4632 matches found
GO-2022-0509 KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge
KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge...
GO-2022-0547 aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator...
GO-2022-0556 OS Command Injection in file editor in Gogs in gogs.io/gogs
OS Command Injection in file editor in Gogs in gogs.io/gogs...
GO-2022-0498 Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd
Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd...
GO-2023-2069 Croc may expose secret to local users in github.com/schollz/croc
Croc may expose secret to local users in github.com/schollz/croc...
GO-2023-2072 Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc
Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc...
GO-2023-1977 Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes
Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes...
GO-2023-1851 HashiCorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
HashiCorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...
GO-2023-1808 Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells
Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells...
GO-2023-1682 Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc
Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc...
GO-2023-1629 Kubernetes vulnerable to validation bypass in k8s.io/kubernetes
Kubernetes vulnerable to validation bypass in k8s.io/kubernetes...
GO-2023-1469 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2024-3039 Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean
Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean...
GO-2024-2984 Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2
Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2...
GO-2024-2972 Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs...
GO-2024-2501 Denial of service in HashiCorp Consul in github.com/hashicorp/consul
Denial of service in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2595 Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2929 Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher
Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2024-2755 Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes
Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes...
GO-2024-2697 Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana
Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2880 Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik...
GO-2024-2703 Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia...
GO-2024-2727 Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation
Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation...
GO-2024-2575 Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3
Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3...
GO-2024-2822 Arbitrary code execution in github.com/tiagorlampert/CHAOS
A remote attacker can execute arbitrary commands via crafted HTTP requests...
GO-2022-0503 Denial of service via malformed CAR data in github.com/ipld/go-car and go-car/v2
Decoding malformed CAR data can cause panics or excessive memory usage...
GO-2022-0461 Unbounded memory consumption in github.com/pion/dtls/v2
Attacker can cause unbounded memory consumption. The Pion DTLS client and server buffer handshake data with no upper limit, permitting an attacker to cause unbounded memory consumption by sending an unterminated handshake...
GO-2020-0014 Infinite loop due to improper handling of "select" tags in golang.org/x/net/html
html.Parse does not properly handle "select" tags, which can lead to an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...
GO-2026-6462 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone...
GO-2026-6441 Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc
In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules such as DENY referencing headers with uppercase or mixed-case characters, the rule fails to match, causing...
GO-2026-6388 SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Password protected tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password publish mode in github.com/siyuan-note/siyuan/kernel...
GO-2026-6371 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore...
GO-2026-6308 Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id in code.vikunja.io/api
Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body taskid in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-6299 statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng
statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng...
GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...
GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution
In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...
GO-2026-6190 Unsafe file permission restoration from metadata in github.com/rclone/rclone
Unsafe file permission restoration from metadata in github.com/rclone/rclone...
GO-2026-6138 Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td
Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td...
GO-2026-6129 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption in github.com/fission/fission
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAPSYSTIME and cross-tenant node wall-clock corruption in github.com/fission/fission...
GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...
GO-2026-6058 Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...
GO-2026-6075 Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea
Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea...
GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...
GO-2026-6083 Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev...
GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...
GO-2026-5912 GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber...
GO-2026-5548 PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in github.com/pocketbase/pocketbase
PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in github.com/pocketbase/pocketbase...
GO-2026-5336 Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git
Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git...