      * feat: add validation for object-format flag in repo create         command (#741)
      * Fix release version (#815)
      * update gitea sdk to v0.22 (#813)
      * don't fallback login directly (#806)
      * Check duplicated login name in interact mode when creating new         login (#803)
      * Fix bug when output json with special chars (#801)
      * add debug mode and update readme (#805)
      * update go.mod to retract the wrong tag v1.3.3 (#802)
      * revert completion scripts removal (#808)
      * Remove pagination from context (#807)
      * Continue auth when failed to open browser (#794)
      * Fix bug (#793)
      * Fix tea login add with ssh public key bug (#789)
      * Add temporary authentication via environment variables (#639)
      * Fix attachment size (#787)
      * deploy image when tagging (#792)
      * Add Zip URL for release list (#788)
      * Use bubbletea instead of survey for interacting with TUI (#786)
      * capitalize a few items
      * rm out of date comparison file
      * README: Document logging in to gitea (#790)
      * remove autocomplete command (#782)
      * chore(deps): update ghcr.io/devcontainers/features/git-lfs         docker tag to v1.2.5 (#773)
      * replace arch package url (#783)
      * fix: Reenable -p and --limit switches (#778)

    - Update to 0.10.1+git.1757695903.cc20b52:
      - feat: add validation for object-format flag in repo create         command (see gh#openSUSE/openSUSE-git#60)
      - Fix release version
      - update gitea sdk to v0.22
      - don't fallback login directly
      - Check duplicated login name in interact mode when creating         new login
      - Fix bug when output json with special chars
      - add debug mode and update readme
      - update go.mod to retract the wrong tag v1.3.3
      - revert completion scripts removal
      - Remove pagination from context
      - Continue auth when failed to open browser
      - Fix bug
      - Fix tea login add with ssh public key bug
      - Add temporary authentication via environment variables
      - Fix attachment size
      - deploy image when tagging
      - Add Zip URL for release list
      - Use bubbletea instead of survey for interacting with TUI
      - capitalize a few items
      - rm out of date comparison file
      - README: Document logging in to gitea
      - remove autocomplete command
      - chore(deps): update ghcr.io/devcontainers/features/git-lfs         docker tag to v1.2.5
      - replace arch package url
      - fix: Reenable `-p` and `--limit` switches

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4190-1 advisory.

    - Update to version 3.19.1
    - CVE-2025-53547: Fixed local code execution in Helm Chart. (bsc#1246152)
    - CVE-2025-58190: Fixed excessive memory consumption by `html.ParseFragment` when processing specially     crafted input. (bsc#1251649)
    - CVE-2025-47911: Fixed various algorithms with quadratic complexity when parsing HTML documents.
    (bsc#1251442)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
291338	openSUSE 16 Security Update : go-sendxmpp (openSUSE-SU-2026:20058-1)	Nessus	SuSE Local Security Checks	medium
291311	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:20044-1)	Nessus	SuSE Local Security Checks	high
282650	openSUSE 16 : Recommended update for trivy (SUSE-SU-openSUSE-RU-2026:20010-1)	Nessus	SuSE Local Security Checks	high
281835	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:0028-1)	Nessus	SuSE Local Security Checks	high
279356	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:4482-1)	Nessus	SuSE Local Security Checks	medium
279354	SUSE SLES15 : Security update 4.3.16.2 for Multi-Linux Manager Server LTS (SUSE-SU-2025:4479-1)	Nessus	SuSE Local Security Checks	medium
278653	openSUSE 16 Security Update : hauler (openSUSE-SU-2025:20160-1)	Nessus	SuSE Local Security Checks	high
277676	openSUSE 16 Security Update : git-bug (openSUSE-SU-2025-20143-1)	Nessus	SuSE Local Security Checks	critical
277014	openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2025-20118-1)	Nessus	SuSE Local Security Checks	medium
276786	SUSE SLES15 / openSUSE 15 Security Update : helm (SUSE-SU-2025:4190-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2025-58190

medium

Tenable Plugins

medium

high

high

high

medium

medium

high

critical

medium

high