4632 matches found
GO-2025-3371 WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2024-3101 Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts...
GO-2024-3339 Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk
Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk...
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3228 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Coder vulnerable to post-auth URL redirection to untrusted site 'Open Redirect' in github.com/coder/coder...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...
GO-2022-0806 Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad
Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0778 Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault
Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0632 Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0612 Stored Cross-site Scripting in gitea in code.gitea.io/gitea
Stored Cross-site Scripting in gitea in code.gitea.io/gitea...
GO-2022-0597 Cross-site Scripting in Gogs in gogs.io/gogs
Cross-site Scripting in Gogs in gogs.io/gogs...
GO-2022-0458 Improper Privilege Management in Cilium in github.com/cilium/cilium
Improper Privilege Management in Cilium in github.com/cilium/cilium...
GO-2022-0418 Opened exploitable ports in default docker-compose.yaml in go-ipfs in github.com/ipfs/go-ipfs
Opened exploitable ports in default docker-compose.yaml in go-ipfs in github.com/ipfs/go-ipfs...
GO-2022-0387 Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd
Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd...
GO-2022-0363 Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o
Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o...
GO-2022-0365 User object created with invalid provider data in GoTrue in github.com/netlify/gotrue
User object created with invalid provider data in GoTrue in github.com/netlify/gotrue...
GO-2022-0308 Gitea displaying raw OpenID error in UI in github.com/go-gitea/gitea
Gitea displaying raw OpenID error in UI in github.com/go-gitea/gitea...
GO-2023-1828 Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul...
GO-2023-1827 Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul
Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul...
GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server
Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2732 Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos
Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos...
GO-2024-2846 Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd
Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd...
GO-2023-1881 The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk
If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is not charged. No patch will be released, as the package is planned to be deprecated and replaced...
GO-2026-6656 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner...
GO-2026-6626 SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel...
GO-2026-6615 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log...
GO-2026-6620 fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf...
GO-2026-6595 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain...
GO-2026-6565 SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet
SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet...
GO-2026-6548 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel
Dasel: Selector lexer panics on trailing whitespace in parseCurRune in github.com/tomwright/dasel...
GO-2026-6550 SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo
SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo...
GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...
GO-2026-6594 Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod
Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod...
GO-2026-6564 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth...
GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...
GO-2026-6538 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit
k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit...
GO-2026-6529 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-6485 Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker
Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker...
GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot...
GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses
Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...
GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...
GO-2026-6464 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone...
GO-2026-6468 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik
Traefik: Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' and Incorrect Authorization in github.com/traefik/traefik...
GO-2026-6398 SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel
SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel...
GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf
ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...
GO-2026-6407 SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel
SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents in github.com/siyuan-note/siyuan/kernel...
GO-2026-6361 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs
SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs...
GO-2026-6302 Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2...