4632 matches found
GO-2025-4046 Mattermost Server is vulnerable to Uncontrolled Resource Consumption in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to Uncontrolled Resource Consumption in github.com/mattermost/mattermost-server...
GO-2025-4053 Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server
Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server...
GO-2025-4051 Mattermost Server does not enforce rate limits on password change attempts in github.com/mattermost/mattermost-server
Mattermost Server does not enforce rate limits on password change attempts in github.com/mattermost/mattermost-server...
GO-2025-3998 NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook in github.com/NVIDIA/gpu-operator
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook in github.com/NVIDIA/gpu-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3929 Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark
Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark...
GO-2025-3923 Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher
Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3907 Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server
Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server...
GO-2025-3906 Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server
Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server...
GO-2025-3864 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3855 OpenBao Userpass and LDAP User Lockout Bypass in github.com/openbao/openbao
OpenBao Userpass and LDAP User Lockout Bypass in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2025-3847 Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego
Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego...
GO-2025-3843 Grafana Infinity Datasource Plugin SSRF Vulnerability in github.com/grafana/grafana-infinity-datasource
Grafana Infinity Datasource Plugin SSRF Vulnerability in github.com/grafana/grafana-infinity-datasource...
GO-2025-3832 OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 in github.com/oauth2-proxy/oauth2-proxy
OAuth2-Proxy's --gitlab-group GitLab Group Authorization config flag stopped working in v7.0.0 in github.com/oauth2-proxy/oauth2-proxy...
GO-2025-3839 Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault
Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault...
GO-2025-3827 eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper
eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper...
GO-2025-3762 New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd
New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd...
GO-2025-3784 filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser
filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser...
GO-2025-3748 Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) in github.com/pion/interceptor
Pion Interceptor's improper RTP padding handling allows remote crash for SFU users DoS in github.com/pion/interceptor...
GO-2025-3740 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3718 Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast
Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3702 Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env
Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env...
GO-2025-3696 Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener
Gardener allows bypassing project secret validation which can lead to privilege escalation in github.com/gardener/gardener...
GO-2025-3648 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle MitM attacks in github.com/rancher/stev. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3645 Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes
Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes...
GO-2025-3637 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3636 one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api
one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api...
GO-2025-3611 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3586 Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher
Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...
GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...
GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...
GO-2025-3487 Potential denial of service in golang.org/x/crypto
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
GO-2025-3448 Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm
Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm...
GO-2025-3455 Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast
Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast...
GO-2025-3409 Zot IdP group membership revocation ignored in zotregistry.dev/zot
Zot IdP group membership revocation ignored in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2025-3372 Vulnerability when creating log files in github.com/golang/glog
When logs are written to a widely-writable directory the default, an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that...
GO-2025-3393 Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server
Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server...
GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5
Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...
GO-2024-3190 Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist
Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist...
GO-2024-3182 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu...
GO-2024-3173 JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju
JUJUCONTEXTID is a predictable authentication secret in github.com/juju/juju...
GO-2024-3102 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver...
GO-2022-1252 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-0937 Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish
Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish...
GO-2022-0982 Improper Privilege Management in Gitea in code.gitea.io/gitea
Improper Privilege Management in Gitea in code.gitea.io/gitea...
GO-2022-0611 HashiCorp Vault Incorrect Permission Assignment for Critical Resource in github.com/hashicorp/vault
HashiCorp Vault Incorrect Permission Assignment for Critical Resource in github.com/hashicorp/vault...
GO-2022-0622 Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad
Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad...