31419 matches found
GO-2026-5691 File Browser has a DoS Vulnerability via Public Login API in github.com/filebrowser/filebrowser
File Browser has a DoS Vulnerability via Public Login API in github.com/filebrowser/filebrowser...
GO-2026-5635 nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh
nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh...
GO-2026-5632 Pelican Web UI Affected by a Privilege Escalation Attack in github.com/pelicanplatform/pelican
Pelican Web UI Affected by a Privilege Escalation Attack in github.com/pelicanplatform/pelican...
GO-2026-5521 Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui...
GO-2026-5612 Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus...
GO-2026-5557 Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend
Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend...
GO-2026-5623 Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0
Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0...
GO-2026-5616 S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy
S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy...
GO-2026-5553 Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry
Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry...
GO-2026-5588 Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker
Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker...
GO-2026-5559 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex in github.com/oauth2-proxy/oauth2-proxy
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skipauthroutes and skipauthregex in github.com/oauth2-proxy/oauth2-proxy...
GO-2026-5535 Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor
Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor...
GO-2026-5624 Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast
Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast...
GO-2026-5602 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2026-5561 Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend...
GO-2026-5625 goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs...
GO-2026-5565 Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui
Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd...
GO-2026-5603 Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation in github.com/lin-snow/ech0
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...