1005 matches found
CVE-2026-13426: Improper Limitation of a Pathname to a Restricted Directory
The Mattermost Go module github.com/mattermost/mattermost/server/public versions v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost...
GO-2026-5242 Dapr: Service Invocation path traversal ACL bypass in github.com/dapr/dapr
Dapr: Service Invocation path traversal ACL bypass in github.com/dapr/dapr...
GO-2026-5150 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser...
CVE-2026-48501
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...
PT-2026-42374
DevGuard has an unauthenticated identity assertion via X-Admin-Token header in github.com/l3montree-dev/devguard...
Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)
Details on CVE-2026-3854: A critical flaw in GitHub’s internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server...
CVE-2026-40890: Out-of-bounds Read
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with...
CVE-2026-5160: Improper Neutralization of Input During Web Page Generation
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...
CVE-2026-33816: Out-of-bounds Write
Memory-safety vulnerability in github.com/jackc/pgx/v5...
CVE-2026-33815: Out-of-bounds Write
Memory-safety vulnerability in github.com/jackc/pgx/v5...
GO-2026-4489 FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp
FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp...
GO-2026-4414 Alist has Insecure TLS Config in github.com/alist-org/alist
Alist has Insecure TLS Config in github.com/alist-org/alist...
PT-2026-6518
Incus container environment configuration newline injection in github.com/lxc/incus...
CVE-2025-11065: Generation of Error Message Containing Sensitive Information
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...
PT-2025-54734
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go...
PT-2025-54593
Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus...
CVE-2025-65637: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...
GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd...