4632 matches found
GO-2023-1581 Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad
Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad...
GO-2024-3038 In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient
In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient...
GO-2024-2970 Gogs allows deletion of internal files in github.com/gogs/gogs
Gogs allows deletion of internal files in github.com/gogs/gogs...
GO-2024-2971 Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs
Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs...
GO-2024-2529 Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd
Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd...
GO-2024-2737 IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker
IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker...
GO-2024-2726 Traefik affected by HTTP/2 CONTINUATION flood in net/http in github.com/traefik/traefik
Traefik affected by HTTP/2 CONTINUATION flood in net/http in github.com/traefik/traefik...
GO-2024-2872 github.com/bincyber/go-sqlcrypter vulnerable to IV collision
github.com/bincyber/go-sqlcrypter vulnerable to IV collision...
GO-2024-2649 Types for Vela Insecure Variable Substitution in github.com/go-vela/types
Types for Vela Insecure Variable Substitution in github.com/go-vela/types...
GO-2023-1534 Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
Unmarshalling a Hello Verify request can panic, which could allow a denial of service...
GO-2022-1004 Improper handling of keys in github.com/theupdateframework/go-tuf
An attacker with the ability to insert public keys into a TUF repository can cause clients to accept a staged change that has not been signed by the correct threshold of signatures...
GO-2026-6639 Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis
Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis...
GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...
GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-6574 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei
Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...
GO-2026-6572 Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers NAT64, IPv4-compatible, 6to4 reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve...
GO-2026-6590 OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator
OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-6552 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth...
GO-2026-6515 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose...
GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana
Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-6518 Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses
Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses...
GO-2026-6516 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this i...
GO-2026-6544 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6487 emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core
emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core...
GO-2026-6486 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha
Nezha: OAuth2 redirecturi Host header injection regression when dashboardhost is empty in github.com/nezhahq/nezha...
GO-2026-6457 rclone: source object names can escape the configured root on upload in github.com/rclone/rclone
rclone: source object names can escape the configured root on upload in github.com/rclone/rclone...
GO-2026-6370 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation in github.com/semaphoreui/semaphore
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation in github.com/semaphoreui/semaphore...
GO-2026-6377 SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel...
GO-2026-6358 OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo...
GO-2026-6345 Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea...
GO-2026-6357 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo...
GO-2026-6367 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium...
GO-2026-6344 Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea...
GO-2026-6343 Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea
Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea...
GO-2026-6363 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit...
GO-2026-6386 SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy in github.com/siyuan-note/siyuan/kernel
SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy in github.com/siyuan-note/siyuan/kernel...
GO-2026-6364 SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel...
GO-2026-6333 Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea
Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea...
GO-2026-6342 Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea
Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea...
GO-2026-6330 klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go
klever-go: SFT add-quantity int64 overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go...
GO-2026-6284 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui...
GO-2026-6259 Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero
Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero...
GO-2026-6286 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server
Mattermost doesn't restrict roleupdated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server...
GO-2026-6272 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit...
GO-2026-6258 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing...
GO-2026-6256 BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit...
GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A...
GO-2026-6214 Path traversal via crafted reference names in github.com/go-git/go-git
Path traversal via crafted reference names in github.com/go-git/go-git...