4632 matches found
GO-2022-0638 Information Exposure in Docker Engine in github.com/docker/docker
Information Exposure in Docker Engine in github.com/docker/docker...
GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd
Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd...
GO-2023-1931 CasaOS contains weak JWT secrets in github.com/IceWhaleTech/CasaOS
CasaOS contains weak JWT secrets in github.com/IceWhaleTech/CasaOS...
GO-2023-1685 HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File in github.com/hashicorp/vault
HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File in github.com/hashicorp/vault...
GO-2023-1502 Velociraptor subject to Path Traversal in www.velocidex.com/golang/velociraptor
Velociraptor subject to Path Traversal in www.velocidex.com/golang/velociraptor...
GO-2024-3016 Beego privilege escalation vulnerability via sendMail in github.com/beego/beego/v2
Beego privilege escalation vulnerability via sendMail in github.com/beego/beego/v2...
GO-2024-3064 Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer
Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer...
GO-2024-3040 Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju
Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causi...
GO-2024-2883 Denial of service via malicious preflight requests in github.com/rs/cors
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...
GO-2024-2562 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security...
GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression
go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...
GO-2024-2632 JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
An attacker with a trusted public key may cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time duri...
GO-2024-2825 Arbitrary code execution during build on Darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -ltolibrary flag in a "cgo LDFLAGS" directive...
GO-2024-2646 Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v2
Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. A malicious user to inject a javascript: link in the UI. When clicked by a victim...
GO-2024-2615 Username enumeration in github.com/IceWhaleTech/CasaOS-UserService
CasaOS-UserService is vulnerable to a username enumeration issue, when an attacker can enumerate the CasaOS username using the application response. If the username is incorrect, the application gives the error 'User does not exist'. If the password is incorrect, the application gives the error...
GO-2024-2618 Authentication token leak in github.com/cloudevents/sdk-go/v2
Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, http.DefaultClient is modified with the authenticated transport...
GO-2024-2616 Path traversal and user privilege escalation in github.com/IceWhaleTech/CasaOS-UserService
The UserService API contains a path traversal vulnerability that allows an attacker to obtain any file on the system, including the user database and system configuration. This can lead to privilege escalation and compromise of the system...
GO-2024-2492 Panic in github.com/moby/buildkit
A malicious BuildKit client or frontend could craft a request that could lead to a BuildKit daemon crashing with a panic...
GO-2023-2096 Signature malleability in github.com/consensys/gnark-crypto
Signature malleability in github.com/consensys/gnark-crypto...
GO-2023-2048 Paths outside of the rootfs could be produced on Windows in github.com/cyphar/filepath-securejoin
Certain rootfs and path combinations result in generated paths that are outside of the provided rootfs on Windows...
GO-2023-1589 Denial of service from memory exhaustion in github.com/notaryproject/notation-go
Parsing PKIX distinguished names containing the string "=" can cause excessive memory consumption...
GO-2022-1165 Denial of service via repository index file in helm.sh/helm/v3
Applications that use the repo package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds reference...
GO-2022-1040 Insufficient sanitization of data files in helm.sh/helm/v3
Helm does not sanitize all fields read from repository data files. A maliciously crafted data file may contain strings containing arbitrary data. If printed to a terminal, a malicious string could obscure or alter data on the screen...
GO-2022-0957 Denial of service via maliciously crafted JSON in github.com/tidwall/gjson
A maliciously crafted JSON input can cause a denial of service attack...
GO-2022-0379 Type confusion in github.com/docker/distribution
Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. A maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image's digest, invalidating the common pattern of relying o...
GO-2022-0300 Panic via malicious inputs in github.com/graph-gophers/graphql-go
Malicious inputs can cause a panic. A maliciously crafted input can cause a stack overflow and panic. Any user with access to the GraphQL can send such a query. This issue only occurs when using the graphql.MaxDepth schema option which is highly recommended in most cases...
GO-2022-0385
The AuthenticateMethod authentication hook is not called for WebSocket connections, allowing unauthenticated access. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable...
GO-2022-0463 Access control bypass due to broad route matching in github.com/beego/beego and beego/v2
Routes in the beego HTTP router can match unintended patterns. This overly-broad matching may permit an attacker to bypass access controls. For example, the pattern "/a/b/:name" can match the URL "/a.xml/b/". This may bypass access control applied to the prefix "/a/"...
GO-2021-0078 Panic when parsing malformed HTML in golang.org/x/net/html
The HTML parser does not properly handle "in frameset" insertion mode, and can be made to panic when operating on malformed HTML that contains tags. If operating on user input, this may be a vector for a denial of service attack...
GO-2026-5802 Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus
Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus...
GO-2026-5855 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape in github.com/fission/fission
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape in github.com/fission/fission...
GO-2026-5494 Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks...
GO-2026-5491 Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string in github.com/tomwright/dasel
Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string in github.com/tomwright/dasel...
GO-2026-5369 Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox
Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox...
GO-2026-5310 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp...
GO-2026-5312 Gogs has SSRF in webhook deliveries in gogs.io/gogs
Gogs has SSRF in webhook deliveries in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2026-5356 Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint in github.com/getarcaneapp/arcane/backend
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint in github.com/getarcaneapp/arcane/backend...
GO-2026-5314 OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims in github.com/oauth2-proxy/oauth2-proxy
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims in github.com/oauth2-proxy/oauth2-proxy...
GO-2026-5383 FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser...
GO-2026-5215 Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator
Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator...
GO-2026-5267 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types in github.com/openbao/openbao
OpenBao: Transit secrets engine crashes on key creation with derived: true for asymmetric key types in github.com/openbao/openbao...
GO-2026-4993 SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) in github.com/siyuan-note/siyuan/kernel
SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink incomplete fix for CVE-2026-34585 in github.com/siyuan-note/siyuan/kernel...
GO-2026-4873 Ella Core has Privilege Escalation via Database Restore by NetworkManager role in github.com/ellanetworks/core
Ella Core has Privilege Escalation via Database Restore by NetworkManager role in github.com/ellanetworks/core...
GO-2026-4647 x402 SDK Security Advisory in github.com/coinbase/x402/go
x402 SDK Security Advisory in github.com/coinbase/x402/go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to...
GO-2026-4275 Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira
Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-3874 Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari
Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari...
GO-2025-3822 Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources in goauthentik.io
Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3646 CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s
CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3610 Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server
Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server...