31422 matches found
GO-2026-5261 Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents in github.com/nezhahq/nezha
Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5206 androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf
androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf...
GO-2026-5129 Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2026-5169 Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder
Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder...
GO-2026-5088 kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp...
GO-2026-5154 Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher
Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2026-5145 Oxia affected by server crash via race condition in session heartbeat handling in github.com/oxia-db/oxia
Oxia affected by server crash via race condition in session heartbeat handling in github.com/oxia-db/oxia...
GO-2026-5177 Ella Core Panics Upon NGAP handover failure in github.com/ellanetworks/core
Ella Core Panics Upon NGAP handover failure in github.com/ellanetworks/core...
GO-2026-5089 FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser
FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser...
GO-2026-5118 zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok...
GO-2026-5155 Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg...
GO-2026-5096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser
File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser...
GO-2026-5117 IPAM controller service account granted unnecessary full access to Secrets in github.com/metal3-io/ip-address-manager
IPAM controller service account granted unnecessary full access to Secrets in github.com/metal3-io/ip-address-manager...
GO-2026-5079 Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox...
GO-2026-5094 Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution...
GO-2026-5173 Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server
Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server...
GO-2026-5100 Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0...
GO-2026-5156 File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser
File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser...
GO-2026-5138 Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm
Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm...