filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2438-1 advisory.

    This update for alloy fixes the following issues

    Security issues:

    - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious     PostgreSQL server       to crash a client application via a DataRow message (bsc#1259919).
    - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack     and .idx files       can lead to the consumption of corrupted files (bsc#1258099).
    - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce     invalid results       and lead to undefined behavior (bsc#1258609).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260317).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262955).
    - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32     integer overflow       (bsc#1263530).

    Non security issue:

    - Use systemd tmpfiles.d to create /var/lib/alloy hierarchy (jsc#PED-14815).
    - Update to version 1.16.1
     * Bug Fixes      logging: Fix startup deadlock when components log before      logging config is evaluated      Update to Beyla 3.9.8      Migrate from Docker to Moby
    - Use latest openSUSE Tumbleweed image for building web UI assets
    - Install nvm to set node version specified upstream
    - update to 1.16.0:
     * Features
     - Add clustering for loki.source.kubernetes_events (#6027)      (3dbf587) (@petewall)
     - Add otelcol.auth.google client auth provider (#5526)      (da99a66) (@dashpole, @clayton-cornell)
     - beyla.ebpf: Bump to v3.7.0 (#5966) (5126c2e) (@marctc)
     - database_observability: Add support for GCP Cloud SQL      metadata (#5875) (5d23245) (@cristiangreco, @clayton-cornell)
     - database_observability: Make targets optional (#5924)      (54664b2) (@matthewnolf)
     - database_observability: Update default excluded schemas and      users (#6080) (b386fff) (@cristiangreco)
     - faro.receiver: Add sourcemap fetching from remote locations      (#4614) (b6cb5da) (@Oxel40)
     - helm: Add support for global.image.pullPolicy (#6069)      (2e2ce72) (@petewall)
     - helm: Allow configuring image pull policy for config reloader      (#5923) (991539b) (@kalleep)
     - loki.secretfilter: Add label_timed_out option to mark      timed-out log lines (#5898) (2ad8834) (@kleimkuhler)
     - loki.secretfilter: Add secrets_redacted_by_category_total      metric combining rule and origin (#5855) (053a2f7)      (@kleimkuhler)
     - loki.secretfilter: Change secretfilter to use go-re2 regex      library instead of stdlib (#5909) (c16a660) (@mikefat)
     - loki.secretfilter: Remove redundant      secrets_redacted_by_rule_total and secrets_redacted_by_origin      metrics (#5970) (b16decb) (@kleimkuhler)
     - Oracle exporter can scrape more than one DB (#6008) (6fbad38)      (@ptodev)
     - prometheus.exporter.cloudwatch: Upgrade YACE and drop      aws-sdk-go v1 support (#5936) (f1c036d) (@x1unix)
     - prometheus.exporter.mysql: Update to mysqld_exporter 0.19.0      (#5836) (4f49b57) (@cristiangreco)
     - prometheus.remote_write: Sync WAL with upstream Prometheus      (#5907) (e74a91b) (@x1unix)
     - pyroscope: Add support for extra async-profiler CLI arguments      (#5472) (9251e33) (@ivanape)
     - pyroscope: Replace Parca gRPC debuginfo upload with Pyroscope      Connect API (#5891) (e7ea34a) (@korniltsev-grafanista)
     - pyroscope: Update debuginfo client for HTTP/1.1 upload API      (#6037) (879d8e5) (@korniltsev-grafanista)
     - Change service stop command from 'sc' to 'net' (#5906)      (450973d) (@mateuszdrab)
     - database_observability.mysql: Refactor explain plan loop      batch size (#5894) (f0fcd6b) (@cristiangreco)
     - database_observability.postgres: Cleanup embedded exporter      collectors on reconnection (#6079) (f30d9ae) (@cristiangreco)
     - database_observability.postgres: Fix EXPLAIN param count when      placeholders repeat (#6082) (b612b81) (@rgeyer)
     - database_observability: Drop schema_detection from logs      (#6076) (b0105cb) (@cristiangreco)
     - database_observability: Ensure connection_info_monitor      goroutine exits on Stop (#5874) (1e3334b) (@cristiangreco)
     - deps: Update module github.com/aws/aws-sdk-go-v2/service/s3      to v1.97.3 [SECURITY] (#6004) (38f4346)
     - deps: Update module github.com/go-git/go-git/v5 to v5.17.1      [SECURITY] (#5934) (a5154af)
     - deps: Update module github.com/go-git/go-git/v5 to v5.18.0      [SECURITY] (#6090) (0e59d64)
     - deps: Update module github.com/nwaples/rardecode/v2 to v2.2.0      [SECURITY] (b44d51a) (@jharvey10)
     - deps: Update module      go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp      to v1.43.0 [SECURITY] (#6016) (d92c5c0)      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp      to v1.43.0 [SECURITY] (#6017) (e655bbc)
     - deps: Update module go.opentelemetry.io/otel/sdk to v1.43.0      [SECURITY] (#6018) (94006e8)
     - deps: Update some minor go dep versions (#5896) (4ddd0ed)      (@jharvey10)
     - go: Update alloy builder image to Go 1.25.9 (#6012) (d2ae8b8)      (@x1unix)
     - go: Upgrade to Go 1.25.9 (#6019) (d777ed1) (@x1unix,      @kalleep)
     - Helm: RBAC template handles empty rule arrays (#4860)      (c9430e9) (@naptalie, @dehaansa, @kalleep)
     - loki.process: Eliminate per-stream goroutines in multiline      stage (#6036) (c089e2e) (@kgeckhart)
     - loki.process: Prevent stage.structured_metadata from adding      the same metadata several times (#5965) (0ec8a26) (@kalleep,      @thampiotr)
     - loki.process: Wrap template in a custom type and move      validation to syntax.Validator (#5910) (700dd7d) (@kalleep)
     - prometheus.exporter.postgres: Close DB connections on update      (#6021) (8da97cf) (@kalleep)
