4632 matches found
GO-2026-4388 Juju has broken CMR authorization in github.com/juju/juju
Juju has broken CMR authorization in github.com/juju/juju...
GO-2026-4362 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea...
GO-2026-4350 Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows
Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows...
GO-2026-4300 Mattermost Server is vulnerable to DoS through maliciously crafted posts in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to DoS through maliciously crafted posts in github.com/mattermost/mattermost-server...
GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve
Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve...
GO-2026-4286 OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware in github.com/openflagr/flagr
OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware in github.com/openflagr/flagr...
GO-2025-4242 OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator
OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator...
GO-2025-4231 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality in github.com/1Panel-dev/1Panel
1Panel contains a cross-site request forgery CSRF vulnerability in the web port configuration functionality in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4197 Mattermost Server exposes OAuth personal access tokens to attackers in github.com/mattermost/mattermost-server
Mattermost Server exposes OAuth personal access tokens to attackers in github.com/mattermost/mattermost-server...
GO-2025-4130 Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server
Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server...
GO-2025-4021 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni
Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni...
GO-2025-4088 sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls
sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls...
GO-2025-4075 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization in github.com/mattermost/mattermost-server
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization in github.com/mattermost/mattermost-server...
GO-2025-4047 Mattermost Server: initial_load API exposes unnecessary information in github.com/mattermost/mattermost-server
Mattermost Server: initialload API exposes unnecessary information in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-4011 Parsing DER payload can cause memory exhaustion in encoding/asn1
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion...
GO-2025-3965 Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly
Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly...
GO-2025-3901 Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server
Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3854 OpenBao has a Timing Side-Channel in the Userpass Auth Method in github.com/openbao/openbao
OpenBao has a Timing Side-Channel in the Userpass Auth Method in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3825 Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor
Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3745 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-3680 OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh
OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh...
GO-2025-3652 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno...
GO-2025-3638 ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls
Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version e.g., TLS 1.2...
GO-2025-3598 bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta
bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta...
GO-2025-3536 OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive
OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive...
GO-2025-3534 Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server
Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server...
GO-2025-3459 Remote code execution in Wazuh server in github.com/wazuh/wazuh
Remote code execution in Wazuh server in github.com/wazuh/wazuh...
GO-2025-3442 CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft
CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft...
GO-2025-3433 Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd
Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd...
GO-2025-3426 CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o...
GO-2025-3416 Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium
Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium...
GO-2025-3399 Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation in github.com/t2bot/matrix-media-repo
Matrix Media Repo MMR allows Server-Side Request Forgery SSRF on redirects and federation in github.com/t2bot/matrix-media-repo...
GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server
Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-3344 Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age
Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age...
GO-2024-3354 Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad...
GO-2024-3302 ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go
ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go...
GO-2024-3277 Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes...
GO-2024-3166 Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf
Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf...
GO-2022-1225 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2022-0995 Talos worker join token can be used to get elevated access level to the Talos API in github.com/talos-systems/talos
Talos worker join token can be used to get elevated access level to the Talos API in github.com/talos-systems/talos...
GO-2022-0890 Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes
Server Side Request Forgery SSRF in Kubernetes in k8s.io/kubernetes...
GO-2022-0869 Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd...
GO-2022-0776 Denial of Service (DoS) in HashiCorp Consul in github.com/hashicorp/consul
Denial of Service DoS in HashiCorp Consul in github.com/hashicorp/consul...
GO-2022-0708 Arbitrary File Override in Docker Engine in github.com/docker/docker
Arbitrary File Override in Docker Engine in github.com/docker/docker...
GO-2022-0752 Privilege Escalation in Docker in github.com/docker/docker
Privilege Escalation in Docker in github.com/docker/docker...
GO-2022-0631 Hard coded cryptographic key in Kiali in github.com/kiali/kiali
Hard coded cryptographic key in Kiali in github.com/kiali/kiali...
GO-2022-0620 HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault...
GO-2022-0547 aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator...