GO-2025-3364 Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada

Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada...

GO-2025-3363 Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada

Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada...

GO-2024-3359 GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast

GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast...

GO-2025-3361 GoPhish sends cleartext passwords in github.com/gophish/gophish

GoPhish sends cleartext passwords in github.com/gophish/gophish...

GO-2024-3357 Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome

Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome...

GO-2024-3358 SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol

SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol...

GO-2024-3336 MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio

MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio...

GO-2024-3340 Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server

Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server...

390,000+ WordPress Credentials Stolen via Malicious GitHub Repository Hosting PoC Exploits

A now-removed GitHub repository that advertised a WordPress tool to publish posts to the online content management system CMS is estimated to have enabled the exfiltration of over 390,000 credentials. The malicious activity is part of a broader attack campaign undertaken by a threat actor, dubbed...

GO-2024-3323 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel...

GO-2024-3324 SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel

SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel...

GO-2024-3311 NULL Pointer Dereference on moby image history in github.com/moby/moby

NULL Pointer Dereference on moby image history in github.com/moby/moby...

CVE-2022-4375

creationtimestamp| type| source ---|---|--- 2024-12-05 13:56:09+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-4375.yaml...

GO-2024-3304 Moby Race Condition vulnerability in github.com/moby/moby

Moby Race Condition vulnerability in github.com/moby/moby...

XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner

Cybersecurity researchers have discovered a software supply chain attack that has remained active for over a year on the npm package registry by starting off as an innocuous library and later adding malicious code to steal sensitive data and mine cryptocurrency on infected systems. The package,...

GO-2024-3291 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs...

Exploit for Use of Hard-coded Credentials in Mariazevedo88 Travels-Java-Api

PoC Authentication Bypass MFA Really Simple Security WordPress...

Exploit for OS Command Injection in Paloaltonetworks Pan-Os

CVE-2024-9474 PoC for Palo Alto PAN-OS vuln...

CVE-2024-52583 WesHacks code includes links to Leostop tracking spyware infested files

The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page schedule.html before 17 November 2024 or commit 93dfb83 contains links to Leostop, a site that hosts a malicious injected JavaScript file that occurs when...

CVE-2024-52583: Download of Code Without Integrity Check

The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page schedule.html before 17 November 2024 or commit 93dfb83 contains links to Leostop, a site that hosts a malicious injected JavaScript file that occurs when...