4632 matches found
GO-2026-4331 Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings
Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings...
GO-2026-4342 Excessive CPU consumption when building archive index in archive/zip
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...
GO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tls
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...
GO-2026-4338 Unexpected code execution when invoking toolchain in cmd/go
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...
GO-2026-4318 DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface in github.com/donknap/dpanel
DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface in github.com/donknap/dpanel...
GO-2026-4317 Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server
Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server...
GO-2026-4321 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs...
GO-2026-4304 CVE-2017-18901 in github.com/mattermost/mattermost-server
CVE-2017-18901 in github.com/mattermost/mattermost-server...
GO-2026-4274 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea
Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea...
GO-2026-4278 HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad...
GO-2026-4277 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4281 Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer
Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer...
GO-2025-4262 Gitea: anonymous user can visit private user's project in code.gitea.io/gitea
Gitea: anonymous user can visit private user's project in code.gitea.io/gitea...
GO-2025-4255 Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls
Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls...
GO-2025-4256 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost...
GO-2025-4258 Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea
Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea...
GO-2025-4162 Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API in github.com/free5gc/openapi
Free5GC is vulnerable to DoS via the NudmSubscriberDataManagement API in github.com/free5gc/openapi...
GO-2025-4191 Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server
Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-4202 Mattermost Server allows attackers to create buttons that can launch API requests in github.com/mattermost/mattermost-server
Mattermost Server allows attackers to create buttons that can launch API requests in github.com/mattermost/mattermost-server...
GO-2025-4198 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider in github.com/mattermost/mattermost-server
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider in github.com/mattermost/mattermost-server...
GO-2025-4190 Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server...
GO-2025-4172 Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost
Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2025-4118 File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser
File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser...
GO-2025-4085 Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel
Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd...
GO-2025-3988 Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail
Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail...
GO-2025-4076 Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation
Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation...
GO-2025-4072 Karmada Dashboard API Unauthorized Access Vulnerability in github.com/karmada-io/dashboard
Karmada Dashboard API Unauthorized Access Vulnerability in github.com/karmada-io/dashboard...
GO-2025-4057 Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server
Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server...
GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd...
GO-2025-3971 DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly
DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly...
GO-2025-3972 Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly...
GO-2025-3943 listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk...
GO-2025-3891 Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent
Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent...
GO-2025-3851 Ollama allows deletion of arbitrary files in github.com/ollama/ollama
Ollama allows deletion of arbitrary files in github.com/ollama/ollama...
GO-2025-3841 Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault
Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault...
GO-2025-3818 Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server
Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server...
GO-2025-3796 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3787 May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure
May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure...
GO-2025-3748 Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) in github.com/pion/interceptor
Pion Interceptor's improper RTP padding handling allows remote crash for SFU users DoS in github.com/pion/interceptor...
GO-2025-3740 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3737 Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi
Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3705 zot logs secrets in zotregistry.dev/zot
zot logs secrets in zotregistry.dev/zot...
GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...
GO-2025-3564 ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx
ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3554 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin...
GO-2025-3543 WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc
This report has been withdrawn with reason: "Does not affect Go code.". https://nvd.nist.gov/vuln/detail/CVE-2025-27612 lists https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 which caused automation to flag as Go; the affected repo is https://github.com/youki-dev/you...
GO-2025-3539 OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console
OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console...