4632 matches found
GO-2024-2716 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb...
GO-2024-2814 Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings...
GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign
Improper verification of signature attestations in github.com/sigstore/cosign...
GO-2023-1269 Panic in encoding in github.com/ipld/go-ipld-prime
Encoding data using the 'json' codec which contains a 'Bytes' type Node will cause the encoder to panic. The decoder is not impacted. If the codec is used to encode user supplied data, this may be used as a vector for a denial of service attack...
GO-2022-0572 Access control bypass via incorrect route lookup in github.com/beego/beego and beego/v2
An issue was discovered in the route lookup process in beego which attackers to bypass access control...
GO-2021-0238 Infinite loop when parsing inputs in golang.org/x/net/html
An attacker can craft an input to ParseFragment that causes it to enter an infinite loop and never return...
GO-2020-0011
When decrypting JsonWebEncryption objects with multiple recipients or JsonWebSignature objects with multiple signatures the Decrypt and Verify methods do not indicate which recipient or signature was valid. This may lead a caller to rely on protected headers from an invalid recipient or signature...
GO-2026-5313 Hugo: XSS via text/html content files in github.com/gohugoio/hugo
Hugo: XSS via text/html content files in github.com/gohugoio/hugo...
GO-2026-5815 nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction in github.com/juev/nebula-mesh
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction in github.com/juev/nebula-mesh...
GO-2026-5858 Fission Container Executor Function PodSpec Injection Leading to Node Escape in github.com/fission/fission
Fission Container Executor Function PodSpec Injection Leading to Node Escape in github.com/fission/fission...
GO-2026-5724 Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs
Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2026-5646 NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird
NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner in github.com/netbirdio/netbird...
GO-2026-5716 Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call in github.com/kubewarden/kubewarden-controller
Kubewarden vulnerable to RBAC Reconnaissance via unchecked cani host capability call in github.com/kubewarden/kubewarden-controller...
GO-2026-5588 Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker
Netmaker does not verify JWT signatures for host tokens in github.com/gravitl/netmaker...
GO-2026-5349 free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf
free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf...
GO-2026-5191 nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh
nebula-mesh: POST /api/v1/hosts/id/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh...
GO-2026-5018 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public...
GO-2026-4984 Malicious module proxy can bypass checksum database in cmd/go
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy GOMODPROXY or checksum database GOSUMDB. A malicious module proxy can serve altered versions o...
GO-2026-4742 Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall
Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall...
GO-2026-4316 Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi
Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi...
GO-2025-3970 DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly...
GO-2025-3724 Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server
Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server...
GO-2025-3468 Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia
Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia...
GO-2025-3380 Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server
Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3363 Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada
Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada...
GO-2024-3336 MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio
MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio...
GO-2024-3163 Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle
Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3119 Path traversal vulnerability in stripe-cli in github.com/stripe/stripe-cli
Path traversal vulnerability in stripe-cli in github.com/stripe/stripe-cli...
GO-2022-1119 Tailscale daemon is vulnerable to information disclosure via CSRF in tailscale.com
Tailscale daemon is vulnerable to information disclosure via CSRF in tailscale.com...
GO-2022-0879 Allocation of Resources Without Limits or Throttling in Hashicorp Consul in github.com/hashicorp/consul
Allocation of Resources Without Limits or Throttling in Hashicorp Consul in github.com/hashicorp/consul...
GO-2022-0793 Path traversal in u-root in github.com/u-root/u-root
Path traversal in u-root in github.com/u-root/u-root...
GO-2023-2005 1Panel Arbitrary File Download vulnerability in github.com/1Panel-dev/1Panel
1Panel Arbitrary File Download vulnerability in github.com/1Panel-dev/1Panel...
GO-2023-1955 Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr
Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr...
GO-2023-1768 Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings
Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings...
GO-2023-1283 KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys in github.com/KubeOperator/kubepi...
GO-2024-3016 Beego privilege escalation vulnerability via sendMail in github.com/beego/beego/v2
Beego privilege escalation vulnerability via sendMail in github.com/beego/beego/v2...
GO-2024-3042 Podman vulnerable to memory-based denial of service in github.com/containers/podman
Podman vulnerable to memory-based denial of service in github.com/containers/podman...
GO-2024-2990 1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel
1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2024-2883 Denial of service via malicious preflight requests in github.com/rs/cors
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...
GO-2024-2932 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec in github.com/rancher/rancher
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2024-2919 malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o
malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o...
GO-2024-2778 Rancher Privilege escalation vulnerability via malicious "Connection" header in github.com/rancher/rancher
Rancher Privilege escalation vulnerability via malicious "Connection" header in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2811 piraeus-operator allows attacker to impersonate service account in github.com/piraeusdatastore/piraeus-operator
piraeus-operator allows attacker to impersonate service account in github.com/piraeusdatastore/piraeus-operator...
GO-2024-2871 Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder
Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder...
GO-2024-2690 HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault...
GO-2024-2728 Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd
Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd...
GO-2024-2667 Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2
Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2...
GO-2024-2658 Container escape at build time in github.com/containers/buildah
A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem...
GO-2024-2598 Verify panics on certificates with an unknown public key algorithm in crypto/x509
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...