65 matches found
GO-2026-5463 Bettercap has an integer coercion error in modules/mysql_server/mysql_server.go in github.com/bettercap/bettercap
Bettercap has an integer coercion error in modules/mysqlserver/mysqlserver.go in github.com/bettercap/bettercap...
GO-2026-6027 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev...
GO-2026-5963 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet in github.com/siyuan-note/siyuan/kernel...
GO-2026-5961 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist in github.com/siyuan-note/siyuan/kernel
SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist in github.com/siyuan-note/siyuan/kernel...
GO-2026-5984 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh...
GO-2026-5997 safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl
safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl...
GO-2026-5947 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE in github.com/BishopFox/joro
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE in github.com/BishopFox/joro...
GO-2026-5320 Cross-site Scripting (XSS) in github.com/yuin/goldmark
Cross-site Scripting XSS in github.com/yuin/goldmark...
GO-2026-5881 goshs: Share-link ?token=… redemption races past download limit in goshs.de/goshs
goshs: Share-link ?token=… redemption races past download limit in goshs.de/goshs...
GO-2026-5902 SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo
SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo...
GO-2026-5857 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission...
GO-2026-5831 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS in github.com/nezhahq/nezha
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5842 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
GO-2026-5694 Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign...
GO-2026-5704 Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature in github.com/lin-snow/ech0
Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature in github.com/lin-snow/ech0...
GO-2026-5746 Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker
The Docker daemon's implementation of the "PUT /containers/id/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted,...
GO-2026-5664 netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil
netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil...
GO-2026-5605 Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg...
GO-2026-5579 Antrea has Missing Encryption of Sensitive Data in antrea.io/antrea
Antrea has Missing Encryption of Sensitive Data in antrea.io/antrea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...