GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server

Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...

GO-2024-3112 CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft

CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft...

GO-2022-1181 AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity

AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity...

GO-2022-0595 Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server

Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server...

GO-2023-2397 User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs...

GO-2024-2899 apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko

apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko...

GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

GO-2026-6613 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

GO-2026-6609 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

GO-2026-6489 Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase

Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase...

GO-2026-6500 RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Resource Exhaustion OOM via Unbounded Body Buffer Allocation in github.com/rabbitmq/amqp091-go...

GO-2026-6496 RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr in github.com/rabbitmq/amqp091-go...

GO-2026-6549 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...

GO-2026-6596 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium...

GO-2026-6121 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) in github.com/gopacket/gopacket

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded 4 GiB allocation unauthenticated remote DoS in github.com/gopacket/gopacket...

GO-2026-5576 LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd

LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd...

GO-2026-5750 Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama

Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama...

GO-2026-4601 Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

GO-2025-4159 Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon

Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon...

GO-2025-4121 LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd

LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd...

GO-2025-4103 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt

KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt...

GO-2025-4032 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-4009 Quadratic complexity when parsing some invalid inputs in encoding/pem

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs...

GO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...

GO-2025-3942 CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns

CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns...

GO-2025-3884 Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...

GO-2025-3835 Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution in github.com/traefik/traefik

Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution in github.com/traefik/traefik...

GO-2025-3837 Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault

Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault...

GO-2025-3782 Incus creates nftables rules that partially bypass security options in github.com/lxc/incus

Incus creates nftables rules that partially bypass security options in github.com/lxc/incus...

GO-2025-3776 Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs...

GO-2025-3811 File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser

File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser...

GO-2025-3777 Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman

Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman...

GO-2025-3802 Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm...

GO-2025-3734 Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome

Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome...

GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2025-3665 Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget

Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget...

GO-2025-3621 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-3490 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login in github.com/rancher/rancher

Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this...

GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...

GO-2024-3325 kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp...

GO-2022-0377 SSRF in repository migration in gogs.io/gogs

SSRF in repository migration in gogs.io/gogs...

GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

GO-2026-6216 Cross-forge account takeover on login in codefloe.com/crowci/crow/v6

In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an...

GO-2026-6191 Arbitrary file write via --links symlinks in github.com/rclone/rclone

Arbitrary file write via --links symlinks in github.com/rclone/rclone...

GO-2026-6117 Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend...

GO-2026-5107 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI in go.opentelemetry.io/obi

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI in go.opentelemetry.io/obi...

GO-2026-4803 MinIO LDAP login brute-force via user enumeration and missing rate limit in github.com/minio/minio

MinIO LDAP login brute-force via user enumeration and missing rate limit in github.com/minio/minio...

GO-2026-4284 Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in github.com/axllent/mailpit

Mailpit Proxy Endpoint has Server-Side Request Forgery SSRF vulnerability in github.com/axllent/mailpit...

GO-2025-4081 Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul

Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul...

GO-2025-4005 Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd

Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd...