4632 matches found
GO-2026-5473 Nuclei: Environment variable disclosure via Response-Derived DSL Expressions in github.com/projectdiscovery/nuclei
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions in github.com/projectdiscovery/nuclei...
GO-2026-5009 Kopia: RCE via SSH ProxyCommand Injection in github.com/kopia/kopia
Kopia: RCE via SSH ProxyCommand Injection in github.com/kopia/kopia...
GO-2024-3245 Ollama Out-of-bounds Read in github.com/ollama/ollama
Ollama Out-of-bounds Read in github.com/ollama/ollama...
GO-2024-3170 Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent
Grafana Agent Flow mode on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent...
GO-2024-3097 Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server
Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3099 Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric
Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric...
GO-2022-0924 Cross-site scripting in Dutchcoders transfer.sh in github.com/dutchcoders/transfer.sh
Cross-site scripting in Dutchcoders transfer.sh in github.com/dutchcoders/transfer.sh...
GO-2022-0775 Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereum
Erroneous Proof of Work calculation in geth in github.com/ethereum/go-ethereum...
GO-2023-2136 Artifact Hub arbitrary file read vulnerability in github.com/artifacthub/hub
Artifact Hub arbitrary file read vulnerability in github.com/artifacthub/hub...
GO-2023-2125 kOps privilege escalation vulnerability in k8s.io/kops
kOps privilege escalation vulnerability in k8s.io/kops...
GO-2023-2065 Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos
Cross-Site Request Forgery CSRF in usememos/memos in github.com/usememos/memos...
GO-2023-1801 kyverno seccomp control can be circumvented in github.com/kyverno/kyverno
kyverno seccomp control can be circumvented in github.com/kyverno/kyverno...
GO-2023-1582 Privilege escalation in MOSN in mosn.io/mosn
Privilege escalation in MOSN in mosn.io/mosn...
GO-2024-3029 Navidrome uses MD5 hashing algorithm in github.com/navidrome/navidrome
Navidrome uses MD5 hashing algorithm in github.com/navidrome/navidrome...
GO-2024-2993 Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver
Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2520 Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana
Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2940 SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo
SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo...
GO-2024-2665 ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2817 karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada
karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada...
GO-2024-2849 dotmesh arbitrary file read and/or write in github.com/dotmesh-io/dotmesh
dotmesh arbitrary file read and/or write in github.com/dotmesh-io/dotmesh...
GO-2024-2851 Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana
Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2692 Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble
Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble...
GO-2024-2803 Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome
Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome...
GO-2024-2870 Credential leakage in github.com/aquasecurity/trivy
A malicious registry can cause Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry ACR if the registry is scanned from directly using Trivy. These tokens can then be used to push/pull...
GO-2024-2819 Denial of Service in github.com/ethereum/go-ethereum
A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. This can result in a denial of service as the node runs out of memory...
GO-2024-2631 Decompression bomb vulnerability in github.com/go-jose/go-jose
An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...
GO-2022-0427 Unprotected file upload in github.com/swaggo/http-swagger
The httpSwagger package's HTTP handler provides WebDAV read/write access to an in-memory filesystem. An attacker can exploit this to cause memory exhaustion by uploading many files, XSS attacks by uploading malicious files, or other unexpected behaviors...
GO-2024-2466 Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4
Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4...
GO-2023-1867 Replay attacks involving proofs in github.com/bnb-chain/tss-lib
Replay attacks involving proofs in github.com/bnb-chain/tss-lib...
GO-2023-1573 Memory exhaustion via OCI image importer in github.com/containerd/containerd
When importing an OCI image, there was no limit on the number of bytes read from the io.Reader passed into ImportIndex. A large number of bytes could be read from this and could cause a denial of service...
GO-2022-0592
A maliciously crafted path can cause Get and other query functions to consume excessive amounts of CPU and time...
GO-2022-0522 Stack exhaustion on crafted paths in path/filepath
Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion...
GO-2022-0212 Request smuggling due to accepting invalid headers in net/http via net/textproto
net/http through net/textproto used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the...
GO-2021-0241 Attacker can drop certain headers in net/http/httputil
ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director...
GO-2022-0755 Cross-site request forgery in github.com/rancher/rancher
Rancher 2 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher...
GO-2020-0029
Due to improper HTTP header santization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source...
GO-2021-0072 Uncontrolled resource allocation in github.com/docker/distribution
Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory...
GO-2026-5051 Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and github.com/hirochachacha/go-smb2
ReadDir and ReadDirPlus parse the QUERYDIRECTORY SMB response by advancing through entries using the server-supplied NextEntryOffset field. The pre-fix code does not bound next against the remaining buffer before re-slicing, and the entry decoder IsInvalid check performs length arithmetic in int...
GO-2026-5730 Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy...
GO-2026-5832 Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API in github.com/nezhahq/nezha
Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5650 Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds in code.vikunja.io/api
Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5353 Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure in github.com/aws/amazon-ecs-agent
Amazon ECS Container Agent Windows is vulnerable to Information Disclosure in github.com/aws/amazon-ecs-agent...
GO-2026-5033 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used...
GO-2026-5001 SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution in github.com/siyuan-note/siyuan/kernel
SiYuan Bazaar marketplace renders unescaped package name and version metadata, allowing stored XSS and Electron code execution in github.com/siyuan-note/siyuan/kernel...
GO-2026-4619 Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs
Gogs: Access tokens get exposed through URL params in API requests in gogs.io/gogs...
GO-2026-4425 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern in github.com/rancher/local-path-provisioner
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern in github.com/rancher/local-path-provisioner...
GO-2025-3495 MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio
MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3338 Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server
Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3269 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli...