4632 matches found
GO-2025-4055 Mattermost Server's Session ID and Session Token are potentially compromised in github.com/mattermost/mattermost-server
Mattermost Server's Session ID and Session Token are potentially compromised in github.com/mattermost/mattermost-server...
GO-2025-4033 Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol
Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol...
GO-2025-4040 NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird
NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird...
GO-2025-4050 Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server...
GO-2025-4048 Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server...
GO-2025-4029 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-3998 NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook in github.com/NVIDIA/gpu-operator
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook in github.com/NVIDIA/gpu-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3985 kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp...
GO-2025-3991 Coder AgentAPI exposed user chat history via a DNS rebinding attack in github.com/coder/agentapi
Coder AgentAPI exposed user chat history via a DNS rebinding attack in github.com/coder/agentapi...
GO-2025-3968 Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly...
GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...
GO-2025-3917 NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector
NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3907 Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server
Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server...
GO-2025-3894 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3862 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3829 Moby firewalld reload removes bridge network isolation in github.com/docker/docker
Moby firewalld reload removes bridge network isolation in github.com/docker/docker...
GO-2025-3767 OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr...
GO-2025-3785 filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser
filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser...
GO-2025-3806 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju...
GO-2025-3744 SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb
SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb...
GO-2025-3742 Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana
Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3726 IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli
IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli...
GO-2025-3702 Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env
Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env...
GO-2025-3699 Allows host filesystem access on pull in github.com/containerd/containerd
Allows host filesystem access on pull in github.com/containerd/containerd...
GO-2025-3664 Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2
Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2...
GO-2025-3689 Ollama Divide by Zero Vulnerability in github.com/ollama/ollama
Ollama Divide by Zero Vulnerability in github.com/ollama/ollama...
GO-2025-3656 Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano...
GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server...
GO-2025-3586 Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher
Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3492 Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos
Memos Server-Side Request Forgery SSRF in github.com/usememos/memos...
GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...
GO-2025-3454 Plenti - Code Injection - Denial of Services in github.com/plentico/plenti
Plenti - Code Injection - Denial of Services in github.com/plentico/plenti...
GO-2024-3230 Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno
Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno...
GO-2024-3223 Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher
Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3217 User Registration Bypass in Zitadel in github.com/zitadel/zitadel
User Registration Bypass in Zitadel in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2022-0937 Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish
Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish...
GO-2022-0878 Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone
Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone...
GO-2022-0585 Server-Side Request Forgery in Apache Traffic Control in github.com/apache/trafficcontrol
Server-Side Request Forgery in Apache Traffic Control in github.com/apache/trafficcontrol...
GO-2022-0540 Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server
Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server...
GO-2022-0559 HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul...
GO-2022-0396 Devices resource list treated as a blacklist by default in github.com/opencontainers/runc
Devices resource list treated as a blacklist by default in github.com/opencontainers/runc...
GO-2022-0389 Unchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings
Unchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings...
GO-2022-0354 Code Injection in CRI-O in github.com/cri-o/cri-o
Code Injection in CRI-O in github.com/cri-o/cri-o...
GO-2022-0325 Skip the router TLS configuration when the host header is an FQDN in github.com/traefik/traefik
Skip the router TLS configuration when the host header is an FQDN in github.com/traefik/traefik...
GO-2023-2376 Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik...
GO-2023-2378 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks...
GO-2023-2329 HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault...
GO-2023-2071 Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc
Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc...