4632 matches found
GO-2025-3903 Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server
Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server...
GO-2025-3868 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3863 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3869 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3885 External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets...
GO-2025-3833 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion in github.com/oauth2-proxy/oauth2-proxy
OAuth2-Proxy has authentication bypass in oauth2-proxy skipauthroutes due to Query Parameter inclusion in github.com/oauth2-proxy/oauth2-proxy...
GO-2025-3828 Unexpected command execution in untrusted VCS repositories in cmd/go
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VCS e.g. Mercurial...
GO-2025-3769 Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server
Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server...
GO-2025-3783 OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao
OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao...
GO-2025-3809 Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout in github.com/ctfer-io/chall-manager
Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout in github.com/ctfer-io/chall-manager...
GO-2025-3768 Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor
Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor...
GO-2025-3730 Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server
Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server...
GO-2025-3693 Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server
Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server...
GO-2025-3698 Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener
Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener...
GO-2025-3679 OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey
OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey...
GO-2025-3634 Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik
Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik...
GO-2025-3618 Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams
Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3529 Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive...
GO-2025-3527 buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx
buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx...
GO-2025-3422 imgproxy is vulnerable to SSRF against 0.0.0.0 in github.com/imgproxy/imgproxy
imgproxy is vulnerable to SSRF against 0.0.0.0 in github.com/imgproxy/imgproxy...
GO-2025-3418 Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway
Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway...
GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however,...
GO-2025-3397 matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo
matrix-media-repo MMR allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo...
GO-2024-3121 Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security
Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security...
GO-2022-0584 Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad
Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0378 MD5 hash support in github.com/foxcpp/maddy
MD5 hash support in github.com/foxcpp/maddy...
GO-2023-1991 Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher
Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher...
GO-2023-1950 Traefik Missing Authentication in github.com/traefik/traefik
Traefik Missing Authentication in github.com/traefik/traefik...
GO-2023-1793 secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver
secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver...
GO-2023-1643 Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium...
GO-2023-1583 User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation
User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation...
GO-2024-3068 Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia
Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia...
GO-2024-2530 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd...
GO-2024-2650 Golang SDK for Vela Insecure Variable Substitution in github.com/go-vela/sdk-go
Golang SDK for Vela Insecure Variable Substitution in github.com/go-vela/sdk-go...
GO-2026-6607 Reject malformed ECH outer extension references in crypto/tls
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...
GO-2026-6663 SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel
SiYuan: TLS Private Keys Readable via getFile Incomplete Blocklist in github.com/siyuan-note/siyuan/kernel...
GO-2026-6638 Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale
Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale...
GO-2026-6645 LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI...
GO-2026-6654 SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel...
GO-2026-6635 SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel...
GO-2026-6621 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword publish mode: cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel...
GO-2026-6629 Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
GO-2026-6505 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace...
GO-2026-6566 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio
Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers clientip/tls/requestid still strippable via the Connection header in github.com/fabiolb/fabio...
GO-2026-6573 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge...
GO-2026-6563 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...
GO-2026-6592 Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle
Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle...
GO-2026-6561 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet...
GO-2026-6585 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name - explorer/indexer data forgery in github.com/klever-io/klever-go...
GO-2026-6567 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet...