GO-2024-3124 Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp

Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function...

GO-2022-0888 Crash due to malformed relay protocol message in github.com/syncthing/syncthing

Crash due to malformed relay protocol message in github.com/syncthing/syncthing...

GO-2022-0855 Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server

Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server...

GO-2022-0806 Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad

Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad...

GO-2022-0825 Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault...

GO-2022-0632 Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault

Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault...

GO-2022-0458 Improper Privilege Management in Cilium in github.com/cilium/cilium

Improper Privilege Management in Cilium in github.com/cilium/cilium...

GO-2022-0387 Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd

Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd...

GO-2022-0363 Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o

Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o...

GO-2022-0365 User object created with invalid provider data in GoTrue in github.com/netlify/gotrue

User object created with invalid provider data in GoTrue in github.com/netlify/gotrue...

GO-2023-1894 code.gitea.io/gitea Open Redirect vulnerability

code.gitea.io/gitea Open Redirect vulnerability...

GO-2023-1828 Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul

Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul...

GO-2023-1544 Podman has Files or Directories Accessible to External Parties in github.com/containers/libpod

Podman has Files or Directories Accessible to External Parties in github.com/containers/libpod...

GO-2024-2971 Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs

Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs...

GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server

Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...

GO-2024-2732 Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos

Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos...

GO-2024-2872 github.com/bincyber/go-sqlcrypter vulnerable to IV collision

github.com/bincyber/go-sqlcrypter vulnerable to IV collision...

GO-2024-2846 Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd...

GO-2023-1881 The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk

If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is not charged. No patch will be released, as the package is planned to be deprecated and replaced...

GO-2026-6656 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner...

GO-2026-6626 SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel...

GO-2026-6615 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log...

GO-2026-6565 SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet

SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet...

GO-2026-6564 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...

GO-2026-6548 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel

Dasel: Selector lexer panics on trailing whitespace in parseCurRune in github.com/tomwright/dasel...

GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...

GO-2026-6594 Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod

Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod...

GO-2026-6550 SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo

SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo...

GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition

nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...

GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot

Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot...

GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses

Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...

GO-2026-6538 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit

k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit...

GO-2026-6530 Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot...

GO-2026-6486 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha

Nezha: OAuth2 redirecturi Host header injection regression when dashboardhost is empty in github.com/nezhahq/nezha...

GO-2026-6526 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive...

GO-2026-6544 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6485 Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker

Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker...

GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

GO-2026-6529 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...

GO-2026-6464 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone...

GO-2026-6400 SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode) in github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode in github.com/siyuan-note/siyuan/kernel...

GO-2026-6343 Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea

Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea...

GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf

ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...

GO-2026-6423 SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel...

GO-2026-6344 Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea

Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea...

GO-2026-6407 SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel...

GO-2026-6364 SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel...

GO-2026-6302 Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2

Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2...

GO-2026-6333 Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea

Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea...