Search for packages
| purl | pkg:rpm/redhat/mcg@5.7.0-69.85e2026.5.7?arch=el8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-47qq-pxyn-wqge
Aliases: CVE-2020-26160 GHSA-w73w-5m7g-f7qc |
Authorization bypass in github.com/dgrijalva/jwt-go jwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m["aud"]` (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1 | There are no reported fixed by versions. |
|
VCID-ncjz-1n22-vuax
Aliases: CVE-2020-28362 |
golang: math/big: panic during recursive division of very large numbers | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T14:04:30.154431+00:00 | RedHat Importer | Affected by | VCID-47qq-pxyn-wqge | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json | 38.0.0 |
| 2026-04-01T14:03:57.064200+00:00 | RedHat Importer | Affected by | VCID-ncjz-1n22-vuax | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-28362.json | 38.0.0 |