15698 matches found
The vulnerability of the Go programming language, related to errors in the certificate validation process, allows attackers to compromise the accessibility of the protected information.
The vulnerability of the Go programming language is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to compromise the accessibility of protected information...
SUSE-SU-2026:1098-1 Security update for cosign
This update for cosign rebuilds it against the current go 1.25 security release...
GO-2026-4856 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium...
GO-2026-4832 NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server...
GO-2026-4829 NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server
NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server...
GO-2026-4836 NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server...
GO-2026-4844 Zoraxy: Authenticated Path Traversal in Config Import leads to RCE in github.com/tobychui/zoraxy
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE in github.com/tobychui/zoraxy...
GO-2026-4813 New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api...
GO-2026-4827 NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server
NATS credentials are exposed in monitoring port via command-line argv in github.com/nats-io/nats-server...
GO-2026-4826 NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server
NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server...
GO-2026-4703 Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo...
GO-2026-4701 github.com/ctfer-io/monitoring Vulnerable to Improper Access Control
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control...
GO-2026-4718 Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/chall-manager/deploy
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/chall-manager/deploy...
GO-2026-4713 File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely in github.com/filebrowser/filebrowser
File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely in github.com/filebrowser/filebrowser...
GO-2026-4714 Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/romeo/environment/deploy
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/romeo/environment/deploy. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4708 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan
SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan...
crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the HostnameError.Error function. This flaw, caused by unbounded string concatenation, leads to excessive resource...
CVE-2026-33487
goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the validateSignature function in validate.go goes through the references in the SignedInfo block to find one that matches the signed element's ID. In Go versions before 1.22, or when go.mod uses an older version,...
CVE-2026-33487
goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the validateSignature function in validate.go goes through the references in the SignedInfo block to find one that matches the signed element's ID. In Go versions before 1.22, or when go.mod uses an older version,...
