4632 matches found
GO-2026-6563 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...
GO-2026-6567 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet...
GO-2026-6592 Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle
Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle...
GO-2026-6585 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name - explorer/indexer data forgery in github.com/klever-io/klever-go...
GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...
GO-2026-6548 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel
Dasel: Selector lexer panics on trailing whitespace in parseCurRune in github.com/tomwright/dasel...
GO-2026-6595 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain...
GO-2026-6530 Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot...
GO-2026-6515 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose...
GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...
GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses
Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...
GO-2026-6486 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha
Nezha: OAuth2 redirecturi Host header injection regression when dashboardhost is empty in github.com/nezhahq/nezha...
GO-2026-6526 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive...
GO-2026-6538 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit
k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit...
GO-2026-6520 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule...
GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot...
GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...
GO-2026-6458 rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone
rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone...
GO-2026-6459 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone
rclone: Directory metadata chmod/chown/chtimes applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone...
GO-2026-6448 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail
Identrail Cross-tenant IDOR: Client-supplied GitHub App installationid is bound to the caller's workspace without ownership verification in github.com/identrail/identrail...
GO-2026-6468 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik
Traefik: Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' and Incorrect Authorization in github.com/traefik/traefik...
GO-2026-6423 SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel...
GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf
ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...
GO-2026-6361 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs
SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs...
GO-2026-6404 SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents in github.com/siyuan-note/siyuan/kernel
SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes name, alias, memo, custom fields of protected documents in github.com/siyuan-note/siyuan/kernel...
GO-2026-6312 KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela
KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela...
GO-2026-6319 Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus
Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus...
GO-2026-6280 Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server
Mattermost doesn't require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server...
GO-2026-6270 Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI in github.com/alexandre-daubois/ember
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI in github.com/alexandre-daubois/ember...
GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile...
GO-2026-6112 Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi
Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi...
GO-2026-6238 Integer overflow in BTF parsing in github.com/cilium/ebpf
Integer overflow in BTF parsing in github.com/cilium/ebpf...
GO-2026-6189 Path traversal in serve s3 in github.com/rclone/rclone
Path traversal in serve s3 in github.com/rclone/rclone...
GO-2026-6094 JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go
JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go...
GO-2026-6248 uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli
uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli...
GO-2026-6221 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...
GO-2026-6164 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend...
GO-2026-6134 goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs
goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs...
GO-2026-6220 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint in github.com/fleetdm/fleet
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint in github.com/fleetdm/fleet...
GO-2026-6122 GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS in github.com/gopacket/gopacket
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation 104-byte UDP datagram - up to 16 GiB make - unauthenticated remote DoS in github.com/gopacket/gopacket...
GO-2026-6207 Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass in github.com/traefik/traefik
Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass in github.com/traefik/traefik...
GO-2026-5666 Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm...
GO-2026-5266 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp
GoBGP: Remote Denial of Service Panic in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp...
GO-2026-5956 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun...
GO-2026-5743 Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy...
GO-2026-5883 KubeVirt has a Link Following issue in kubevirt.io/kubevirt
KubeVirt has a Link Following issue in kubevirt.io/kubevirt...
GO-2026-5590 uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli...
GO-2026-5538 Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS in github.com/harvester/harvester
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS in github.com/harvester/harvester...
GO-2026-5578 Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint in go.temporal.io/server
Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint in go.temporal.io/server...