     - prometheus.scrape: Update scrape_native_histograms to be      updated at runtime (#6087) (18b205c) (@kalleep)
     - pyroscope.ebpf: Fix deadlock on LRU eviction in irsymcache      (#5911) (03ca563) (@luweglarz)
     - pyroscope.ebpf: Move Pyroscope ebpf metrics registration      after component error handling (#5540) (a3c57c0) (@crbednarz,      @marcsanmi)
     - pyroscope: Set user agent on debuginfo connect-go client      (#6022) (38ad1ef) (@korniltsev-grafanista)
     - ui: Large arguments are downloaded as files instead of      rendered (#5268) (26c67b3) (@ptodev)
     - Update go-m1cpu v0.1.7 -> v0.2.1 to fix M5 chip crash (#6034)      (7fa0cbc) (@ymotongpoo)
     - windows-installer: Increase service restart on failure delays      (#5969) (add15b1) (@rknightion)
    - add script to package webassets inside a podman container, to not      endanger or pollute the host system with npm
    - update to 1.15.1:
     goroutine exits on Stop
     * CVE-2026-34986: Fix panic in JWE decryption (bsc#1262955)
    - update to 1.15.0:
     * BREAKING CHANGES
     - otelcol: Upgrade to OTel Collector v0.147.0
     - Renamed undocumented metrics that was previously prefixed      with <component_id><metric_name> to      loki_source_awsfirehose<metric_name>
     * Security      CVE-2026-26958: Update filippo.io/edwards25519 to version 1.1.1      (bsc#1258609).
     - alloy-mixin: Add filters, groupBy, and multi-select dashboard      variables
     - beyla.ebpf: Add support for Prometheus native histograms
     - beyla.ebpf: Bump Beyla to v3.6
     - converters: Support converting Promtail limits_config
     - database_observability.mysql: Add filtering of query samples      and wait events by minimum duration
     - database_observability.mysql: Embed prometheus exporter      within db-o11y component
     - database_observability.postgres: Add configurable limit to      pg_stat_statements query
     - database_observability.postgres: Embed prometheus exporter
     - database_observability: Promote components to stable
     - Expose Functionality to Handle syslogs with Empty MSG Field
     - loki.process: Support structured metadata as source type of      stage.labels for loki.process
     - loki.secretfilter: Add sampling for secretfilter entries
     - loki.source.gcplog: Add alloy config for MaxOutstandingBytes      and MaxOutstandingMessages
     - loki.write: Add loki pipeline latency metric
     - mixin: Update loki dashboard
     - otelcol.receiver.datadog: Expose intake proxy and      trace_id_cache_size settings
     - prometheus.exporter.cloudwatch: Use aws-sdk-go-v2 by default
     - pyroscope.ebpf: Add comm, pid labels and kernel frame options
    - update to 1.14.1:
     - Correctly handle the deprecated topic field in      otelcol.receiver.kafka configuration
     - loki.process: Protect against json that does not look like      docker json format
     - loki.source.file: Keep positions for compressed files when      reading is finished
     - prometheus.scrape: Update arguments and targets even if      scrape_native_histograms and extra_metrics are updated
    - update to 1.14.0:
     - loki.secretfilter: Some config options are removed entirely:
     partial_mask (replaced with redact_percent), allowlist (now      controlled with custom gitleaks config), enable_entropy,      include_generic, types (now controlled with custom gitleaks      config).
     - otelcol.receiver.prometheus: otelcol.receiver.prometheus no      longer sets start times of OTLP metrics.
     * Security:
    - update to 1.13.2:
     - Expose missing otelcol.processor.tail_sampling options
     - mixin: Add zipped dashboards as a release artifact
     - profiler: Backport Go 1.26 gopclntab textStart fix
     - prometheus.exporter.postgres: Update version of the exporter      fork to fix pg_settings
     - pyroscope.ebpf: Backport dotnet nibble map fix
    - update to 1.13.1:
     - timeout before starting new ones
    - update to 1.13.0:
     - otelcol: Upgrade to OTel Collector v0.142.0
     - otelcol.receiver.kafka: The global topic attribute has been      deleted; use the topics attributes inside the logs, metrics,      and traces blocks instead.
     - otelcol.exporter > sending_queue > batch > min_size changed      from 8192 to 2000 and max_size changed from 0 to 3000
     - Add a virtual_node_peer_attributes and      virtual_node_extra_label arguments to      otelcol.connector.servicegraph
     - Add an otelcol.processor.metric_start_time component
     - Add job level period, length, and add_cloudwatch_timestamp      options and labels_snake_case to CW exporter
     - Add missing configuration parameter      deployment_name_from_replicaset to k8sattributes processor
     - Add parcas symbols upload to pyroscope.ebpf
     - Add sharding for loki.write
     - Add unexposed otel engine and extension to codebase and      change build structure
     - beyla.ebpf: Add meta_cache_address to      beyla.ebpf.attributes.kubernetes
     - beyla.ebpf: Upgrade Beyla to v2.8.5
     - Change the defaults for sending_queue > batch block inside      otelcol.exporter components
     - cluster: Support DNS discovery mode prefixes in
     --cluster.join-addresses flag
     - converter: Update promtail converter to use file_match block      for loki.source.file
     - database_observability: Add health check collector for      postgres component
     - database_observability: Expose exclude_schemas and      exclude_databases settings
     - database_observability: Support Azure cloud provider config      data
     - database_observability.mysql: Support excluding schemas in      all collectors
     - database_observability.postgres: Support excluding DBs in all      collectors

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20940-1 advisory.

    Changes in grafana:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by       updating golang.org/x/net to version 0.55.0 (bsc#1266600)

    - Update to version 11.6.14+security-04:
      Security:
      * CVE-2026-28374: Fix insecure direct object reference in         Annotations API (bsc#1265290)
      * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live         push endpoint (bsc#1265289)
      * CVE-2026-28383: Fix unbounded memory allocation in Grafana         plugin resources (bsc#1265286)
      * CVE-2026-28380: Fix broken access control in Snapshot API         (bsc#1265287)
      * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass         (bsc#1265285)
      * CVE-2026-28379: Fix viewer-triggered race condition in         Grafana Live (bsc#1265288)
      * CVE-2026-33377: Fix dashboard Editor Privilege Escalation         (bsc#1265284)
      * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin         (bsc#1265283)
      * CVE-2026-33381: Prevent users from generating Service Account         tokens after permissions removal (bsc#1265281)
      * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing         an authenticated attacker to read arbitrary files from the         Grafana servers filesystem (bsc#1265282)

    - CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)
    - CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability       in Apache Thrift (bsc#1263501)

    - CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1       (bsc#1258595)
    - CVE-2026-21725: Fix missing UID when deleting datasource by name       (bsc#1258873)

    - Update to version 11.6.14+security-01:
      Security:
      * CVE-2026-33375: Fix denial of Service via out-of-memory         exhaustion in MSSQL data source plugin (bsc#1260881)

    - Update to version 11.6.14:
      Security:
      * CVE-2026-27876: Fix remote arbitrary code execution via chained         SQL Expressions (bsc#1261025)
      * CVE-2026-27877: Fix information disclosure of data-source         passwords via public dashboards (bsc#1261026)
      * CVE-2026-28375: Fix denial of service via testdata data-source         (bsc#1261029)
      * CVE-2026-27879: Fix denial of service via resample query         (bsc#1261027)
      * CVE-2026-33186: Fix authorization bypass due to improper         validation of the HTTP/2 :path pseudo-header (bsc#1260263)
      * CVE-2026-21724: Fix authorization bypass allows modification of         protected webhook URLs (bsc#1260878)

    - Update to version 11.6.13:
      Enhancement:
      * Wire the public dashboard service to the HTTP server

    - Update to version 11.6.12:
      Enhancement:
      * Update authentication redirect logic       Bug fix:
      * Fix single panel render with variable references

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0777-1 advisory.

    Update to version 3.0.5 (jsc#SLE-23879).

    Security issues fixed:

    - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253913).
    - CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496).
    - CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to     arbitrary       internal services (bsc#1256562).
    - CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata     JSON returned       by TUF repository (bsc#1257080).
    - CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files     due to a       compromised or misconfigured TUF repository (bsc#1257085).
    - CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542).
    - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes     with target       cache path traversal (bsc#1257139).
    - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce     invalid results       and lead to undefined behavior (bsc#1258612).

    Other updates and bugfixes:

    * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
    * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
    * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
    * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
    * chore(deps): bump the actions group with 3 updates (#4703)
    * update golang builder to use go1.25.7 (#4687)
    * update golangci-lint to v2.8.x (#4688)
    * Support DSSE signing conformance test (#4685)
    * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
    * Deprecate rekor-entry-type flag (#4691)
    * Deprecate cosign triangulate (#4676)
    * Deprecate cosign copy (#4681)
    * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
    * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
    * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
    * Automatically require signed timestamp with Rekor v2 entries (#4666)
    * Fix syntax issue in conformance test, update nightly (#4664)
    * Add mTLS support for TSA client connections when signing with a signing config (#4620)
    * fix: avoid panic on malformed tlog entry body (#4652)
    * Verify validity of chain rather than just certificate (#4663)
    * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
    * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
    * Bump sigstore/sigstore to resolve GHSA (#4660)
    * Gracefully fail if bundle payload body is not a string (#4648)
    * fix: avoid panic on malformed replace payload (#4653)
    * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
    * fix: avoid panic on malformed attestation payload (#4651)
    * fix: avoid panic on malformed tlog entries (#4649)
    * Update conformance to latest
    * docs(cosign): clarify RFC3161 revocation semantics (#4642)
    * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
    * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
    * Add origin key for ctfe trusted root
    * Add changelog updates for v3.0.4 and v2.6.2 (#4625)

    - Update to version 3.0.4:

    * Fix bundle verify path for old bundle/trusted root (#4623)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
    * chore(deps): bump cuelang.org/go in the gomod group (#4615)
    * Optimize cosign tree performance by caching digest resolution (#4612)
    * Don't require a trusted root to verify offline with a key (#4613)
    * Support default services for trusted-root and signing-config creation (#4592)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
    * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
    * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
    * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
    * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
    * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
    * chore(deps): bump the gomod group with 5 updates (#4599)
    * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
    * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
    * chore(deps): bump the actions group with 3 updates (#4587)
    * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
    * chore(deps): bump the gomod group with 9 updates (#4577)

    - Update to version 3.0.3:

    * 4554: Closes 4554 - Add warning when --output* is used (#4556)
    * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
    * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
    * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
    * chore(deps): bump the actions group with 4 updates (#4544)
    * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
    * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
    * update builder to use go1.25.5 (#4566)
    * Protobuf bundle support for subcommand `clean` (#4539)
    * Add staging flag to initialize with staging TUF metadata
    * update slack invite link (#4560)
    * Updating sign-blob to also support signing with a certificate (#4547)
    * Bump sigstore library dependencies (#4532)
    * Protobuf bundle support for subcommands `save` and `load` (#4538)
    * Fix cert attachment for new bundle with signing config
    * Fix OCI verification with local cert - old bundle
    * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
    * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
    * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
    * update go builder and cosign (#4529)
    * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
    * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
    * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
    * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
    * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
    * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
    * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
    * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
    * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
    * Deprecate tlog-upload flag (#4458)
    * fix: Use signal context for `sign` cli package.
    * update offline verification directions (#4526)
    * Fix signing/verifying annotations for new bundle
    * Add support to download and attach for protobuf bundles (#4477)
    * Add --signing-algorithm flag (#3497)
    * Refactor signcommon bundle helpers
    * Add --bundle and fix --upload for new bundle
    * Pass insecure registry flags through to referrers
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
    * Add protobuf bundle support for tree subcommand (#4491)
    * Remove stale embed import (#4492)
    * Support multiple container identities
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
    * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
    * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
    * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
    * chore(deps): bump cuelang.org/go in the gomod group (#4479)
    * upgrade OSS-Fuzz build tooling (#4487)
    * Fix segfault when no attestations are found (#4472)
    * Use overridden repository for new bundle format (#4473)
    * update go to 1.25.3 (#4471)
    * Remove --out flag from `cosign initialize` (#4462)
    * chore(deps): bump the actions group with 2 updates (#4460)
    * Deprecate offline flag (#4457)
    * Deduplicate code in sign/attest* and verify* commands (#4449)
    * Cache signing config when calling initialize (#4456)
    * Update changelog for v3.0.2 (#4455)
    * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go
    * chore(deps): bump the actions group with 3 updates
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
    * choose different signature filename for KMS-signed release signatures (#4448)
    * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
    * Update rekor-tiles version path
    * update CL for v3.0.1 release (#4447)
    * update goreleaser config for v3.0.0 release (#4446)
    * Create changelog for v3.0.0 (#4440)
    * Fetch service URLs from the TUF PGI signing config by default (#4428)
    * Create changelog for v2.6.1 (#4439)
    * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
    * chore(deps): bump the gomod group with 2 updates (#4429)
    * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
    * chore(deps): bump the actions group with 3 updates (#4434)
    * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
    * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
    * Bump module version to v3 for Cosign v3.0 (#4427)
    * Move sigstore-conformance back to tagged release (#4425)
    * Bump sigstore-go to v1.1.3 (#4423)
    * Partially populate the output of cosign verify when working with new bundles (#4416)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
    * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
    * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
    * bump go builder to use 1.25.1 and cosign (#4417)
    * Bump sigstore-go for more precise user agents (#4413)
    * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
    * chore(deps): bump the actions group with 2 updates (#4407)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
    * Default to using the new protobuf format (#4318)

    - Update to version 2.6.0:

    * Require exclusively a SigningConfig or service URLs when signing (#4403)
    * Add a terminal spinner while signing with sigstore-go (#4402)
    * Bump sigstore-go, support alternative hash algorithms with keys (#4386)
    * Add support for SigningConfig in sign/attest (#4371)
    * Support self-managed keys when signing with sigstore-go (#4368)
    * Remove SHA256 assumption in sign-blob/verify-blob (#4050)
    * introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
    * refactor: extract function to write referrer attestations (#4357)
    * Break import cycle with e2e build tag (#4370)
    * Update conformance test binary for signing config (#4367)
    * update builder image to use go1.25 (#4366)
    * Don't load content from TUF if trusted root path is specified (#4347)
    * Don't require timestamps when verifying with a key (#4337)
    * Fixes to cosign sign / verify for the new bundle format (#4346)
    * update builder to use go1.24.6 (#4334)
    * bump golangci-lint to v2.3.x (#4333)
    * Have cosign sign support bundle format (#4316)
    * Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
    * Verify subject with bundle only when checking claims (#4320)
    * Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-     attestation` the       ability to verify with just a digest (#4306)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for     building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results     or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on     an initialized point that is not the identity point, it returns an incorrect result. If the method is     called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero     value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that     MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519     only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.
    (CVE-2026-26958)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for
    building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results
    or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on
    an initialized point that is not the identity point, it returns an incorrect result. If the method is
    called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero
    value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that
    MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519
    only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.
    (CVE-2026-26958)

ID	Name	Product	Family	Type	Severity
321596	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:2438-1)	Nessus	SuSE Local Security Checks	Local	medium
321072	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20940-1)	Nessus	SuSE Local Security Checks	Local	medium
301024	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2026:0777-1)	Nessus	SuSE Local Security Checks	Local	medium
299681	Linux Distros Unpatched Vulnerability : CVE-2026-26958	Nessus	Misc.	Local	medium
437845	SCA: security update for filippo.io/edwards25519 (GHSA-fw7p-63qq-7hpr)	Tenable Cloud Security	SCA Checks	Local	medium
437845	SCA: security update for filippo.io/edwards25519 (GHSA-fw7p-63qq-7hpr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-26958

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium