4035 matches found
GO-2025-3768 Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor
Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor...
GO-2025-3798 Leaks private key in certs in github.com/juju/utils
Leaks private key in certs in github.com/juju/utils...
GO-2025-3803 Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk
Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk...
GO-2025-3765 SQL injection vulnerability in github.com/uptrace/bun/driver/pgdriver
SQL injection vulnerability in github.com/uptrace/bun/driver/pgdriver...
GO-2025-3770 Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi
Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi...
GO-2025-3802 Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm
Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm...
GO-2025-3755 CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd
CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd...
GO-2025-3570 SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver
SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver...
GO-2025-3756 Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server
Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server...
GO-2025-3757 Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server
Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server...
GO-2025-3754 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl...
GO-2025-3750 Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...
GO-2025-3751 Sensitive headers not cleared on cross-origin redirect in net/http
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...
GO-2025-3749 Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...
GO-2025-3745 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmonk. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-3744 SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb
SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb...
GO-2025-3747 Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino
Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino...
GO-2025-3743 CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns...
GO-2025-3748 Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) in github.com/pion/interceptor
Pion Interceptor's improper RTP padding handling allows remote crash for SFU users DoS in github.com/pion/interceptor...
GO-2025-3746 Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino
Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino...
GO-2025-3741 kro Confused Deputy vulnerability in github.com/kro-run/kro
kro Confused Deputy vulnerability in github.com/kro-run/kro...
GO-2025-3742 Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana
Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3740 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3731 Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server
Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server...
GO-2025-3730 Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server
Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server...
GO-2025-3729 Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server
Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server...
GO-2025-3728 Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server
Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server...
GO-2025-3724 Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server
Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server...
GO-2025-3736 Gokapi has stored XSS vulnerability in friendly name for API keys in github.com/forceu/gokapi
Gokapi has stored XSS vulnerability in friendly name for API keys in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3733 Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome
Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome...
GO-2025-3737 Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi
Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3726 IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli
IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli...
GO-2025-3734 Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome
Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome...
GO-2025-3732 GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh
GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh...
GO-2025-3722 Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio
Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio...
GO-2025-3735 Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go
Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go...
GO-2025-3719 Traefik allows path traversal using url encoding in github.com/traefik/traefik
Traefik allows path traversal using url encoding in github.com/traefik/traefik...
GO-2025-3721 ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3720 Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd
Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd...
GO-2025-3705 zot logs secrets in zotregistry.dev/zot
zot logs secrets in zotregistry.dev/zot...
GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3704 Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana
Grafana Cross-Site-Scripting XSS via custom loaded frontend plugin in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3706 Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber
Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber...
GO-2025-3703 Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg
Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg...
GO-2025-3702 Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env
Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env...
GO-2025-3700 Character injection in Hubble CLI in github.com/cilium/hubble
Character injection in Hubble CLI in github.com/cilium/hubble...
GO-2025-3699 Allows host filesystem access on pull in github.com/containerd/containerd
Allows host filesystem access on pull in github.com/containerd/containerd...
GO-2025-3701 Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd
Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd...
GO-2025-3697 Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation in github.com/gardener/external-dns-management
Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation in github.com/gardener/external-dns-management...