4632 matches found
GO-2025-3563 Request smuggling due to acceptance of invalid chunked data in net/http
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...
GO-2025-3586 Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher
Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3588 Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla
Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla...
GO-2025-3587 Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer
Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer...
GO-2025-3585 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input in github.com/beego/beego
Beego allows Reflected/Stored XSS in Beego's RenderForm Function Due to Unescaped User Input in github.com/beego/beego...
GO-2025-3584 go.rgst.io/stencil/v2 vulnerable to Path Traversal
go.rgst.io/stencil/v2 vulnerable to Path Traversal...
GO-2025-3583 Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow in github.com/NethermindEth/juno
Nethermind Juno Potential Denial of Service DoS via Integer Overflow in github.com/NethermindEth/juno...
GO-2025-3581 github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...
GO-2025-3582 Ollama Denial of Service (DoS) via Null Pointer Dereference in github.com/ollama/ollama
Ollama Denial of Service DoS via Null Pointer Dereference in github.com/ollama/ollama...
GO-2025-3559 Ollama Divide By Zero vulnerability in github.com/ollama/ollama
Ollama Divide By Zero vulnerability in github.com/ollama/ollama...
GO-2025-3558 Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama
Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama...
GO-2025-3557 Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama
Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama...
GO-2025-3548 Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP in github.com/ollama/ollama
Ollama Vulnerable to Denial of Service DoS via Crafted GZIP in github.com/ollama/ollama...
GO-2025-3526 Index out-of-range panic in github.com/onosproject/onos-lib-go
Index out-of-range panic in github.com/onosproject/onos-lib-go...
GO-2025-3533 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
Improper Handling of Highly Compressed Data Data Amplification in github.com/getkin/kin-openapi/openapi3filter...
GO-2025-3540 Potential out of order responses when CLIENT SETINFO times out during connection establishment in github.com/redis/go-redis
Potential out of order responses when CLIENT SETINFO times out during connection establishment in github.com/redis/go-redis...
GO-2025-3553 Excessive memory allocation during header parsing in github.com/golang-jwt/jwt
Excessive memory allocation during header parsing in github.com/golang-jwt/jwt...
GO-2025-3556 Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server...
GO-2025-3562 Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno...
GO-2025-3566 ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx
ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3522 Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API in k8s.io/kubernetes
Kubernetes allows Command Injection affecting Windows nodes via nodes//logs/query API in k8s.io/kubernetes...
GO-2025-3564 ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx
ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3521 Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes
Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes...
GO-2025-3520 cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) in github.com/cheqd/cheqd-node
cheqd-node Security patch for upstream vulnerabilities in IBC-Go ISA-2025-001 and Cosmos SDK ISA-2025-002 in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...
GO-2025-3554 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin...
GO-2025-3546 PipeCD Vulnerable to Privilege Escalation in github.com/pipe-cd/pipecd
PipeCD Vulnerable to Privilege Escalation in github.com/pipe-cd/pipecd...
GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3560 Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium
Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium...
GO-2025-3543 WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc
This report has been withdrawn with reason: "Does not affect Go code.". https://nvd.nist.gov/vuln/detail/CVE-2025-27612 lists https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 which caused automation to flag as Go; the affected repo is https://github.com/youki-dev/you...
GO-2025-3568 ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx
ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-3545 CVE-2024-53348 in github.com/loxilb-io/loxilb
CVE-2024-53348 in github.com/loxilb-io/loxilb...
GO-2025-3561 Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium
Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium...
GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...
GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes
Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes...
GO-2025-3536 OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive
OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive...
GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server...
GO-2025-3538 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp...
GO-2025-3537 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza
OWASP Coraza WAF has parser confusion which leads to wrong URI in REQUESTFILENAME in github.com/corazawaf/coraza...
GO-2025-3534 Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server
Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server...
GO-2025-3539 OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console
OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console...
GO-2025-3542 LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
LocalAI Cross-Site Scripting XSS vulnerability in its search functionality in github.com/mudler/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server...
GO-2025-3567 ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx
ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2025-3565 ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3529 Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive...
GO-2025-3528 containerd has an integer overflow in User ID handling in github.com/containerd/containerd
containerd has an integer overflow in User ID handling in github.com/containerd/containerd...
GO-2025-3530 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Bare Metal Operator BMO can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis...