6602 matches found
CVE-2023-6195 Server-Side Request Forgery (SSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image...
CVE-2023-6195 Server-Side Request Forgery (SSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image...
CVE-2023-6195 Server-Side Request Forgery (SSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image...
GO-2025-3426 CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o...
GO-2025-3424 Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x
Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3414 Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah...
GO-2025-3410 Insecure default config access in WriteFreely in github.com/writefreely/writefreely
Insecure default config access in WriteFreely in github.com/writefreely/writefreely...
uniapi version 1.0.7 contained an information harvesting script.
uniapi version 1.0.7 introduces code that would executeon import of the module and download a script from a remote URL,and would then execute the downloaded script in a thread.The downloaded script would harvest system informationand POST the information to another remote URL.This code was found ...
GO-2025-3407 Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server
Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server...
GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3376 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset...
GO-2025-3377 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3374 Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve
Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve...
GO-2025-3368 Argument Injection via the URL field in github.com/go-git/go-git
Argument Injection via the URL field in github.com/go-git/go-git...
GO-2024-3358 SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol
SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol...
GO-2025-3364 Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada
Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada...
GO-2024-3357 Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome
Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome...
GO-2024-3359 GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast
GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast...