4632 matches found
GO-2025-4025 CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft
CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft...
GO-2025-4116 Potential denial of service in golang.org/x/crypto/ssh/agent
SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...
GO-2025-4082 Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul
Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul...
GO-2025-4078 Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast
Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast...
GO-2025-4087 Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto
Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto...
GO-2025-4002 Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd...
GO-2025-4027 Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto
Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto...
GO-2025-4008 ALPN negotiation error contains attacker controlled information in crypto/tls
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...
GO-2025-3982 Rancher sends sensitive information to external services through the `/meta/proxy` endpoint in github.com/rancher/rancher
Rancher sends sensitive information to external services through the /meta/proxy endpoint in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3996 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd...
GO-2025-3915 Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes
Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes...
GO-2025-3926 Harness Allows Arbitrary File Write in Gitness LFS server in github.com/harness/gitness
Harness Allows Arbitrary File Write in Gitness LFS server in github.com/harness/gitness...
GO-2025-3870 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3865 Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3872 Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3867 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3871 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3848 HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault
HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault...
GO-2025-3820 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3823 Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service in github.com/kyverno/kyverno
Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service in github.com/kyverno/kyverno...
GO-2025-3781 Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus
Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus...
GO-2025-3795 File Browser vulnerable to command execution allowlist bypass in github.com/filebrowser/filebrowser
File Browser vulnerable to command execution allowlist bypass in github.com/filebrowser/filebrowser...
GO-2025-3792 File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser
File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser...
GO-2025-3783 OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao
OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao...
GO-2025-3797 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3798 Leaks private key in certs in github.com/juju/utils
Leaks private key in certs in github.com/juju/utils...
GO-2025-3755 CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd
CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd...
GO-2025-3750 Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...
GO-2025-3741 kro Confused Deputy vulnerability in github.com/kro-run/kro
kro Confused Deputy vulnerability in github.com/kro-run/kro...
GO-2025-3735 Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go
Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go...
GO-2025-3703 Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg
Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg...
GO-2025-3695 Ollama Server Vulnerable to Denial of Service (DoS) Attack in github.com/ollama/ollama
Ollama Server Vulnerable to Denial of Service DoS Attack in github.com/ollama/ollama...
GO-2025-3679 OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey
OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey...
GO-2025-3660 OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa
OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa...
GO-2025-3607 gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf
gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf...
GO-2025-3557 Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama
Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama...
GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server...
GO-2025-3483 Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server
Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server...
GO-2025-3462 Unencrypted transmission in Temporal api-go library in go.temporal.io/api
Unencrypted transmission in Temporal api-go library in go.temporal.io/api...
GO-2025-3422 imgproxy is vulnerable to SSRF against 0.0.0.0 in github.com/imgproxy/imgproxy
imgproxy is vulnerable to SSRF against 0.0.0.0 in github.com/imgproxy/imgproxy...
GO-2025-3418 Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway
Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway...
GO-2024-3350 WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core
WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core...
GO-2024-3319 Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd
Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd...
GO-2024-3288 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig...
GO-2024-3279 Mismatched bit-length validation in can lead to panic in cosmossdk.io/math
Mismatched bit-length validation in can lead to panic in cosmossdk.io/math...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3221 Rancher Remote Code Execution via Cluster/Node Drivers in github.com/rancher/rancher
Rancher Remote Code Execution via Cluster/Node Drivers in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2022-1066 Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node
Potential inter-blockchain communication IBC protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node...