4632 matches found
GO-2025-3627 Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik
Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik...
GO-2025-3568 ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx
ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes
Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes...
GO-2025-3546 PipeCD Vulnerable to Privilege Escalation in github.com/pipe-cd/pipecd
PipeCD Vulnerable to Privilege Escalation in github.com/pipe-cd/pipecd...
GO-2025-3427 Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator
Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator...
GO-2024-3268 Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in oth...
GO-2024-3303 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows
Argo Workflows Allows Access to Archived Workflows with Fake Token in client mode in github.com/argoproj/argo-workflows...
GO-2024-3289 OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console
OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console...
GO-2024-3253 LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI
LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI...
GO-2024-3241 Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul...
GO-2024-3129 OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer in github.com/openshift/builder
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer in github.com/openshift/builder...
GO-2024-3107 Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...
GO-2022-1245 usememos/memos Improper Authorization vulnerability in github.com/usememos/memos
usememos/memos Improper Authorization vulnerability in github.com/usememos/memos...
GO-2022-1105 HashiCorp Nomad vulnerable to non-sensitive metadata exposure in github.com/hashicorp/nomad
HashiCorp Nomad vulnerable to non-sensitive metadata exposure in github.com/hashicorp/nomad...
GO-2022-0895 HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul
HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul...
GO-2022-0867 Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes in k8s.io/kubernetes
Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes in k8s.io/kubernetes...
GO-2022-0853 SQL Injection in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor
SQL Injection in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor...
GO-2022-0759 PolicyController before 0.2.1 may bypass attestation verification in github.com/sigstore/policy-controller
PolicyController before 0.2.1 may bypass attestation verification in github.com/sigstore/policy-controller...
GO-2022-0703 XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes
XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes...
GO-2022-0508 KubeEdge Cloud AdmissionController component DoS in github.com/kubeedge/kubeedge
KubeEdge Cloud AdmissionController component DoS in github.com/kubeedge/kubeedge...
GO-2022-0511 KubeEdge Cloud Stream and Edge Stream DoS from large stream message in github.com/kubeedge/kubeedge
KubeEdge Cloud Stream and Edge Stream DoS from large stream message in github.com/kubeedge/kubeedge...
GO-2022-0510 KubeEdge CloudCore Router memory exhaustion vulnerability in github.com/kubeedge/kubeedge
KubeEdge CloudCore Router memory exhaustion vulnerability in github.com/kubeedge/kubeedge...
GO-2022-0561 Use of Hard-coded Cryptographic Key in Netmaker in github.com/gravitl/netmaker
Use of Hard-coded Cryptographic Key in Netmaker in github.com/gravitl/netmaker...
GO-2022-0497 Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd...
GO-2022-0453 Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd...
GO-2022-0281 Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman...
GO-2023-2159 Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes
Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes...
GO-2023-2011 Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading in github.com/yaklang/yaklang
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading in github.com/yaklang/yaklang...
GO-2023-1927 Podman Path Traversal Vulnerability leads to arbitrary file read/write in github.com/containers/podman
Podman Path Traversal Vulnerability leads to arbitrary file read/write in github.com/containers/podman...
GO-2023-1831 Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack in github.com/notaryproject/notation
Notation's default maxSignatureAttempts in notation verify enables an endless data attack in github.com/notaryproject/notation...
GO-2023-1852 HashiCorp Consul Incorrect Access Control vulnerability in github.com/hashicorp/consul
HashiCorp Consul Incorrect Access Control vulnerability in github.com/hashicorp/consul...
GO-2023-1738 Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer in github.com/apptainer/apptainer
Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer in github.com/apptainer/apptainer...
GO-2023-1662 Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer...
GO-2024-3071 Gateway API route matching order contradicts specification in github.com/cilium/cilium
Gateway API route matching order contradicts specification in github.com/cilium/cilium...
GO-2024-2982 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault
Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2519 Grafana world readable configuration files in github.com/grafana/grafana
Grafana world readable configuration files in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio
Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...
GO-2024-2491 Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc
Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc...
GO-2024-2516 Grafana XSS via a column style in github.com/grafana/grafana
Grafana XSS via a column style in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...
GO-2024-2447 Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...
GO-2024-2850 NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server...
GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd...
GO-2024-2812 Some CORS middleware allow untrusted origins in github.com/jub0bs/fcors
Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...
GO-2023-1766 Denial of service from memory leak in github.com/ipfs/go-libipfs
An attacker can cause a Bitswap server to allocate and leak unbounded amounts of memory...
GO-2022-0193 Panic on unconsidered isindex and template combination in golang.org/x/net/html
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...
GO-2022-0438 Exposure of sensitive information via log file in github.com/hashicorp/go-getter
The getter package can write SSH credentials to its logfile, exposing credentials to local users able to read the logfile...
GO-2021-0057 Panic due to improper input validation in github.com/buger/jsonparser
Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector...
GO-2021-0091
Due to improper input validation when uploading a file, a malicious user may force the server to return arbitrary HTTP headers when the uploaded file is downloaded...
GO-2026-6443 Server panic via missing authority or Host headers in google.golang.org/grpc
In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice,...
GO-2026-5946 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE in github.com/nuclio/nuclio
Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE in github.com/nuclio/nuclio...