31412 matches found
GO-2026-5483 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga...
GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf
androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...
GO-2026-5434 monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr
monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr...
GO-2026-5433 DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace
DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5449 Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication in github.com/amir20/dozzle
Dozzle's Cross-Site WebSocket Hijacking CSWSH on exec/attach endpointsbypasses authentication in github.com/amir20/dozzle...
GO-2026-5409 Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana
Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-5458 File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser
File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser...
GO-2026-5486 Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline...
GO-2026-5476 Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend...
GO-2026-5411 File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser...
GO-2026-5494 Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks...
GO-2026-5280 Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus...
GO-2026-5421 PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman
PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman...
GHSA-V6W7-GQ3G-FWVM vulnerabilities
Vulnerabilities for packages: qemu...
GHSA-V2J6-3Q6Q-GM3G vulnerabilities
Vulnerabilities for packages: expat...
GO-2026-5329 zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok...
GO-2026-5369 Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox
Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox...
GO-2026-5383 FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser...
GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...