4632 matches found
GO-2026-5642 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions in github.com/free5gc/nef
free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions in github.com/free5gc/nef...
GO-2026-5694 Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign...
GO-2026-5670 Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard
Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard...
GO-2026-5688 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms in github.com/axllent/mailpit
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms in github.com/axllent/mailpit...
GO-2026-5715 Singularity: Incorrect path matching for 'limit container paths' directive in github.com/sylabs/singularity
Singularity: Incorrect path matching for 'limit container paths' directive in github.com/sylabs/singularity...
GO-2026-5545 Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs
Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-5549 frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control in github.com/fatedier/frp
frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control in github.com/fatedier/frp...
GO-2026-5627 Gotenberg has a Server-Side Request Forgery (SSRF) Issue in github.com/gotenberg/gotenberg
Gotenberg has a Server-Side Request Forgery SSRF Issue in github.com/gotenberg/gotenberg...
GO-2026-5601 AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers
AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao
OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...
GO-2026-5534 TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5533 Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server in github.com/tilt-dev/tilt
Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server in github.com/tilt-dev/tilt...
GO-2026-5621 Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno...
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd...
GO-2026-5537 free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating in github.com/free5gc/smf
free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/ref panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating in github.com/free5gc/smf...
GO-2026-5544 Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension
Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension...
GO-2026-5520 Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet...
GO-2026-5609 OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) in github.com/openbao/openbao
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction DoS in github.com/openbao/openbao...
GO-2026-5514 SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb
SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb...
GO-2026-5546 Oxia exposes bearer token in debug log messages on authentication failure in github.com/oxia-db/oxia
Oxia exposes bearer token in debug log messages on authentication failure in github.com/oxia-db/oxia...
GO-2026-5629 Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server
Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server...
GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd...
GO-2026-5617 Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection
A race condition in the Docker daemon allows an attacker to redirect bind mounts to arbitrary host paths during a "docker cp" operation. The affected code is in the daemon package, specifically the openContainerFS method. This is daemon-owned, Linux-specific code and is not intended for external...
GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef
free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...
GO-2026-5459 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery
Anyquery has Path Traversal through clearplugincache, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5458 File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser
File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser...
GO-2026-5477 Gogs has Stored XSS in `.ipynb` Preview in gogs.io/gogs
Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2026-5439 Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members in github.com/nezhahq/nezha
Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members in github.com/nezhahq/nezha...
GO-2026-5436 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave...
GO-2026-5401 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon...
GO-2026-5412 Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5386 AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli
GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...
GO-2026-5390 MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway...
GO-2026-5184 Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs
Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-5270 Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace
Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace...
GO-2026-5227 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI
Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI...
GO-2026-5216 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination in github.com/OliveTin/OliveTin
OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination in github.com/OliveTin/OliveTin...
GO-2026-5207 Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
Fleet: Helm impersonation bypass of RESTClientGetter retains cluster-admin during template rendering in github.com/rancher/fleet...
GO-2026-5279 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline.uses in chainguard.dev/melange...
GO-2026-5202 Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs
Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5201 SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated) in github.com/siyuan-note/siyuan/kernel
SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG getDynamicIcon, unauthenticated in github.com/siyuan-note/siyuan/kernel...
GO-2026-5146 SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs
SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs...
GO-2026-5123 Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export in github.com/lin-snow/ech0
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-5143 Portainer has an endpoint security bypass via Swarm service create/update in github.com/portainer/portainer
Portainer has an endpoint security bypass via Swarm service create/update in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5174 Velocidex Velociraptor has an off-by-one error in www.velocidex.com/golang/velociraptor
Velocidex Velociraptor has an off-by-one error in www.velocidex.com/golang/velociraptor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5070 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in github.com/hahwul/dalfox...
GO-2026-5167 File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser
File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser...
GO-2026-5112 Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server
Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...