36515 matches found
GO-2026-5476 Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend...
GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf
androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...
GO-2026-5280 Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus...
GO-2026-5414 listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk...
GO-2026-5486 Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline...
GO-2026-5411 File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser...
GO-2026-5494 Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks...
GO-2026-5433 DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace
DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5434 monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr
monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr...
GO-2026-5469 goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs
goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs...
GHSA-V6W7-GQ3G-FWVM vulnerabilities
Vulnerabilities for packages: qemu...
GHSA-V2J6-3Q6Q-GM3G vulnerabilities
Vulnerabilities for packages: expat...
GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli
GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
GO-2026-5397 Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus...
GO-2026-5303 goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs
goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs...
GO-2026-5369 Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox
Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox...
GO-2026-5329 zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok...
GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...