4632 matches found
GO-2026-4519 Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom
Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom...
GO-2026-4442 FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-4454 Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs
Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik
Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik...
GO-2026-4458 Blocklist Bypass possible via ECDSA Signature Malleability in github.com/slackhq/nebula
Blocklist Bypass possible via ECDSA Signature Malleability in github.com/slackhq/nebula...
GO-2026-4405 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko...
GO-2026-4345 Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in github.com/axllent/mailpit
Mailpit has a Server-Side Request Forgery SSRF via HTML Check API in github.com/axllent/mailpit...
GO-2025-4245 Expr has Denial of Service via Unbounded Recursion in Builtin Functions in github.com/expr-lang/expr
Expr has Denial of Service via Unbounded Recursion in Builtin Functions in github.com/expr-lang/expr...
GO-2025-4136 authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io
authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-4167 Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium...
GO-2025-4219 SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel
SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel...
GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik...
GO-2025-4193 Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio
Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio...
GO-2025-4176 Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer
Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer...
GO-2025-4177 Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity
Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4096 Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc
Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc...
GO-2025-4105 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation in kubevirt.io/kubevirt
KubeVirt VMI Denial-of-Service DoS Using Pod Impersonation in kubevirt.io/kubevirt...
GO-2025-4024 Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows
Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows...
GO-2025-3999 Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd
Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd...
GO-2025-4000 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd...
GO-2025-4042 NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4073 Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher
Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher...
GO-2025-4041 Cosmos EVM Vulnerability in github.com/cosmos/evm
Cosmos EVM Vulnerability in github.com/cosmos/evm...
GO-2025-4013 Panic when validating certificates with DSA public keys in crypto/x509
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains...
GO-2025-4010 Insufficient validation of bracketed IPv6 hostnames in net/url
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...
GO-2025-3962 esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh
esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh...
GO-2025-3955 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...
GO-2025-3925 Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw
Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw...
GO-2025-3918 NeuVector admin account has insecure default password in github.com/neuvector/neuvector
NeuVector admin account has insecure default password in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3866 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3870 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3834 1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core
1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3800 eKuiper /config/uploads API arbitrary file writing may lead to RCE in github.com/lf-edge/ekuiper
eKuiper /config/uploads API arbitrary file writing may lead to RCE in github.com/lf-edge/ekuiper...
GO-2025-3799 LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement in github.com/lf-edge/ekuiper
LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement in github.com/lf-edge/ekuiper...
GO-2025-3774 Kubernetes allows nodes to bypass dynamic resource allocation authorization checks in k8s.io/kubernetes
Kubernetes allows nodes to bypass dynamic resource allocation authorization checks in k8s.io/kubernetes...
GO-2025-3801 Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary in github.com/babylonlabs-io/babylon
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary in github.com/babylonlabs-io/babylon...
GO-2025-3693 Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server
Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server...
GO-2025-3686 Babylon Finality Provider `MsgCommitPubRandList` replay attack in github.com/babylonlabs-io/babylon
Babylon Finality Provider MsgCommitPubRandList replay attack in github.com/babylonlabs-io/babylon...
GO-2025-3687 Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon...
GO-2025-3649 Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet...
GO-2025-3609 Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server...
GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...
GO-2025-3515 CVE-2025-26260 in github.com/plentico/plenti
CVE-2025-26260 in github.com/plentico/plenti...
GO-2025-3461 go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative
go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative...
GO-2025-3449 wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm
wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm...
GO-2025-3443 CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft
CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft...
GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito
Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...
GO-2024-3175 Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju
Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2022-0410 Local directory executable lookup in sops (Windows-only) in go.mozilla.org/sops
Local directory executable lookup in sops Windows-only in go.mozilla.org/sops...
GO-2022-0388 Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows
Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows...