4632 matches found
GO-2026-4298 Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server
Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server...
GO-2025-4264 Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea...
GO-2025-4265 Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea
Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea...
GO-2025-4247 Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost
Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-4230 1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality in github.com/1Panel-dev/1Panel
1Panel contains a cross-site request forgery CSRF vulnerability in the panel name management functionality in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4214 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon...
GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik
Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik...
GO-2025-4124 ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel
ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4104 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2025-4026 Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor
Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2025-4056 Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...
GO-2025-3994 Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd
Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd...
GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh
esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...
GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2025-3919 NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3852 operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd in github.com/operator-framework/operator-sdk
operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd in github.com/operator-framework/operator-sdk...
GO-2025-3853 OpenBao TOTP Secrets Engine Code Reuse in github.com/openbao/openbao
OpenBao TOTP Secrets Engine Code Reuse in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2025-3831 Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos
Memos has Cross-Site Scripting XSS Vulnerability in Image URLs in github.com/usememos/memos...
GO-2025-3830 Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker...
GO-2025-3849 Incorrect results returned from Rows.Scan in database/sql
Cancelling a query e.g. by cancelling the context passed to one of the query methods during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with...
GO-2025-3810 Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager
Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager...
GO-2025-3794 File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser
File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser...
GO-2025-3804 Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju
Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju...
GO-2025-3771 Mattermost allows an unauthorized Guest user access to Playbook in github.com/mattermost/mattermost-server
Mattermost allows an unauthorized Guest user access to Playbook in github.com/mattermost/mattermost-server...
GO-2025-3808 Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive in github.com/ctfer-io/chall-manager...
GO-2025-3758 Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad...
GO-2025-3778 Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs
Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs...
GO-2025-3803 Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk
Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk...
GO-2025-3757 Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server
Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server...
GO-2025-3743 CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns...
GO-2025-3733 Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome
Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome...
GO-2025-3721 ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3631 GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp
GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp...
GO-2025-3585 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input in github.com/beego/beego
Beego allows Reflected/Stored XSS in Beego's RenderForm Function Due to Unescaped User Input in github.com/beego/beego...
GO-2025-3537 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza
OWASP Coraza WAF has parser confusion which leads to wrong URI in REQUESTFILENAME in github.com/corazawaf/coraza...
GO-2025-3494 IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go...
GO-2025-3408 WITHDRAWN: DefaultConfig has dangerous defaults causing hung Read in github.com/hashicorp/yamux
This report has been withdrawn with reason: "By request of maintainer in https://github.com/golang/vulndb/issues/3453". The default values for Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout of 30s and 10s create the possibility for timed out writes that most aren't...
GO-2025-3371 WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2024-3101 Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts...
GO-2024-3339 Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk
Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk...
GO-2024-3340 Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server
Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3313 Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd
Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd...
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3228 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Coder vulnerable to post-auth URL redirection to untrusted site 'Open Redirect' in github.com/coder/coder...
GO-2024-3220 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...
GO-2024-3141 OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa
OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions...