4632 matches found
GO-2026-4828 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server
NATS has mTLS verifyandmap authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server...
GO-2026-4816 NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs...
GO-2026-4785 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu
Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu...
GO-2026-4765 mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo
mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo...
GO-2026-4727 Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server
Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-4740 WITHDRAWN: Denial of service in github.com/shamaton/msgpack
This report has been withdrawn with reason: "Duplicate of 4513"...
GO-2026-4747 SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel
SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel...
GO-2026-4646 SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-4360 Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats
Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats...
GO-2026-4584 OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin
OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin...
GO-2026-4558 Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API in github.com/axllent/mailpit
Mailpit is Vulnerable to Server-Side Request Forgery SSRF via Link Check API in github.com/axllent/mailpit...
GO-2026-4541 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2...
GO-2026-4497 Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings...
GO-2026-4471 Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in github.com/gofiber/fiber
Fiber has an insecure fallback in utils.UUIDv4 / utils.UUID — predictable / zero‑UUID on crypto/rand failure in github.com/gofiber/fiber...
GO-2026-4465 LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik
Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik...
GO-2026-4398 WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow in github.com/h44z/wg-portal
WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow in github.com/h44z/wg-portal. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-4405 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko...
GO-2026-4345 Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in github.com/axllent/mailpit
Mailpit has a Server-Side Request Forgery SSRF via HTML Check API in github.com/axllent/mailpit...
GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea
Gitea has improper access control for uploaded attachments in code.gitea.io/gitea...
GO-2026-4356 Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly...
GO-2025-4253 Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats
Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats...
GO-2026-4273 Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server
Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2025-4161 VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM in github.com/VictoriaMetrics/VictoriaMetrics
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM in github.com/VictoriaMetrics/VictoriaMetrics...
GO-2025-4233 HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go...
GO-2025-4167 Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium...
GO-2025-4223 RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows...
GO-2025-4219 SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel
SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel...
GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik...
GO-2025-4193 Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio
Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio...
GO-2025-4176 Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer
Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer...
GO-2025-4177 Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity
Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN .example.com...
GO-2025-4158 LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in github.com/lf-edge/ekuiper
LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in github.com/lf-edge/ekuiper...
GO-2025-4156 OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao
OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4123 Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token high compression ratio in github.com/dvsekhvalnov/jose2go
Denial-of-Service DoS via crafted JSON Web Encryption JWE token high compression ratio in github.com/dvsekhvalnov/jose2go...
GO-2025-4096 Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc
Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc...
GO-2025-4128 Mattermost does not enforce MFA on WebSocket connections in github.com/mattermost/mattermost-server
Mattermost does not enforce MFA on WebSocket connections in github.com/mattermost/mattermost-server...
GO-2025-4114 Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus
Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2025-4105 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation in kubevirt.io/kubevirt
KubeVirt VMI Denial-of-Service DoS Using Pod Impersonation in kubevirt.io/kubevirt...
GO-2025-4116 Potential denial of service in golang.org/x/crypto/ssh/agent
SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...
GO-2025-4004 Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns in github.com/lxc/lxd...
GO-2025-4078 Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast
Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast...
GO-2025-4024 Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows
Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows...
GO-2025-4087 Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto
Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto...
GO-2025-4000 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd...
GO-2025-4052 OpenBao and Vault Leak []byte Fields in Audit Logs in github.com/openbao/openbao
OpenBao and Vault Leak byte Fields in Audit Logs in github.com/openbao/openbao...
GO-2025-4068 Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula
Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula...
GO-2025-4042 NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...