4632 matches found
GO-2026-4794 Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api
Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api...
GO-2026-4779 MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio
MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio...
GO-2026-4778 Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets in github.com/juju/juju
Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets in github.com/juju/juju...
GO-2026-4757 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference in github.com/free5gc/udm
free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference in github.com/free5gc/udm...
GO-2026-4769 Juju affected by timing ownership claim attack on new external back-end secrets in github.com/juju/juju
Juju affected by timing ownership claim attack on new external back-end secrets in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4751 Zitadel is missing enforcement of organization scopes in github.com/zitadel/zitadel
Zitadel is missing enforcement of organization scopes in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-4763 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error in github.com/free5gc/udm
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error in github.com/free5gc/udm...
GO-2026-4761 Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline...
GO-2026-4756 free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter in github.com/free5gc/nrf
free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter in github.com/free5gc/nrf...
GO-2026-4770 Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk...
GO-2026-4765 mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo
mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo...
GO-2026-4754 free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion in github.com/free5gc/ausf
free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion in github.com/free5gc/ausf...
GO-2026-4775 step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq MessageType=18 in github.com/smallstep/certificates...
GO-2026-4766 SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass) in github.com/siyuan-note/siyuan/kernel
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home GHSA-h5vh-m7fg-w5h6 Bypass in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2026-4755 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques in github.com/free5gc/udm
free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques in github.com/free5gc/udm...
GO-2026-4752 SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass in github.com/siyuan-note/siyuan/kernel
SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-4777 Juju has unauthorized access to out-of-scope Kubernetes secrets in github.com/juju/juju
Juju has unauthorized access to out-of-scope Kubernetes secrets in github.com/juju/juju...
GO-2026-4773 Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk...
GO-2026-4774 qui CORS Misconfiguration: Arbitrary Origins Trusted in github.com/autobrr/qui
qui CORS Misconfiguration: Arbitrary Origins Trusted in github.com/autobrr/qui...
GO-2026-4759 Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload in github.com/nhost/nhost
Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload in github.com/nhost/nhost...
GO-2026-4758 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request in github.com/free5gc/udm
free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request in github.com/free5gc/udm...
GO-2026-4768 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel...
GO-2026-4776 Ella Core panics on malformed ULNASTransport Message without a Request Type in github.com/ellanetworks/core
Ella Core panics on malformed ULNASTransport Message without a Request Type in github.com/ellanetworks/core...
GO-2026-4733 Mattermost fails to bound memory allocation when processing DOC files in github.com/mattermost/mattermost-server
Mattermost fails to bound memory allocation when processing DOC files in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-4735 Mattermost fails to filter invite IDs based on user permissions in github.com/mattermost/mattermost-server
Mattermost fails to filter invite IDs based on user permissions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4727 Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server
Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-4748 PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation in github.com/pinchtab/pinchtab
PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation in github.com/pinchtab/pinchtab...
GO-2026-4734 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server
Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4747 SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel
SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel...
GO-2026-4742 Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall
Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall...
GO-2026-4737 Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd
Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd...
GO-2026-4745 Mattermost fails to properly enforce read permissions in search API endpoints in github.com/mattermost/mattermost-server
Mattermost fails to properly enforce read permissions in search API endpoints in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-4731 Mattermost fails to properly handle very long passwords in github.com/mattermost/mattermost-server
Mattermost fails to properly handle very long passwords in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4732 Mattermost allows attackers to spoof permalink embeds in github.com/mattermost/mattermost-server
Mattermost allows attackers to spoof permalink embeds in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4746 Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation in github.com/mattermost/mattermost-server
Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4749 Mattermost fails to validate team-specific upload_file permissions in github.com/mattermost/mattermost-server
Mattermost fails to validate team-specific uploadfile permissions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2026-4744 Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server
Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4750 Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf
Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf...
GO-2026-4740 WITHDRAWN: Denial of service in github.com/shamaton/msgpack
This report has been withdrawn with reason: "Duplicate of 4513"...
GO-2026-4729 Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server
Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causi...
GO-2026-4728 Tillitis TKey Client has an Error in Protocol Implementation in github.com/tillitis/tkeyclient
Tillitis TKey Client has an Error in Protocol Implementation in github.com/tillitis/tkeyclient...
GO-2026-4743 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel...
GO-2026-4730 Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline...
GO-2026-4526 Infinite loop in github.com/antchfx/xpath
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true"...
GO-2026-4697 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo...
GO-2026-4696 Gokapi vulnerable to Privilege Escalation in File Replace in github.com/forceu/gokapi
Gokapi vulnerable to Privilege Escalation in File Replace in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2026-4698 Gokapi vulnerable to DoS in E2E Metadata Parser in github.com/forceu/gokapi
Gokapi vulnerable to DoS in E2E Metadata Parser in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-4695 Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload in github.com/forceu/gokapi
Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-4699 SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo
SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo...
GO-2026-4513 Denial of service in github.com/shamaton/msgpack
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data format codes 0xd4-0xd8. This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack...