4632 matches found
GO-2025-3662 Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault...
GO-2025-3663 Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault...
GO-2025-3656 Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano...
GO-2025-3660 OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa
OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa...
GO-2025-3652 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno...
GO-2025-3645 Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes
Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes...
GO-2025-3647 Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher
Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3648 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle MitM attacks in github.com/rancher/stev. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3650 Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake
Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake...
GO-2025-3649 Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet...
GO-2025-3646 CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s
CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2025-3644 Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3643 Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3640 Memory exhaustion in github.com/vbatts/tar-split
Memory exhaustion in github.com/vbatts/tar-split...
GO-2025-3639 Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju
Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju...
GO-2025-3638 ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls
Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version e.g., TLS 1.2...
GO-2025-3633 GoBGP does not verify that the input length in github.com/osrg/gobgp
GoBGP does not verify that the input length in github.com/osrg/gobgp...
GO-2025-3632 GoBGP crashes in the flowspec parser in github.com/osrg/gobgp
GoBGP crashes in the flowspec parser in github.com/osrg/gobgp...
GO-2025-3630 GoBGP does not properly check the input length in github.com/osrg/gobgp
GoBGP does not properly check the input length in github.com/osrg/gobgp...
GO-2025-3631 GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp
GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp...
GO-2025-3635 In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium...
GO-2025-3634 Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik
Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik...
GO-2025-3627 Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik
Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik...
GO-2025-3625 cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps
cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps...
GO-2025-3623 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3636 one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api
one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api...
GO-2025-3637 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3607 gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf
gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf...
GO-2025-3619 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3621 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server...
GO-2025-3612 Dpanel's hard-coded JWT secret leads to remote code execution in github.com/donknap/dpanel
Dpanel's hard-coded JWT secret leads to remote code execution in github.com/donknap/dpanel...
GO-2025-3611 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3609 Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server...
GO-2025-3608 Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events...
GO-2025-3603 Query smuggling in ch-go library in github.com/ClickHouse/ch-go
Query smuggling in ch-go library in github.com/ClickHouse/ch-go...
GO-2025-3620 Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server
Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server...
GO-2025-3618 Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams
Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...
GO-2025-3610 Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server
Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server...
GO-2025-3604 Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Proper Access Controls on /api/v4/audits Endpoint in github.com/mattermost/mattermost-server...
GO-2025-3600 Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server
Missing...
GO-2025-3595 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...
GO-2025-3602 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm...
GO-2025-3591 Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app...
GO-2025-3599 bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta...
GO-2025-3594 MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio
MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio...