4632 matches found
GO-2026-5309 Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo
Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo...
GO-2026-5198 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute in github.com/osrg/gobgp
GoBGP: Remote Denial of Service Panic via Malformed Well-known Path Attribute in github.com/osrg/gobgp...
GO-2026-5069 Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber
Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber...
GO-2026-5880 Hardlink path traversal during tar extraction in oras.land/oras-go
Hardlink path traversal during tar extraction in oras.land/oras-go...
GO-2026-5074 Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git
Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git...
GO-2026-5597 Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy
Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy...
GO-2026-5542 Path traversal via malicious package name in github.com/zarf-dev/zarf
A path traversal vulnerability in Zarf allows an attacker to write arbitrary files on the host system by providing a malicious package name in the package metadata. This occurs when Zarf generates SBOM or documentation outputs, or when creating a package, as it fails to properly sanitize the...
GO-2026-6013 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-6028 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) in gitea.dev
Gitea: Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939 in gitea.dev...
GO-2026-6024 File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser
File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser...
GO-2026-6018 Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper...
GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...
GO-2026-6016 oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen...
GO-2026-5991 nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh
nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh...
GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5934 netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil...
GO-2026-5977 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly...
GO-2026-5975 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly...
GO-2026-5980 yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu
yutu: Arbitrary File Write via MCP caption-download Tool in github.com/eat-pray-ai/yutu...
GO-2026-5950 nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh
nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh...
GO-2026-5997 safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl
safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl...
GO-2026-5967 SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content in github.com/siyuan-note/siyuan/kernel...
GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...
GO-2026-5699 GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/osrg/gobgp
GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/osrg/gobgp...
GO-2026-5496 Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git
Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git...
GO-2026-5895 Casdoor has an authentication bypass in github.com/casdoor/casdoor
Casdoor has an authentication bypass in github.com/casdoor/casdoor...
GO-2026-5876 Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher
Rancher has Privilege Escalation from Project Owner to Host in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5828 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key in github.com/nezhahq/nezha
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwtsecretkey in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-5836 Mattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github
Mattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github...
GO-2026-5854 Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance in github.com/fission/fission
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance in github.com/fission/fission...
GO-2026-5769 Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint in github.com/mattermost/mattermost-server
Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5765 Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs
Gogs has Unauthenticated Asymmetric Denial of Service DoS via SSH Handshake Stall File Descriptor Exhaustion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5737 Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri in github.com/authorizerdev/authorizer
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirecturi in github.com/authorizerdev/authorizer...
GO-2026-5641 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec...
GO-2026-5636 Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg
Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg...
GO-2026-5643 Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline...
GO-2026-5598 Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join in github.com/daytonaio/daytona
Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join in github.com/daytonaio/daytona...
GO-2026-5612 Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus...
GO-2026-5511 FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) in github.com/gtsteffaniak/filebrowser
FileBrowser Vulnerable to Stored XSS via SVG File in Public Share Missing CSP Header in github.com/gtsteffaniak/filebrowser...
GO-2026-5550 Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output in github.com/couchbase/sync_gateway
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output in github.com/couchbase/syncgateway. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5616 S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy
S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy...
GO-2026-5628 Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go
Klever-Go KVM: Unauthenticated remote node crash nil-pointer DoS in klever-go P2P transaction interceptor txVersionChecker nil RawData - potential chain halt in github.com/klever-io/klever-go...
GO-2026-5522 Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace in github.com/mattermost/mattermost-server
Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-5560 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo...
GO-2026-5583 CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns...
GO-2026-5484 Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server
Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-5407 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr...
GO-2026-5507 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server
Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server...
GO-2026-5431 Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session in github.com/lin-snow/ech0
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5425 Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator
Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator...