GO-2025-3556 Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server

Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server...

GO-2025-3536 OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive

OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive...

GO-2025-3514 cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node

cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...

GO-2025-3413 HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug

HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug...

GO-2025-3396 Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib

Server-Side Request Forgery SSRF on redirects and federation in github.com/matrix-org/gomatrixserverlib...

GO-2025-3392 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GO-2024-3356 Path Traversal in file update API in gogs in gogs.io/gogs

Path Traversal in file update API in gogs in gogs.io/gogs...

GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs

Remote Command Execution in file editing in gogs in gogs.io/gogs...

GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather

OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3306 Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess

Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess...

GO-2024-3218 Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht

Content Censorship in the InterPlanetary File System IPFS via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht...

GO-2024-3294 Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb

Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb...

GO-2024-3233 Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server

Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server...

GO-2024-3226 Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows

Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows...

GO-2024-3189 Consensus failure in github.com/btcsuite/btcd

The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split accepting an invalid block or Denial of Service DoS attacks rejecting a valid block...

GO-2024-3185 XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready

XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready...

GO-2024-3081 CWA-2024-006: wasmd non-deterministic module_query_safe query in github.com/CosmWasm/wasmd

CWA-2024-006: wasmd non-deterministic modulequerysafe query in github.com/CosmWasm/wasmd...

GO-2022-0983 ANSI escape characters not filtered in kubectl in k8s.io/kubernetes

ANSI escape characters not filtered in kubectl in k8s.io/kubernetes...

GO-2022-0886 Kubernetes Arbitrary Command Injection in k8s.io/kubernetes

Kubernetes Arbitrary Command Injection in k8s.io/kubernetes...

GO-2022-0824 Improper Input Validation in vault-ssh-helper in github.com/hashicorp/vault-ssh-helper

Improper Input Validation in vault-ssh-helper in github.com/hashicorp/vault-ssh-helper...

GO-2022-0823 Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea

Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea...

GO-2022-0815 Improper input validation in umoci in github.com/opencontainers/umoci

Improper input validation in umoci in github.com/opencontainers/umoci...

GO-2022-0631 Hard coded cryptographic key in Kiali in github.com/kiali/kiali

Hard coded cryptographic key in Kiali in github.com/kiali/kiali...

GO-2022-0580 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki in github.com/cloudflare/cfrpki

Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki in github.com/cloudflare/cfrpki...

GO-2022-0600 HashiCorp Nomad Artifact Download Race Condition in github.com/hashicorp/nomad

HashiCorp Nomad Artifact Download Race Condition in github.com/hashicorp/nomad...

GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd

Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd...

GO-2022-0231 Cross-site Scripting in github.com/schollz/rwtxt

Cross-site Scripting in github.com/schollz/rwtxt...

GO-2023-2063 HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault

HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault...

GO-2023-2080 Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium

Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium...

GO-2023-1965 Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer

Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer...

GO-2023-1899 Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad

Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad...

GO-2023-1888 1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel

1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel...

GO-2023-1865 Vega's validators able to submit duplicate transactions in code.vegaprotocol.io/vega

Vega's validators able to submit duplicate transactions in code.vegaprotocol.io/vega...

GO-2023-1785 Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium

Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium...

GO-2023-1612 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer

Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...

GO-2024-3019 soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve...

GO-2024-2994 Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes

Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes...

GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server

Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server

Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2024-2445 Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport

Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2024-2501 Denial of service in HashiCorp Consul in github.com/hashicorp/consul

Denial of service in HashiCorp Consul in github.com/hashicorp/consul...

GO-2024-2746 Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes

Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes...

GO-2024-2666 Insecure IPsec transparent encryption in github.com/cilium/cilium

Insecure IPsec transparent encryption in github.com/cilium/cilium...

GO-2022-1053 Incorrect signatures in github.com/supranational/blst

Potential creation of an invalid signature from correct inputs. Some inputs to the blstfpeuclinverse function can produce incorrect outputs. This could theoretically permit the creation of an invalid signature from correct inputs...

GO-2026-6473 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GO-2026-6428 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo...

GO-2026-6415 SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel...

GO-2026-6435 Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore

Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore...

GO-2026-6411 MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox...