4632 matches found
GO-2024-3012 Malicious code in github.com/PromonLogicalis/asn1
Version 7bdca06d0edf of the github.com/PromonLogicalis/asn1 module contains malicious code which downloads a program from a remote web server and executes it...
GO-2024-2593 Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server
Mattermost fails to check the "inviteguest" permission in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2923 Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt
Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt...
GO-2026-6602 Checksum database bypass for golang.org/toolchain in cmd/go
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
GO-2026-6601 Checksum bypass for golang.org/fips140 in cmd/go
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...
GO-2026-6665 Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake
Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake...
GO-2026-6662 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel
SiYuan: /history/path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/ in github.com/siyuan-note/siyuan/kernel...
GO-2026-6657 SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU Bypass of CheckHostSSRF in github.com/siyuan-note/siyuan/kernel...
GO-2026-6624 SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel...
GO-2026-6498 RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go...
GO-2026-6494 RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client in github.com/rabbitmq/amqp091-go
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client in github.com/rabbitmq/amqp091-go...
GO-2026-6553 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao...
GO-2026-6506 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns...
GO-2026-6456 rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone
rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone...
GO-2026-6430 SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
SiYuan: Database view structure all view names, layout types and per-field visibility is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel...
GO-2026-6277 netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil...
GO-2026-6253 moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive
moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...
GO-2026-6199 Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone
Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone...
GO-2026-6182 Command execution via PowerShell smart quotes in github.com/rclone/rclone
PowerShell treats several Unicode smart-quote characters U+2018, U+2019, U+201A, U+201B as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename wit...
GO-2026-6113 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList...
GO-2026-5516 Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph
A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a...
GO-2026-5157 hjson stack exhaustion vulnerability in github.com/hjson/hjson-go
hjson stack exhaustion vulnerability in github.com/hjson/hjson-go...
GO-2026-4864 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the ATSYMLINKNOFOLLOW flag, which Root.Chmod uses to...
GO-2026-4600 Panic in name constraint checking for malformed certificates in crypto/x509
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS...
GO-2026-4550 CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl
CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl...
GO-2026-4452 Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4102 KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes in kubevirt.io/kubevirt
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes in kubevirt.io/kubevirt...
GO-2025-4095 Kgateway transformation policy template can emit files from the container in github.com/kgateway-dev/kgateway
Kgateway transformation policy template can emit files from the container in github.com/kgateway-dev/kgateway...
GO-2025-4109 KubeVirt Arbitrary Container File Read in kubevirt.io/kubevirt
KubeVirt Arbitrary Container File Read in kubevirt.io/kubevirt...
GO-2025-4107 KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing in kubevirt.io/kubevirt
KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing in kubevirt.io/kubevirt...
GO-2025-4020 DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode
DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode...
GO-2025-4030 Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3940 Atlantis Exposes Service Version Publicly on /status API Endpoint in github.com/runatlantis/atlantis
Atlantis Exposes Service Version Publicly on /status API Endpoint in github.com/runatlantis/atlantis...
GO-2025-3817 Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana
Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2025-3788 Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault
Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault...
GO-2025-3780 OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk
OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk...
GO-2025-3791 Babylon vulnerable to chain half when transaction has fees different than `ubbn` in github.com/babylonlabs-io/babylon
Babylon vulnerable to chain half when transaction has fees different than ubbn in github.com/babylonlabs-io/babylon...
GO-2025-3751 Sensitive headers not cleared on cross-origin redirect in net/http
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...
GO-2025-3747 Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino
Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino...
GO-2025-3720 Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd
Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd...
GO-2025-3701 Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd
Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd...
GO-2025-3562 Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno...
GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3450 MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun
MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun...
GO-2024-3112 CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft
CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft...
GO-2022-1181 AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity
AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity...
GO-2022-0590 HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault
HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault...