1005 matches found
PT-2026-80366
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded 4 GiB allocation unauthenticated remote DoS in github.com/gopacket/gopacket...
PT-2026-80459
New API: Integer overflow in quota billing yields negative charges self-crediting in github.com/QuantumNous/new-api...
PT-2026-80460
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api...
PT-2026-80461
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
PT-2026-80382
Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td...
PT-2026-80393
Apache Answer vulnerable to Cross-site Scripting in github.com/apache/answer...
PT-2026-80400
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings...
PT-2026-80386
Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator...
PT-2026-80439
Gophish contains a denial of service vulnerability in github.com/gophish/gophish...
PT-2026-80456
Integer overflow in BTF parsing in github.com/cilium/ebpf...
PT-2026-80358
Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi...
PT-2026-80440
Worktree operations may follow symlinks in github.com/go-git/go-git...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect handling process. An attacker can intercept sensitive credentials by observing network traffic during a same-host HTTPS-to-HTTP redirect. Remediation Upgrade...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect handling process. An attacker can intercept sensitive credentials by observing network traffic during a same-host HTTPS-to-HTTP redirect. Remediation Upgrade...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via improper sanitization of sensitive headers during HTTP redirects. An attacker can obtain confidential authorization tokens or encryption keys by intercepting network traffic when a redirect from...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the run function. An attacker can obtain sensitive internal information, such as file paths, Go module versions, goroutine states, memory addresses, and partial file contents by triggering a panic in the RC API a...
GO-2026-5750 Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama
Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama...
Integer Overflow or Wraparound
Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the exec request handling process. An attacker can cause the server process to crash and terminate all active connections by sending a specially crafted five-byte message with a manipulated length field...
CVE-2026-54063: Allocation of Resources Without Limits or Throttling
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Exc...