4632 matches found
GO-2026-5281 opentelemetry-go's Schema ParseFile leaks file descriptors on each parse in go.opentelemetry.io/otel/schema
opentelemetry-go's Schema ParseFile leaks file descriptors on each parse in go.opentelemetry.io/otel/schema...
GO-2026-5284 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio...
GO-2026-5091 Gitea has insecure default SSH settings in code.gitea.io/gitea
Gitea has insecure default SSH settings in code.gitea.io/gitea...
GO-2026-5168 Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus
Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus...
GO-2026-4989 MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx
MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx...
GO-2026-4869 Unbounded allocation for old GNU sparse in archive/tar
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format...
GO-2026-4910 Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git
Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git...
GO-2026-4789 Packetbeat does not properly validate an array index in multiple protocol parser components in github.com/elastic/beats
Packetbeat does not properly validate an array index in multiple protocol parser components in github.com/elastic/beats...
GO-2026-4906 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse in github.com/0xJacky/Nginx-UI
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse in github.com/0xJacky/Nginx-UI...
GO-2026-4904 nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover in github.com/0xJacky/Nginx-UI
nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover in github.com/0xJacky/Nginx-UI...
GO-2026-4863 Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast
Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast...
GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc...
GO-2026-4845 Harbor allows the use of the default password for web UI login in github.com/goharbor/harbor
Harbor allows the use of the default password for web UI login in github.com/goharbor/harbor...
GO-2026-4849 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4724 Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloudnativelabs/kube-router
Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS in github.com/cloudnativelabs/kube-router...
GO-2026-4817 GoDoxy has a Path Traversal Vulnerability in its File API in github.com/yusing/godoxy
GoDoxy has a Path Traversal Vulnerability in its File API in github.com/yusing/godoxy...
GO-2026-4719 Romeo is vulnerable to Archive Slip due to missing checks in sanitization in github.com/ctfer-io/romeo/webserver
Romeo is vulnerable to Archive Slip due to missing checks in sanitization in github.com/ctfer-io/romeo/webserver...
GO-2026-4709 SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure in github.com/siyuan-note/siyuan/kernel...
GO-2026-4807 Ory Hydra has a SQL injection via forged pagination tokens in github.com/ory/hydra
Ory Hydra has a SQL injection via forged pagination tokens in github.com/ory/hydra...
GO-2026-4805 Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api
Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2026-4794 Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api
Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api...
GO-2026-4783 Ella Core panics on invalid PDU Session IDs in NGAP messages in github.com/ellanetworks/core
Ella Core panics on invalid PDU Session IDs in NGAP messages in github.com/ellanetworks/core...
GO-2026-4798 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api
Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement in code.vikunja.io/api...
GO-2026-4777 Juju has unauthorized access to out-of-scope Kubernetes secrets in github.com/juju/juju
Juju has unauthorized access to out-of-scope Kubernetes secrets in github.com/juju/juju...
GO-2026-4776 Ella Core panics on malformed ULNASTransport Message without a Request Type in github.com/ellanetworks/core
Ella Core panics on malformed ULNASTransport Message without a Request Type in github.com/ellanetworks/core...
GO-2026-4735 Mattermost fails to filter invite IDs based on user permissions in github.com/mattermost/mattermost-server
Mattermost fails to filter invite IDs based on user permissions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4518 Denial of service in github.com/jackc/pgproto3/v2
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic...
GO-2026-4692 Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core...
GO-2026-4668 zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) in zotregistry.dev/zot
zot’s create-only policy allows overwrite attempts of existing latest tag update permission not required in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4671 Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval in github.com/anchore/quill
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval in github.com/anchore/quill...
GO-2026-4656 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange in github.com/pocket-id/pocket-id/backend
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange in github.com/pocket-id/pocket-id/backend...
GO-2026-4595 Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd
Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd...
GO-2026-4606 File Browser's TUS Delete Endpoint Bypasses Delete Permission Check in github.com/filebrowser/filebrowser
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check in github.com/filebrowser/filebrowser...
GO-2026-4604 ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication in github.com/zitadel/zitadel
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2026-4643 WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora
WeKnora has DNS Rebinding Vulnerability in webfetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora...
GO-2026-4645 WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation in github.com/Tencent/WeKnora
WeKnora has Remote Code Execution RCE via Command Injection in MCP Stdio Configuration Validation in github.com/Tencent/WeKnora...
GO-2026-4618 Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs
Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs...
GO-2026-4628 WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora
WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora...
GO-2026-4627 Gogs: DOM-based XSS via milestone selection in gogs.io/gogs
Gogs: DOM-based XSS via milestone selection in gogs.io/gogs...
GO-2026-4620 Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs
Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2026-4577 malcontent: Nested archive extraction failure can drop content from scan inputs in github.com/chainguard-dev/malcontent
malcontent: Nested archive extraction failure can drop content from scan inputs in github.com/chainguard-dev/malcontent...
GO-2026-4567 Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess
Vitess users with backup storage access can gain unauthorized access to production deployment environments in vitess.io/vitess...
GO-2026-4570 Vitess users with backup storage access can write to arbitrary file paths in vitess.io/vitess
Vitess users with backup storage access can write to arbitrary file paths on restore in vitess.io/vitess...
GO-2026-4599 Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered...
GO-2026-4552 Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api
Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module in code.vikunja.io/api...
GO-2026-4545 esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh
esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh...
GO-2026-4509 Fingerprint vulnerability in uTLS from GREASE ECH mismatch for Chrome parrots in github.com/refraction-networking/utls
Fingerprint vulnerability in uTLS from GREASE ECH mismatch for Chrome parrots in github.com/refraction-networking/utls...
GO-2026-4394 OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk...
GO-2026-4361 Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft
Inconsistencies between how commit signatures are verified and how block time is derived in github.com/cometbft/cometbft...