21111 matches found
CVE-2026-92992
Dromara mayfly-go (up to 1.11.5 ) contains an authorization flaw in the AI Assistant component (file server/internal/ai/api/ai.go). The whitelist bypass is one-token wide: any compound command containing curl , wget , or sed executes automatically without approval, and that approval is granted by...
CVE-2026-92992 Dromara mayfly-go AI Assistant ai.go authorization
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...
CVE-2026-92992 Dromara mayfly-go AI Assistant ai.go authorization
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...
vet v1.19.1
Find malicious packages, vulnerabilities and risky CI workflows before they reach production. Install • Docs • Commands • Policy • Discord !NOTE This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2. Why vet Yo...
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...
EUVD-2026-80871
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing...
GHSA-H7VF-4X9W-H99V oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...
EUVD-2026-80873
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir...
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
Summary The content/file.Store in oras-go v2 unpacks OCI layer tarballs when a descriptor carries io.deis.oras.content.unpack=true. The extraction routine validates symlink targets purely lexically filepath.Join and, for regular files placed directly at the extraction root, skips the parent-symli...
GHSA-M37J-52J7-PJW7 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
Summary The content/file.Store in oras-go v2 unpacks OCI layer tarballs when a descriptor carries io.deis.oras.content.unpack=true. The extraction routine validates symlink targets purely lexically filepath.Join and, for regular files placed directly at the extraction root, skips the parent-symli...
GHSA-4V58-74MF-RJX3 RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
Summary A vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process. Details When parsing incoming AMQP frames, the readField function processes...
EUVD-2026-80819
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client...
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
Summary A vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process. Details When parsing incoming AMQP frames, the readField function processes...
EUVD-2026-80821
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr...
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
Summary A critical stream desynchronization vulnerability has been identified in the AMQP wire-protocol parser. When parsing a long string readLongstr within a table field, providing a length that exceeds the maximum signed 32-bit integer 2^31 - 1, or roughly 2.1 GiB triggers an improper...
GHSA-C5PQ-FR2G-9JPF RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
Summary A critical stream desynchronization vulnerability has been identified in the AMQP wire-protocol parser. When parsing a long string readLongstr within a table field, providing a length that exceeds the maximum signed 32-bit integer 2^31 - 1, or roughly 2.1 GiB triggers an improper...
GHSA-R9C8-GCJP-XFWH RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Summary A flaw in the recvContent function allows a malicious AMQP server to trigger an Out-of-Memory OOM error, forcing the host operating system or container runtime to immediately terminate the client process. Vulnerability Details When receiving message content payloads, the client processes...
EUVD-2026-80810
RabbitMQ amqp091-go: Resource Exhaustion OOM via Unbounded Body Buffer Allocation...
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Summary A flaw in the recvContent function allows a malicious AMQP server to trigger an Out-of-Memory OOM error, forcing the host operating system or container runtime to immediately terminate the client process. Vulnerability Details When receiving message content payloads, the client processes...