GO-2022-0803 containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd...

GO-2022-0705 Directory Traversal in Docker in github.com/docker/docker

Directory Traversal in Docker in github.com/docker/docker...

GO-2022-0770 Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad

Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad...

GO-2022-0630 Arbitrary Code Execution in Docker in github.com/docker/docker

Arbitrary Code Execution in Docker in github.com/docker/docker...

GO-2022-0591 Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad

Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad...

GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd

DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd...

GO-2022-0440 Woodpecker allows cross-site scripting (XSS) via build logs in github.com/woodpecker-ci/woodpecker

Woodpecker allows cross-site scripting XSS via build logs in github.com/woodpecker-ci/woodpecker...

GO-2022-0304 Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd

Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd...

GO-2022-0278 Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd

Unprivileged pod using hostPath can side-step active LSM when it is SELinux in github.com/containerd/containerd...

GO-2022-0250 Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki

Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki...

GO-2023-2330 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

GO-2023-2078 Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium

Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium...

GO-2023-2088 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault...

GO-2023-2072 Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc

Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc...

GO-2023-2069 Croc may expose secret to local users in github.com/schollz/croc

Croc may expose secret to local users in github.com/schollz/croc...

GO-2023-1972 Gogs XSS Vulnerability in gogs.io/gogs

Gogs XSS Vulnerability in gogs.io/gogs...

GO-2023-1959 Kubernetes arbitrary file overwrite in k8s.io/kubernetes

Kubernetes arbitrary file overwrite in k8s.io/kubernetes...

GO-2023-1864 Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes...

GO-2023-1628 Kubernetes vulnerable to path traversal in k8s.io/kubernetes

Kubernetes vulnerable to path traversal in k8s.io/kubernetes...

GO-2023-1629 Kubernetes vulnerable to validation bypass in k8s.io/kubernetes

Kubernetes vulnerable to validation bypass in k8s.io/kubernetes...

GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd

The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd...

GO-2024-3009 snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd

snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik

ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...

GO-2024-2699 Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama

Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama...

GO-2024-2468 snapd Race Condition vulnerability in github.com/snapcore/snapd

snapd Race Condition vulnerability in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...

GO-2024-2694 Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go

Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go...

GO-2024-2660 Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl

Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack...

GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter

There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...

GO-2024-2471 Chain halt panic in github.com/cometbft/cometbft

A vulnerability in CometBFT’s validation logic for VoteExtensionsEnableHeight can result in a chain halt when triggered through a governance parameter change proposal on an ABCI2 Application Chain. If a parameter change proposal including a VoteExtensionsEnableHeight modification is passed, nodes...

GO-2024-2469 Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go

Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go...

GO-2023-2333 Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark

Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark...

GO-2022-0251 Panic on NUL character in ROA in github.com/cloudflare/cfrpki

OctoRPKI crashes when a repository returns an invalid ROA that is only an encoded NUL character \0...

GO-2022-0233 Resource exhaustion in github.com/pires/go-proxyproto

The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them. v0.6.0 of the proxyproto package adds support for a user-define...

GO-2022-0461 Unbounded memory consumption in github.com/pion/dtls/v2

Attacker can cause unbounded memory consumption. The Pion DTLS client and server buffer handshake data with no upper limit, permitting an attacker to cause unbounded memory consumption by sending an unterminated handshake...

GO-2022-0563 Cross-site request forgery in github.com/filebrowser/filebrowser/v2

A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...

GO-2021-0097 Panic due to out-of-bounds read in github.com/dhowden/tag

Due to improper bounds checking, a number of methods can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack...

GO-2020-0006 Denial of service via open idle connection in github.com/miekg/dns

An attacker may prevent TCP connections to a Server by opening a connection and leaving it idle, until the connection is closed by the server no other connections will be accepted...

GO-2021-0084 Incorrect permissions for critical resource in github.com/astaxie/beego

Session data is stored using permissive permissions, allowing local users with filesystem access to read arbitrary data...

GO-2026-6395 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) in github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles publish mode in github.com/siyuan-note/siyuan/kernel...

GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...

GO-2026-6309 Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet...

GO-2026-6321 alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http...

GO-2026-6301 Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo...

GO-2026-6138 Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td

Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td...

GO-2026-6190 Unsafe file permission restoration from metadata in github.com/rclone/rclone

Unsafe file permission restoration from metadata in github.com/rclone/rclone...

GO-2026-6237 Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp

In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in ...

GO-2026-6181 Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone...

GO-2026-6108 Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh

Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh...

GO-2026-6224 Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API in github.com/kubev2v/migration-planner

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API in github.com/kubev2v/migration-planner...

GO-2026-6229 Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs in github.com/kubev2v/migration-planner

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs in github.com/kubev2v/migration-planner...