4632 matches found
GO-2025-4226 Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
Miniflux has an Open Redirect via protocol-relative redirecturl in miniflux.app...
GO-2025-4214 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon...
GO-2025-4200 Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials in github.com/mattermost/mattermost-server
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials in github.com/mattermost/mattermost-server...
GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik
Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik...
GO-2025-4151 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb...
GO-2025-4124 ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel
ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4125 Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator...
GO-2025-4026 Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor
Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2025-4040 NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird
NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird...
GO-2025-4048 Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server...
GO-2025-4050 Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server...
GO-2025-4034 MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS in github.com/minio/minio
MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS in github.com/minio/minio...
GO-2025-4029 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-4056 Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...
GO-2025-4033 Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol
Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol...
GO-2025-3994 Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd
Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd...
GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh
esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...
GO-2025-3968 Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly...
GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...
GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3917 NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector
NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3919 NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3894 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3852 operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd in github.com/operator-framework/operator-sdk
operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd in github.com/operator-framework/operator-sdk...
GO-2025-3853 OpenBao TOTP Secrets Engine Code Reuse in github.com/openbao/openbao
OpenBao TOTP Secrets Engine Code Reuse in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2025-3831 Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos
Memos has Cross-Site Scripting XSS Vulnerability in Image URLs in github.com/usememos/memos...
GO-2025-3830 Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker...
GO-2025-3794 File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser
File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser...
GO-2025-3771 Mattermost allows an unauthorized Guest user access to Playbook in github.com/mattermost/mattermost-server
Mattermost allows an unauthorized Guest user access to Playbook in github.com/mattermost/mattermost-server...
GO-2025-3806 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju...
GO-2025-3778 Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs
Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs...
GO-2025-3804 Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju
Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju...
GO-2025-3808 Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager...
GO-2025-3810 Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager
Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager...
GO-2025-3803 Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk
Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk...
GO-2025-3757 Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server
Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server...
GO-2025-3742 Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana
Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3733 Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome
Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome...
GO-2025-3726 IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli
IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli...
GO-2025-3721 ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3664 Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2
Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2...
GO-2025-3689 Ollama Divide by Zero Vulnerability in github.com/ollama/ollama
Ollama Divide by Zero Vulnerability in github.com/ollama/ollama...
GO-2025-3656 Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano...
GO-2025-3631 GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp
GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp...
GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server...
GO-2025-3537 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza
OWASP Coraza WAF has parser confusion which leads to wrong URI in REQUESTFILENAME in github.com/corazawaf/coraza...
GO-2025-3492 Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos
Memos Server-Side Request Forgery SSRF in github.com/usememos/memos...
GO-2025-3454 Plenti - Code Injection - Denial of Services in github.com/plentico/plenti
Plenti - Code Injection - Denial of Services in github.com/plentico/plenti...
GO-2025-3408 WITHDRAWN: DefaultConfig has dangerous defaults causing hung Read in github.com/hashicorp/yamux
This report has been withdrawn with reason: "By request of maintainer in https://github.com/golang/vulndb/issues/3453". The default values for Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout of 30s and 10s create the possibility for timed out writes that most aren't...