GHSA-2464-8j7c-4cjmPublished

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

cve-program · CVE-2025-11065

Published

github.com/go-viper/mapstructure/v2

https://github.com/go-viper/mapstructure/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "2.4.0",
                            "versionType": "semver"
                        }
                    ],
                    "packageName": "github.com/go-viper/mapstructure/v2",
                    "collectionURL": "https://github.com/go-viper/mapstructure/",
                    "defaultStatus": "unaffected"
                }

openshift-pipelines-client

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Pipelines",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-pipelines-client",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_pipelines:1"
                    ]
                }

rhacm2/acm-grafana-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhacm2/acm-grafana-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:acm:2"
                    ]
                }

rhacm2/submariner-rhel9-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhacm2/submariner-rhel9-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:acm:2"
                    ]
                }

advanced-cluster-security/rhacs-central-db-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Security 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:advanced_cluster_security:4"
                    ]
                }

advanced-cluster-security/rhacs-main-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Security 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "advanced-cluster-security/rhacs-main-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:advanced_cluster_security:4"
                    ]
                }

advanced-cluster-security/rhacs-rhel8-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Security 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "advanced-cluster-security/rhacs-rhel8-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:advanced_cluster_security:4"
                    ]
                }

advanced-cluster-security/rhacs-roxctl-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Security 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:advanced_cluster_security:4"
                    ]
                }

advanced-cluster-security/rhacs-scanner-v4-db-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Security 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:advanced_cluster_security:4"
                    ]
                }

advanced-cluster-security/rhacs-scanner-v4-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Advanced Cluster Security 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:advanced_cluster_security:4"
                    ]
                }

redhat-certification-preflight

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Certification for Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-certification-preflight",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:certifications:1::el8"
                    ]
                }

redhat-certification-preflight

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-certification-preflight",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:certifications:9"
                    ]
                }

gvisor-tap-vsock

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gvisor-tap-vsock",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

opentelemetry-collector

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "opentelemetry-collector",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

toolbox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "toolbox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:10"
                    ]
                }

gvisor-tap-vsock

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "gvisor-tap-vsock",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

opentelemetry-collector

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "opentelemetry-collector",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

toolbox

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "toolbox",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

rhoai/odh-model-registry-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-model-registry-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

rhoai/odh-rhel9-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-rhel9-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

microshift

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "microshift",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

openshift

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

openshift4/ose-helm-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift4/ose-helm-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

openshift4/ose-helm-rhel9-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift4/ose-helm-rhel9-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

podman

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "podman",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

devspaces/traefik-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Dev Spaces",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "devspaces/traefik-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_devspaces:3"
                    ]
                }

devspaces/udi-base-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Dev Spaces",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "devspaces/udi-base-rhel9",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_devspaces:3"
                    ]
                }

devspaces/udi-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Dev Spaces",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "devspaces/udi-rhel9",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_devspaces:3"
                    ]
                }

rhosdt/opentelemetry-collector-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift distributed tracing 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhosdt/opentelemetry-collector-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_distributed_tracing:3"
                    ]
                }

openshift-gitops-1/argocd-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift GitOps",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-gitops-1/argocd-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_gitops:1"
                    ]
                }

openshift-gitops-1/argocd-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift GitOps",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-gitops-1/argocd-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_gitops:1"
                    ]
                }

rhtap-task-runner/rhtap-task-runner-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Application Pipeline",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtap-task-runner/rhtap-task-runner-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_application_pipeline:1"
                    ]
                }

rhtas/cosign-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/cosign-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/fulcio-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/fulcio-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/gitsign-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/gitsign-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/rekor-backfill-redis-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/rekor-backfill-redis-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/rekor-cli-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/rekor-cli-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/rekor-server-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/rekor-server-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

rhtas/timestamp-authority-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Trusted Artifact Signer",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhtas/timestamp-authority-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:trusted_artifact_signer:1"
                    ]
                }

zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Zero Trust Workload Identity Manager - Tech Preview",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
                    ]
                }

zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Zero Trust Workload Identity Manager - Tech Preview",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
                    ]
                }

zero-trust-workload-identity-manager/spiffe-spire-server-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Zero Trust Workload Identity Manager - Tech Preview",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "zero-trust-workload-identity-manager/spiffe-spire-server-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
                    ]
                }

zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Zero Trust Workload Identity Manager - Tech Preview",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-29426

