4632 matches found
GO-2024-3338 Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server
Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3269 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli...
GO-2024-3168 Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy...
GO-2022-1192 usememos/memos missing Secure cookie attribute in github.com/usememos/memos
usememos/memos missing Secure cookie attribute in github.com/usememos/memos...
GO-2022-0578 Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0512 DoS in KubeEdge's Websocket Client in package Viaduct in github.com/kubeedge/kubeedge
DoS in KubeEdge's Websocket Client in package Viaduct in github.com/kubeedge/kubeedge...
GO-2022-0358 Path traversal allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd
Path traversal allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd...
GO-2023-2176 Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation in github.com/kubernetes-csi/csi-proxy
Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation in github.com/kubernetes-csi/csi-proxy...
GO-2023-1911 gitjacker arbitrary code execution in github.com/liamg/gitjacker
gitjacker arbitrary code execution in github.com/liamg/gitjacker...
GO-2023-1291 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2024-3008 snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd
snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3010 CVE-2024-6984 in github.com/juju/juju
CVE-2024-6984 in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report. The...
GO-2024-2955 Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors
Gin-Gonic CORS middleware mishandles a wildcard at the end of an origin string. Examples: https://example.community/ is accepted by the origin string https://example.com/ and http://localhost.example.com/ is accepted by the origin string http://localhost/...
GO-2024-2558 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security...
GO-2024-2924 AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome
AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-2913 Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker
Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker...
GO-2024-2684 CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs
CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs...
GO-2024-2770 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax
IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...
GO-2024-2706 Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server
Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-2804 Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2024-2597 Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb
Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb...
GO-2024-2863 wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl
wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl...
GO-2024-2462 Arbitrary command execution in github.com/0xJacky/Nginx-UI
Arbitrary command execution in github.com/0xJacky/Nginx-UI...
GO-2023-2114 Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml
The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP context durin...
GO-2023-1268 Authentication failure in mellium.im/sasl
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...
GO-2022-0574 Denial of service in github.com/open-policy-agent/opa
An issue in the AST parser of Open Policy Agent makes it possible for attackers to cause a Denial of Service attack from a crafted input...
GO-2022-0433 Stack overflow from a large amount of PEM data in encoding/pem
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data...
GO-2021-0053 Panic due to improper input validation in github.com/gogo/protobuf
Due to improper bounds checking, maliciously crafted input to generated Unmarshal methods can cause an out-of-bounds panic. If parsing messages from untrusted parties, this may be used as a denial of service vector...
GO-2026-5844 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
GO-2026-5702 SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel...
GO-2026-5562 melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange
melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange...
GO-2026-5304 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/revoke,renew — incomplete fix of CVE-2026-45808 in github.com/openbao/openbao...
GO-2026-5329 zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok...
GO-2026-5331 Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata in github.com/lin-snow/ech0
Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata in github.com/lin-snow/ech0...
GO-2026-5337 Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) in github.com/kyverno/kyverno
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation CVE-2026-22039 Incomplete Fix in github.com/kyverno/kyverno...
GO-2026-5118 zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok...
GO-2026-4982 Bypass of meta content URL escaping causes XSS in html/template
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS...
GO-2026-4708 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan
SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan...
GO-2025-3958 Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3819 Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server
Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server...
GO-2025-3661 Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor...
GO-2025-3591 Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app...
GO-2024-3359 GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast
GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast...
GO-2022-0883 SQL Injection in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor
SQL Injection in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor...
GO-2022-0642 Cross-site Scripting in Gogs in gogs.io/gogs
Cross-site Scripting in Gogs in gogs.io/gogs...
GO-2022-0499 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd...
GO-2023-1982 Gophish vulnerable to Server-Side Request Forgery in github.com/gophish/gophish
Gophish vulnerable to Server-Side Request Forgery in github.com/gophish/gophish...
GO-2023-1928 Hashicorp Nomad Access Control Issues in github.com/hashicorp/nomad
Hashicorp Nomad Access Control Issues in github.com/hashicorp/nomad...
GO-2023-1590 GoPistolet vulnerable to Improper Resource Shutdown or Release in github.com/gopistolet/gopistolet
GoPistolet vulnerable to Improper Resource Shutdown or Release in github.com/gopistolet/gopistolet...