PT-2025-45821

Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go...

PT-2025-45802

Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers...

PT-2025-45885

Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto...

GO-2025-4036 Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server

Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server...

PT-2025-45838

Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs...

PT-2025-45841

Cosmos EVM Vulnerability in github.com/cosmos/evm...

PT-2025-45854

Mattermost Server does not check if cookies are used over SSL in github.com/mattermost/mattermost-server...

PT-2025-45864

Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server...

PT-2025-45866

Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server...

PT-2025-45842

NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

PT-2025-45873

Rancher exposes sensitive information through audit logs in github.com/rancher/rancher...

PT-2025-45870

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault...

PT-2025-45875

Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation...

PT-2025-45829

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents in github.com/in-toto/go-witness...

EUVD-2023-1536

Malicious code in bioql PyPI...

CVE-2025-10954: Improper Validation of Syntactic Correctness of Input

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range"...

GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh

esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...

CVE-2025-54799

Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME...

CVE-2025-54799: Cleartext Transmission of Sensitive Information

Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME...

Cross-site Scripting (XSS)

github.com/forceu/gokapi is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the API key renaming feature, which allowed authenticated users to inject JavaScript that would execute when another user accessed the API tab...