4632 matches found
GO-2026-4408 melange pipeline working-directory could allow command injection in chainguard.dev/melange
melange pipeline working-directory could allow command injection in chainguard.dev/melange...
GO-2026-4344 File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login in github.com/filebrowser/filebrowser
File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login in github.com/filebrowser/filebrowser...
GO-2025-4188 Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus
Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus...
GO-2025-4173 Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes in github.com/eclipse/paho.mqtt.golang
Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes in github.com/eclipse/paho.mqtt.golang...
GO-2025-4192 Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority
Sigstore Timestamp Authority allocates excessive memory during request parsing in github.com/sigstore/timestamp-authority...
GO-2025-4160 Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype
Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype...
GO-2025-4150 OpenFGA Improper Policy Enforcement in github.com/openfga/openfga
OpenFGA Improper Policy Enforcement in github.com/openfga/openfga...
GO-2025-4135 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...
GO-2025-4025 CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft
CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft...
GO-2025-4119 AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql...
GO-2025-4115 Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus...
GO-2025-4108 containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd
containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd...
GO-2025-4110 KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt
KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt...
GO-2025-3987 Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers
Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers...
GO-2025-4038 Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs
Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs...
GO-2025-4070 HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault...
GO-2025-4039 OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao
OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4049 OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao
OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao...
GO-2025-4006 Excessive CPU consumption in ParseAddress in net/mail
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...
GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd...
GO-2025-3922 Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz
Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz...
GO-2025-3924 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault...
GO-2025-3900 Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure
Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure...
GO-2025-3857 OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao
OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3856 OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3836 Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault
Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault...
GO-2025-3840 Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault
Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault...
GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...
GO-2025-3766 Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana
Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3728 Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server
Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server...
GO-2025-3732 GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh
GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh...
GO-2025-3719 Traefik allows path traversal using url encoding in github.com/traefik/traefik
Traefik allows path traversal using url encoding in github.com/traefik/traefik...
GO-2025-3690 SeaweedFS Vulnerable to SQL Injection in github.com/seaweedfs/seaweedfs
SeaweedFS Vulnerable to SQL Injection in github.com/seaweedfs/seaweedfs...
GO-2025-3688 Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil
Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil...
GO-2025-3662 Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault...
GO-2025-3663 Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault...
GO-2025-3620 Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server
Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server...
GO-2025-3584 go.rgst.io/stencil/v2 vulnerable to Path Traversal
go.rgst.io/stencil/v2 vulnerable to Path Traversal...
GO-2025-3476 Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk
Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk...
GO-2024-3259 CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft...
GO-2024-3232 Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server
Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server...
GO-2024-3219 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses...
GO-2022-1204 Yapscan's report receiver server vulnerable to path traversal and log injection in github.com/fkie-cad/yapscan
Yapscan's report receiver server vulnerable to path traversal and log injection in github.com/fkie-cad/yapscan...
GO-2022-1000 KubeVirt vulnerable to arbitrary file read on host in kubevirt.io/kubevirt
KubeVirt vulnerable to arbitrary file read on host in kubevirt.io/kubevirt...
GO-2022-0576 Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server
Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server...
GO-2023-2388 eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github...
GO-2023-2156 Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware
Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware...
GO-2023-2012 lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs...
GO-2023-1862 Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium
Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium...