4632 matches found
GO-2024-2996 CVE-2024-21527 in github.com/gotenberg/gotenberg
CVE-2024-21527 in github.com/gotenberg/gotenberg...
GO-2024-2477 OpenFGA denial of service in github.com/openfga/openfga
OpenFGA denial of service in github.com/openfga/openfga...
GO-2024-2521 Moby Docker cp broken with debian containers in github.com/docker/docker
In Docker 19.03.x before 19.03.1 linked against the GNU C Library aka glibc, code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container...
GO-2024-2535 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' in github.com/rancher/rancher
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2915 Open Redirect URL in Harbor in github.com/goharbor/harbor
Open Redirect URL in Harbor in github.com/goharbor/harbor...
GO-2024-2906 CVE-2024-5138 in github.com/snapcore/snapd
CVE-2024-5138 in github.com/snapcore/snapd...
GO-2024-2776 Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol
Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol...
GO-2024-2789 Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator
Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator...
GO-2024-2796 Mattermost fails to limit the size of a request path in github.com/mattermost/mattermost-server
Mattermost fails to limit the size of a request path in github.com/mattermost/mattermost-server...
GO-2024-2762 Rancher code injection via fluentd config commands in github.com/rancher/rancher
Rancher code injection via fluentd config commands in github.com/rancher/rancher...
GO-2024-2814 Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings...
GO-2024-2643 Bypass manifest during application creation in github.com/argoproj/argo-cd/v2
An improper validation bug allows users who have create privileges to sync a local manifest during application creation. This allows for bypassing the restriction that the manifests come from some approved git/Helm/OCI source...
GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign
Improper verification of signature attestations in github.com/sigstore/cosign...
GO-2023-2000 Large RSA keys can cause high resource usage in github.com/libp2p/go-libp2p
Large RSA keys can lead to resource exhaustion attacks. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits...
GO-2023-1269 Panic in encoding in github.com/ipld/go-ipld-prime
Encoding data using the 'json' codec which contains a 'Bytes' type Node will cause the encoder to panic. The decoder is not impacted. If the codec is used to encode user supplied data, this may be used as a vector for a denial of service attack...
GO-2022-0572 Access control bypass via incorrect route lookup in github.com/beego/beego and beego/v2
An issue was discovered in the route lookup process in beego which attackers to bypass access control...
GO-2021-0238 Infinite loop when parsing inputs in golang.org/x/net/html
An attacker can craft an input to ParseFragment that causes it to enter an infinite loop and never return...
GO-2020-0011
When decrypting JsonWebEncryption objects with multiple recipients or JsonWebSignature objects with multiple signatures the Decrypt and Verify methods do not indicate which recipient or signature was valid. This may lead a caller to rely on protected headers from an invalid recipient or signature...
GO-2026-6328 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA in github.com/free5gc/ausf
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES in 5G-AKA in github.com/free5gc/ausf...
GO-2026-5815 nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction in github.com/juev/nebula-mesh
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction in github.com/juev/nebula-mesh...
GO-2026-5646 NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird
NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird...
GO-2026-5588 Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker
Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker...
GO-2026-5191 nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh
nebula-mesh: POST /api/v1/hosts/id/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh...
GO-2026-5067 Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server...
GO-2026-4742 Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall
Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall...
GO-2025-3563 Request smuggling due to acceptance of invalid chunked data in net/http
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...
GO-2025-3567 ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx
ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2025-3468 Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia
Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia...
GO-2025-3474 MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping
MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping...
GO-2025-3380 Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server
Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3364 Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada
Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada...
GO-2024-3286 Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes
Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes...
GO-2024-3278 Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines...
GO-2024-3273 CVE-2024-24426 in github.com/magma/magma
CVE-2024-24426 in github.com/magma/magma...
GO-2024-3163 Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle
Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3156 CVE-2024-47219 in github.com/vesoft-inc/nebula
CVE-2024-47219 in github.com/vesoft-inc/nebula...
GO-2024-3119 Path traversal vulnerability in stripe-cli in github.com/stripe/stripe-cli
Path traversal vulnerability in stripe-cli in github.com/stripe/stripe-cli...
GO-2024-3091 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server
Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server...
GO-2022-1119 Tailscale daemon is vulnerable to information disclosure via CSRF in tailscale.com
Tailscale daemon is vulnerable to information disclosure via CSRF in tailscale.com...
GO-2022-0912 Predictable SIF UUID Identifiers in github.com/sylabs/sif
Predictable SIF UUID Identifiers in github.com/sylabs/sif...
GO-2022-0634 Hashicorp Nomad Information Exposure Through Environmental Variables in github.com/hashicorp/nomad
Hashicorp Nomad Information Exposure Through Environmental Variables in github.com/hashicorp/nomad...
GO-2022-0450 Shell command injection in gitea in code.gitea.io/gitea
Shell command injection in gitea in code.gitea.io/gitea...
GO-2022-0451 Ignition config accessible to unprivileged software on VMware in github.com/coreos/ignition
Ignition config accessible to unprivileged software on VMware in github.com/coreos/ignition...
GO-2023-2344 Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells
Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells...
GO-2023-2050 Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd
Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd...
GO-2023-2005 1Panel Arbitrary File Download vulnerability in github.com/1Panel-dev/1Panel
1Panel Arbitrary File Download vulnerability in github.com/1Panel-dev/1Panel...
GO-2023-1956 KubePi Privilege Escalation vulnerability in github.com/KubeOperator/kubepi
KubePi Privilege Escalation vulnerability in github.com/KubeOperator/kubepi...
GO-2023-1957 KubePi may leak password hash of any user in github.com/KubeOperator/kubepi
KubePi may leak password hash of any user in github.com/KubeOperator/kubepi...
GO-2023-1633 Nomad Job Submitter Privilege Escalation Using Workload Identity in github.com/hashicorp/nomad
Nomad Job Submitter Privilege Escalation Using Workload Identity in github.com/hashicorp/nomad...