35891 matches found
Improper Validation of Array Index
Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the selector lexer process. An attacker can cause a panic and potentially disrupt service availability by providing a quoted string with a trailing backslash. Remediation There is no fixed version...
GO-2026-5433 DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace
DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5280 Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus...
GO-2026-5486 Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline...
GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf
androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...
GO-2026-5469 goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs
goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs...
GHSA-V6W7-GQ3G-FWVM vulnerabilities
Vulnerabilities for packages: qemu...
GHSA-V2J6-3Q6Q-GM3G vulnerabilities
Vulnerabilities for packages: expat...
GO-2026-5369 Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox
Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox...
GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli
GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...
GO-2026-5301 Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet
Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet...
GO-2026-5383 FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser...
GO-2026-5397 Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus...
GO-2026-5303 goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs
goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs...
GO-2026-5329 zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok...
GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...
GO-2026-5361 authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd
authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
GO-2026-5252 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import volume omitted in github.com/lxc/incus...