4632 matches found
GO-2026-4593 Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS in github.com/traefik/traefik...
GO-2026-4581 INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints in github.com/romitou/insatutorat
INSATutorat has an authorization bypass vulnerability in its /api/admin/ endpoints in github.com/romitou/insatutorat...
GO-2026-4571 Beszel: Docker API has a Path Traversal Vulnerability via Unsanitized Container ID in github.com/henrygd/beszel
Beszel: Docker API has a Path Traversal Vulnerability via Unsanitized Container ID in github.com/henrygd/beszel...
GO-2026-4553 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api...
GO-2026-4410 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko...
GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in github.com/mattermost/mattermost-server
Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-4507 Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum
Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2026-4499 Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs
Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4506 opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path in github.com/open-policy-agent/opa-envoy-plugin
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsedpath in github.com/open-policy-agent/opa-envoy-plugin...
GO-2026-4473 Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git
Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git...
GO-2026-4358 Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore
Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore...
GO-2026-4435 EVE Doesn't Protect Rootfs in github.com/lf-edge/eve
EVE Doesn't Protect Rootfs in github.com/lf-edge/eve...
GO-2026-4490 NeuVector scanner insecurely handles passwords as command arguments in github.com/neuvector/scanner
NeuVector scanner insecurely handles passwords as command arguments in github.com/neuvector/scanner. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4463 Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations in github.com/mattermost/mattermost-server
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4461 Antrea has invalid enforcement order for network policy rules caused by integer overflow in antrea.io/antrea
Antrea has invalid enforcement order for network policy rules caused by integer overflow in antrea.io/antrea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2026-4466 Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service in github.com/bishopfox/sliver
Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service in github.com/bishopfox/sliver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4493 Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC in github.com/yokecd/yoke
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC in github.com/yokecd/yoke...
GO-2026-4449 Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs
Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2026-4406 apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko...
GO-2026-4347 SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel
SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel...
GO-2026-4386 SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal in github.com/siyuan-note/siyuan/kernel
SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal in github.com/siyuan-note/siyuan/kernel...
GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea
Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea...
GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea
Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea...
GO-2026-4314 High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum
High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2026-4303 Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server...
GO-2025-4269 SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle
SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle...
GO-2025-4148 Mattermost Server is vulnerable to Directory Traversal by System Admins in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to Directory Traversal by System Admins in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2025-4137 authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io
authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-4224 OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs in github.com/opentofu/opentofu...
GO-2025-4221 SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE in github.com/siyuan-note/siyuan/kernel
SiYuan: ZipSlip - Arbitrary File Overwrite - RCE in github.com/siyuan-note/siyuan/kernel...
GO-2025-4204 Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server
Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server...
GO-2025-4211 Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in github.com/babylonlabs-io/babylon
Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in github.com/babylonlabs-io/babylon...
GO-2025-4213 ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in github.com/zitadel/zitadel
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4215 memos vulnerability allows arbitrarily reactions deletion in github.com/usememos/memos
memos vulnerability allows arbitrarily reactions deletion in github.com/usememos/memos...
GO-2025-4182 Coder logs sensitive objects unsanitized in github.com/coder/coder
Coder logs sensitive objects unsanitized in github.com/coder/coder...
GO-2025-4183 CVE-2017-18870 in github.com/mattermost/mattermost-server
CVE-2017-18870 in github.com/mattermost/mattermost-server...
GO-2025-4178 Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost
Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost...
GO-2025-4189 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through authorlink field in Slack attachments in github.com/mattermost/mattermost-server...
GO-2025-4133 Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server
Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4097 Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc
Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc...
GO-2025-4131 Mattermost allows regular users to access archived channel content and files in github.com/mattermost/mattermost-server
Mattermost allows regular users to access archived channel content and files in github.com/mattermost/mattermost-server...
GO-2025-4117 File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function in github.com/filebrowser/filebrowser
File Browser is Vulnerable to Insecure Direct Object Reference IDOR in Share Deletion Function in github.com/filebrowser/filebrowser...
GO-2025-4090 lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs
lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs...
GO-2025-4113 OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy...
GO-2025-4067 OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-4063 Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server
Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server...
GO-2025-4064 Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server...
GO-2025-4060 Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server
Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server...
GO-2025-4065 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server...