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jan 26, 2026, 7:36:28 PM

dateUpdated: Nov 5, 2026, 2:47:08 PM

22 related source bulletins · separate from aliases

openSUSE-SU-2025:15724-1: trivy-0.67.2-1.1 on GA media

CVE-2025-11065

openSUSE-SU-2025:20117-1: Security update for trivy

CVE-2024-3817 · CVE-2024-45337 · CVE-2024-45338 · CVE-2024-51744 · CVE-2025-11065 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-22872 · CVE-2025-27144 · CVE-2025-30204 · CVE-2025-46569 · CVE-2025-47291 · CVE-2025-53547 · CVE-2025-58058

openSUSE-SU-2025:20073-1: Security update for alloy

CVE-2025-11065 · CVE-2025-58058

msrc_CVE-2025-11065: Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

CVE-2025-11065

SUSE-SU-2025:4457-1: Security update 5.0.6 for Multi-Linux Manager Client Tools

CVE-2025-11065 · CVE-2025-3415 · CVE-2025-47908 · CVE-2025-6023 · CVE-2025-6197

openSUSE-SU-2026:20798-1: Security update for trivy

SUSE-SU-2025:4458-1: Security update 5.0.6 for Multi-Linux Manager Client Tools

CVE-2025-11065 · CVE-2025-3415 · CVE-2025-6023 · CVE-2025-6197

SUSE-SU-2025:4446-1: Security update 5.1.1.1 for Multi-Linux Manager Client Tools

CVE-2025-11065 · CVE-2025-47911 · CVE-2025-58190 · CVE-2025-64751

openSUSE-SU-2025:15631-1: alloy-1.11.2-2.1 on GA media

CVE-2025-11065 · CVE-2025-58058

SUSE-SU-2025:21137-1: Security update for alloy

CVE-2025-11065 · CVE-2025-58058

SUSE-SU-2025:4121-1: Security update for alloy

CVE-2025-11065 · CVE-2025-58058

openSUSE-SU-2025-20073-1: Security update for alloy

CVE-2025-11065 · CVE-2025-58058

SUSE-SU-2025:4482-1: Security update for grafana

CVE-2025-11065 · CVE-2025-3415 · CVE-2025-47911 · CVE-2025-58190 · CVE-2025-6023 · CVE-2025-6197 · CVE-2025-64751

openSUSE-SU-2025-20117-1: Security update for trivy

openSUSE-SU-2025:15610-1: grafana-11.6.6-1.1 on GA media

CVE-2025-11065

openSUSE-SU-2026:20386-1: Security update for cosign

CVE-2025-11065 · CVE-2025-58181 · CVE-2026-22703 · CVE-2026-22772 · CVE-2026-23991 · CVE-2026-23992 · CVE-2026-24122 · CVE-2026-24137 · CVE-2026-26958

openSUSE-SU-2026:10232-1: cosign-3.0.4-2.1 on GA media

CVE-2025-11065 · CVE-2025-58181 · CVE-2026-22703

SUSE-SU-2025:4444-1: Security update 5.1.1.1 for Multi-Linux Manager Client Tools

CVE-2025-11065 · CVE-2025-47911 · CVE-2025-58190 · CVE-2025-64751

SUSE-SU-2025:4479-1: Security update 4.3.16.2 for Multi-Linux Manager Server LTS

CVE-2025-11065 · CVE-2025-47911 · CVE-2025-58190 · CVE-2025-62348 · CVE-2025-62349 · CVE-2025-64751

SUSE-SU-2026:0777-1: Security update for cosign

CVE-2025-11065 · CVE-2025-58181 · CVE-2026-22703 · CVE-2026-22772 · CVE-2026-23991 · CVE-2026-23992 · CVE-2026-24122 · CVE-2026-24137 · CVE-2026-26958

SUSE-SU-2026:20904-1: Security update for cosign

CVE-2025-11065 · CVE-2025-58181 · CVE-2026-22703 · CVE-2026-22772 · CVE-2026-23991 · CVE-2026-23992 · CVE-2026-24122 · CVE-2026-24137 · CVE-2026-26958

openSUSE-SU-2026:20654-1: Security update for grafana

CVE-2023-45288 · CVE-2024-11741 · CVE-2024-28180 · CVE-2024-45339 · CVE-2024-51744 · CVE-2024-9264 · CVE-2024-9476 · CVE-2025-11065 · CVE-2025-21613 · CVE-2025-22870 · CVE-2025-22872 · CVE-2025-2703 · CVE-2025-27144 · CVE-2025-29923 · CVE-2025-3415 · CVE-2025-3454 · CVE-2025-3580 · CVE-2025-4123 · CVE-2025-47911 · CVE-2025-58190 · CVE-2025-6023 · CVE-2025-6197 · CVE-2025-64751 · CVE-2025-68156 · CVE-2026-21720 · CVE-2026-21721 · CVE-2026-21722

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-11065

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-209

Original publisher date fields

published: 2026-01-26T20:16:06.840

lastModified: 2026-11-05T15:17:07.947

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-2464-8j7c-4cjm

Published

github.com/go-viper/mapstructure/v2

SEMVER · introduced 0 → fixed 2.4.0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2025-3900

Published

github.com/go-viper/mapstructure

SEMVER · introduced 0

github.com/go-viper/mapstructure/v2

SEMVER · introduced 0 → fixed 2.4.0

Original source record · Cite this exact observation · Complete original publisher JSON