16996 matches found
GO-2026-5667 CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns...
GO-2026-5643 Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline...
GO-2026-5694 Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign...
GO-2026-5672 Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data in github.com/nezhahq/nezha
Nezha's private services EnableShowInService: false are enumerable via per-server endpoints, leaking name and timing data in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-5746 Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker
The Docker daemon's implementation of the "PUT /containers/id/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted,...
GO-2026-5664 netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil
netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil...
GO-2026-5708 Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana
Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5628 Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go
Klever-Go KVM: Unauthenticated remote node crash nil-pointer DoS in klever-go P2P transaction interceptor txVersionChecker nil RawData - potential chain halt in github.com/klever-io/klever-go...
GO-2026-5610 OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size in go.opentelemetry.io/obi...
GO-2026-5616 S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy
S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy...
GO-2026-5552 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering in github.com/OliveTin/OliveTin
OliveTin has Unvalidated ot-prefixed Arguments that Bypass Input Filtering in github.com/OliveTin/OliveTin...
GO-2026-5579 Antrea has Missing Encryption of Sensitive Data in antrea.io/antrea
Antrea has Missing Encryption of Sensitive Data in antrea.io/antrea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...
GO-2026-5629 Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server
Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server...
GO-2026-5547 in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang
in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang...
GO-2026-5605 Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg...
GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...
GO-2026-5604 Docker MCP Gateway: Argument injection via OCI image label YAML in github.com/docker/mcp-gateway
Docker MCP Gateway: Argument injection via OCI image label YAML in github.com/docker/mcp-gateway...
GO-2026-5614 arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS in github.com/arnika-project/arnika
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS in github.com/arnika-project/arnika...