50754 matches found
GO-2026-5708 Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana
Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5624 Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast
Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast...
GO-2026-5484 Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server
Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-5409 Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana
Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-5505 Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization in github.com/portainer/portainer
Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
CVE-2025-71335
Flowise before 3.0.10 affected versions 3.0.7 and earlier fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the...
EUVD-2026-39561
Two data sources DICOMWebProxy and DICOMJSON shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the...
GO-2026-5359 Grafana Tempo has Inadequate Encryption Strength in github.com/grafana/tempo
Grafana Tempo has Inadequate Encryption Strength in github.com/grafana/tempo. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-5377 ExternalSecrets vulnerable to privilege escalation with secret overwriting in github.com/external-secrets/external-secrets/apis
ExternalSecrets vulnerable to privilege escalation with secret overwriting in github.com/external-secrets/external-secrets/apis. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5217 Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer
Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5154 Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher
Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2026-5143 Portainer has an endpoint security bypass via Swarm service create/update in github.com/portainer/portainer
Portainer has an endpoint security bypass via Swarm service create/update in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5110 Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs
Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5112 Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server
Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
EUVD-2026-39538
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6...
CVE-2026-55180
CVE-2026-55180 affects pnpm before 10.34.2 and 11.5.3. The issue arises when pnpm and related configuration (repository-controlled .npmrc and pnpm-workspace.yaml) expand ${ENV_VAR} placeholders into registry request destinations and registry credentials. This can cause dependency resolution to se...
CVE-2026-48995 pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if thi...
CVE-2026-54829
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005...