4632 matches found
GO-2026-4379 gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values in github.com/gmrtd/gmrtd
gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values in github.com/gmrtd/gmrtd...
GO-2026-4393 Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher
Rancher CLI skips TLS verification on Rancher CLI login command in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-4387 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in github.com/siyuan-note/siyuan/kernel
SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in github.com/siyuan-note/siyuan/kernel...
GO-2026-4370 Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea
Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea...
GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea
Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea...
GO-2026-4356 Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly...
GO-2026-4352 OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format in github.com/opentofu/opentofu
OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format in github.com/opentofu/opentofu...
GO-2026-4378 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper...
GO-2026-4363 Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea
Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea...
GO-2026-4354 Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor
Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor...
GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea
Gitea has improper access control for uploaded attachments in code.gitea.io/gitea...
GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea
Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea...
GO-2026-4362 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea...
GO-2026-4355 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
Rekor affected by Server-Side Request Forgery SSRF via provided public key URL in github.com/sigstore/rekor...
GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea...
GO-2026-4353 Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve
Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve...
GO-2026-4350 Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows
Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows...
GO-2026-4369 Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea
Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea...
GO-2026-4349 Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf...
GO-2026-4348 Client DoS via malformed server response in github.com/theupdateframework/go-tuf
Client DoS via malformed server response in github.com/theupdateframework/go-tuf...
GO-2026-4365 Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea
Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea...
GO-2026-4377 Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf
Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf...
GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...
GO-2026-4342 Excessive CPU consumption when building archive index in archive/zip
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...
GO-2026-4341 Memory exhaustion in query parameter parsing in net/url
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containi...
GO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tls
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries for instance the Client Hello and Encrypted Extensions messages, the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosu...
GO-2026-4339 Arbitrary file write using cgo pkg-config directive in cmd/go
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...
GO-2026-4338 Unexpected code execution when invoking toolchain in cmd/go
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...
GO-2025-4253 Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats
Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats...
GO-2026-4312 Envoy Extension Policy lua scripts injection causes arbitrary command execution in github.com/envoyproxy/gateway
Envoy Extension Policy lua scripts injection causes arbitrary command execution in github.com/envoyproxy/gateway...
GO-2026-4317 Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server
Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server...
GO-2026-4315 DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum
DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum...
GO-2026-4314 High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum
High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2026-4310 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails in github.com/axllent/mailpit
Mailpit is vulnerable to Cross-Site WebSocket Hijacking CSWSH allowing unauthenticated access to emails in github.com/axllent/mailpit. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4313 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in github.com/flipped-aurora/gin-vue-admin
Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in github.com/flipped-aurora/gin-vue-admin...
GO-2026-4318 DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface in github.com/donknap/dpanel
DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface in github.com/donknap/dpanel...
GO-2026-4316 Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi
Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi...
GO-2026-4319 Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel
Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-4320 Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE in github.com/getarcaneapp/arcane/backend
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE in github.com/getarcaneapp/arcane/backend...
GO-2026-4322 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall in github.com/traefik/traefik
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall in github.com/traefik/traefik...
GO-2026-4311 Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
Fulcio is vulnerable to Server-Side Request Forgery SSRF via MetaIssuer Regex Bypass in github.com/sigstore/fulcio...
GO-2026-4321 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs...
GO-2025-4252 Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in github.com/elastic/beats
Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in github.com/elastic/beats...
GO-2026-4273 Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server
Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2025-4248 Mattermost has missing redirect URL validation in github.com/mattermost/mattermost
Mattermost has missing redirect URL validation in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-4251 Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama
Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama...
GO-2026-4297 Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server
Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server...
GO-2026-4298 Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server
Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server...
GO-2026-4302 Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server...