GO-2025-4172 Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost

Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GO-2025-4118 File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser

File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser...

GO-2025-4085 Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel

Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd...

GO-2025-3988 Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail

Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail...

GO-2025-4076 Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation

Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation...

GO-2025-4072 Karmada Dashboard API Unauthorized Access Vulnerability in github.com/karmada-io/dashboard

Karmada Dashboard API Unauthorized Access Vulnerability in github.com/karmada-io/dashboard...

GO-2025-4057 Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server...

GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd...

GO-2025-3971 DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly

DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly...

GO-2025-3972 Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly

Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly...

GO-2025-3943 listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk

listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk...

GO-2025-3929 Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark

Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark...

GO-2025-3891 Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent

Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent...

GO-2025-3864 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3851 Ollama allows deletion of arbitrary files in github.com/ollama/ollama

Ollama allows deletion of arbitrary files in github.com/ollama/ollama...

GO-2025-3855 OpenBao Userpass and LDAP User Lockout Bypass in github.com/openbao/openbao

OpenBao Userpass and LDAP User Lockout Bypass in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2025-3847 Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego

Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego...

GO-2025-3841 Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault

Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault...

GO-2025-3832 OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 in github.com/oauth2-proxy/oauth2-proxy

OAuth2-Proxy's --gitlab-group GitLab Group Authorization config flag stopped working in v7.0.0 in github.com/oauth2-proxy/oauth2-proxy...

GO-2025-3818 Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server

Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server...

GO-2025-3784 filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser

filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser...

GO-2025-3787 May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure

May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure...

GO-2025-3748 Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) in github.com/pion/interceptor

Pion Interceptor's improper RTP padding handling allows remote crash for SFU users DoS in github.com/pion/interceptor...

GO-2025-3740 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana

Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3718 Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast

Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast...

GO-2025-3696 Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener

Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener...

GO-2025-3636 one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api

one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api...

GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno

Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...

GO-2025-3611 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-3564 ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx

ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3554 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin

Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin...

GO-2025-3543 WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc

This report has been withdrawn with reason: "Does not affect Go code.". https://nvd.nist.gov/vuln/detail/CVE-2025-27612 lists https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 which caused automation to flag as Go; the affected repo is https://github.com/youki-dev/you...

GO-2025-3539 OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console

OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console...

GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad

Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...

GO-2025-3448 Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm

Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm...

GO-2025-3455 Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast

Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast...

GO-2025-3410 Insecure default config access in WriteFreely in github.com/writefreely/writefreely

Insecure default config access in WriteFreely in github.com/writefreely/writefreely...

GO-2025-3394 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GO-2025-3401 matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo

matrix-media-repo MMR allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo...

GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2024-3358 SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol

SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol...

GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5

Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...

GO-2024-3213 Plenti arbitrary file write vulnerability in github.com/plentico/plenti

Plenti arbitrary file write vulnerability in github.com/plentico/plenti...

GO-2024-3184 Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome

Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome...

GO-2024-3190 Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist

Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist...

GO-2024-3162 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault...

GO-2024-3102 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver

OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver...

GO-2022-1252 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos

usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...

GO-2022-1206 CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation in github.com/cri-o/cri-o

CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation in github.com/cri-o/cri-o...