4632 matches found
GO-2025-3955 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...
GO-2025-3916 simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core
simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core...
GO-2025-3888 Helm May Panic Due To Incorrect YAML Content in helm.sh/helm
Helm May Panic Due To Incorrect YAML Content in helm.sh/helm...
GO-2025-3887 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm...
GO-2025-3872 Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3871 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3867 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3866 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3858 Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao
Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3838 Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault
Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault...
GO-2025-3834 1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core
1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3820 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3797 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3799 LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement in github.com/lf-edge/ekuiper
LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement in github.com/lf-edge/ekuiper...
GO-2025-3755 CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd
CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd...
GO-2025-3706 Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber
Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber...
GO-2025-3704 Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana
Grafana Cross-Site-Scripting XSS via custom loaded frontend plugin in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3692 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server
Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server...
GO-2025-3695 Ollama Server Vulnerable to Denial of Service (DoS) Attack in github.com/ollama/ollama
Ollama Server Vulnerable to Denial of Service DoS Attack in github.com/ollama/ollama...
GO-2025-3686 Babylon Finality Provider `MsgCommitPubRandList` replay attack in github.com/babylonlabs-io/babylon
Babylon Finality Provider MsgCommitPubRandList replay attack in github.com/babylonlabs-io/babylon...
GO-2025-3687 Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon...
GO-2025-3660 OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa
OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa...
GO-2025-3607 gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf
gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf...
GO-2025-3609 Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server...
GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...
GO-2025-3483 Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server
Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server...
GO-2025-3461 go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative
go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative...
GO-2025-3462 Unencrypted transmission in Temporal api-go library in go.temporal.io/api
Unencrypted transmission in Temporal api-go library in go.temporal.io/api...
GO-2024-3288 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig...
GO-2024-3221 Rancher Remote Code Execution via Cluster/Node Drivers in github.com/rancher/rancher
Rancher Remote Code Execution via Cluster/Node Drivers in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3200 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb...
GO-2022-1019 lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs...
GO-2022-1066 Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node
Potential inter-blockchain communication IBC protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node...
GO-2022-0894 Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul
Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul...
GO-2022-0893 Access Restriction Bypass in kubernetes in github.com/kubernetes/kubernetes
Access Restriction Bypass in kubernetes in github.com/kubernetes/kubernetes...
GO-2022-0554 Unrestricted Upload of File with Dangerous Type in Gogs in gogs.io/gogs
Unrestricted Upload of File with Dangerous Type in Gogs in gogs.io/gogs...
GO-2022-0457 Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium
Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium...
GO-2022-0418 Opened exploitable ports in default docker-compose.yaml in go-ipfs in github.com/ipfs/go-ipfs
Opened exploitable ports in default docker-compose.yaml in go-ipfs in github.com/ipfs/go-ipfs...
GO-2022-0378 MD5 hash support in github.com/foxcpp/maddy
MD5 hash support in github.com/foxcpp/maddy...
GO-2022-0393 Network policy may be bypassed by some ICMP Echo Requests in github.com/cilium/cilium
Network policy may be bypassed by some ICMP Echo Requests in github.com/cilium/cilium...
GO-2022-0375 Improper Access Control in github.com/treeverse/lakefs
Improper Access Control in github.com/treeverse/lakefs...
GO-2022-0388 Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows
Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows...
GO-2022-0315 Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea...
GO-2023-2340 Attacker can cause Kyverno user to unintentionally consume insecure image in github.com/kyverno/kyverno
Attacker can cause Kyverno user to unintentionally consume insecure image in github.com/kyverno/kyverno...
GO-2023-2188 slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier
slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier...
GO-2023-1607 Yapscan Denial of Service vulnerability in report server in github.com/fkie-cad/yapscan
Yapscan Denial of Service vulnerability in report server in github.com/fkie-cad/yapscan...
GO-2023-1524 Initial debug-host handler implementation could leak information and facilitate denial of service in fortio.org/proxy
Initial debug-host handler implementation could leak information and facilitate denial of service in fortio.org/proxy...
GO-2024-2816 kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt
kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt...