GO-2025-3516 Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/

Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/...

GO-2025-3517 Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go

Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go...

GO-2025-3515 CVE-2025-26260 in github.com/plentico/plenti

CVE-2025-26260 in github.com/plentico/plenti...

GO-2025-3514 cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node

cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...

GO-2025-3509 Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server

Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server...

GO-2025-3511 Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify...

GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad

Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...

GO-2025-3508 LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper

LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper...

GO-2025-3512 kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver

kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

GO-2025-3498 Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus

Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus...

GO-2025-3500 In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone

In-memory stored Cross-site scripting XSS vulnerability in pineconesim in github.com/matrix-org/pinecone...

GO-2025-3463 DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware

DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware...

GO-2025-3499 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2025-3505 Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet

Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3504 Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway

Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway...

GO-2025-3507 Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux

Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux...

GO-2025-3494 IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go

IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go...

GO-2025-3492 Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

Memos Server-Side Request Forgery SSRF in github.com/usememos/memos...

GO-2025-3475 Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes

Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes...

GO-2025-3479 lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs

lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs...

GO-2025-3465 Node Denial of Service via kubelet Checkpoint API in k8s.io/kubernetes

Node Denial of Service via kubelet Checkpoint API in k8s.io/kubernetes...

GO-2025-3468 Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia

Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia...

GO-2025-3477 S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation in github.com/oxyno-zeta/s3-proxy

S3-Proxy allows Reflected Cross-site Scripting XSS in template implementation in github.com/oxyno-zeta/s3-proxy...

GO-2025-3474 MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping

MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping...

GO-2025-3466 Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping

Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping...

GO-2025-3461 go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative

go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative...

GO-2025-3467 `gh attestation verify` returns incorrect exit code during verification if no attestations are present in github.com/cli/cli

gh attestation verify returns incorrect exit code during verification if no attestations are present in github.com/cli/cli...

GO-2025-3481 Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server

Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server...

GO-2025-3470 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server

Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server...

GO-2025-3491 Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher

Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3483 Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server

Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server...

GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome

Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...

GO-2025-3495 MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio

MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2025-3472 SSRF in sliver teamserver in github.com/bishopfox/sliver

SSRF in sliver teamserver in github.com/bishopfox/sliver...

GO-2025-3459 Remote code execution in Wazuh server in github.com/wazuh/wazuh

Remote code execution in Wazuh server in github.com/wazuh/wazuh...

GO-2025-3489 Rancher's SAML-based login via CLI can be denied by unauthenticated users in github.com/rancher/rancher

Rancher's SAML-based login via CLI can be denied by unauthenticated users in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3490 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login in github.com/rancher/rancher

Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this...

GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...

GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution

Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...

GO-2025-3476 Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk

Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk...

GO-2025-3485 DoS in go-jose Parsing in github.com/go-jose/go-jose

DoS in go-jose Parsing in github.com/go-jose/go-jose...

GO-2025-3462 Unencrypted transmission in Temporal api-go library in go.temporal.io/api

Unencrypted transmission in Temporal api-go library in go.temporal.io/api...

GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

GO-2025-3487 Potential denial of service in golang.org/x/crypto

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

GO-2025-3456 WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core

WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core...

GO-2025-3458 SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo

SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3457 WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core

WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core...

GO-2025-3428 Arbitrary code execution during build on darwin in cmd/go

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...