4632 matches found
GO-2026-5285 Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin
Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin...
GO-2026-5394 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs PUT Upload in github.com/patrickhener/goshs...
GO-2026-5288 Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled in github.com/apernet/hysteria/core
Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled in github.com/apernet/hysteria/core...
GO-2026-5239 OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga...
GO-2026-5256 Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server
Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-5229 SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView` in github.com/siyuan-note/siyuan/kernel
SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via /api/av/removeUnusedAttributeView in github.com/siyuan-note/siyuan/kernel...
GO-2026-5243 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea...
GO-2026-5222 nhost has Session Persistence After Password Change in github.com/nhost/nhost
nhost has Session Persistence After Password Change in github.com/nhost/nhost...
GO-2026-5204 Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches DoS in github.com/klever-io/klever-go...
GO-2026-5187 PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw
PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw...
GO-2026-5223 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml in github.com/juev/nebula-mesh
nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml in github.com/juev/nebula-mesh...
GO-2026-5217 Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer
Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5270 Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace
Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace...
GO-2026-5275 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals in go.opentelemetry.io/obi...
GO-2026-5253 OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR in go.opentelemetry.io/obi...
GO-2026-5235 Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows
Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows...
GO-2026-5195 Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware in github.com/traefik/traefik
Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware in github.com/traefik/traefik...
GO-2026-5224 Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go...
GO-2026-5225 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner
Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...
GO-2026-5221 goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs...
GO-2026-5068 Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode in github.com/inspektor-gadget/inspektor-gadget
Inspektor Gadget uses unsanitized ANSI Escape Sequences In columns Output Mode in github.com/inspektor-gadget/inspektor-gadget...
GO-2026-5124 Gogs has DoS in rendering issue index pattern in gogs.io/gogs
Gogs has DoS in rendering issue index pattern in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edi...
GO-2026-5086 Caddy Defender trusted proxy client IP bypass in pkg.jsn.cam/caddy-defender
Caddy Defender trusted proxy client IP bypass in pkg.jsn.cam/caddy-defender...
GO-2026-5170 OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga
OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga...
GO-2026-5083 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services in github.com/traefik/traefik
Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services in github.com/traefik/traefik...
GO-2026-5161 Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator...
GO-2026-5113 ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub
ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub...
GO-2026-5077 Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding in github.com/xddxdd/bird-lg-go
Bird-lg-go has a Fatal Out-of-Memory OOM Denial of Service via Unbounded JSON Decoding in github.com/xddxdd/bird-lg-go...
GO-2026-5128 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails in github.com/traefik/traefik
Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails in github.com/traefik/traefik...
GO-2026-5095 Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana
Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5082 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission
Fission router exposes /fission-function// on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission...
GO-2026-5140 Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES in gogs.io/gogs
Gogs's password-reset tokens use account-activation lifetime, ignoring RESETPASSWORDCODELIVES in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-5072 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows
Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows...
GO-2026-5093 free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef
free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef...
GO-2026-5126 opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter
opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter...
GO-2026-5120 Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers in github.com/openclaw/crabbox
Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers in github.com/openclaw/crabbox...
GO-2026-5100 Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers in github.com/lin-snow/ech0...
GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all...
GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close, resulting in a resource leak per connection. Unsolicited global responses are now discarded...
GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
The Verify method for FIDO/U2F security key types [email protected], [email protected] did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,...
GO-2026-5014 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError...
GO-2026-4909 Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git
Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git...
GO-2026-4738 File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser
File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser...
GO-2026-4874 Ella Core has a Denial of Service via SCTP connection cleanup deadlock in github.com/ellanetworks/core
Ella Core has a Denial of Service via SCTP connection cleanup deadlock in github.com/ellanetworks/core...
GO-2026-4905 Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) in github.com/gotenberg/gotenberg
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme bypass of GHSA-rh2x-ccvw-q7r3 in github.com/gotenberg/gotenberg...
GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker...
GO-2026-4850 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4843 SiYuan has directory traversal within its publishing service in github.com/siyuan-note/siyuan/kernel
SiYuan has directory traversal within its publishing service in github.com/siyuan-note/siyuan/kernel...