4632 matches found
GO-2026-5389 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend
Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend...
GO-2026-5373 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) in github.com/radius-project/radius
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation Multi-Tenant Installs in github.com/radius-project/radius...
GO-2026-5371 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno...
GO-2026-5326 free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef
free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef...
GO-2026-5333 Portainer missing authorization on custom template file endpoint, which exposes template content in github.com/portainer/portainer
Portainer missing authorization on custom template file endpoint, which exposes template content in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5348 auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation in github.com/go-pkgz/auth
auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation in github.com/go-pkgz/auth...
GO-2026-5350 Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) in github.com/cloudreve/Cloudreve
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation Insecure PRNG Seeding in github.com/cloudreve/Cloudreve...
GO-2026-5357 SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution in github.com/siyuan-note/siyuan/kernel
SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution in github.com/siyuan-note/siyuan/kernel...
GO-2026-5361 authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd
authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd...
GO-2026-5298 Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList() in github.com/google/go-attestation
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList in github.com/google/go-attestation...
GO-2026-5089 FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser
FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser...
GO-2026-5092 Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server
Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server...
GO-2026-5042 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs in github.com/kata-containers/kata-containers
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs in github.com/kata-containers/kata-containers...
GO-2026-4996 Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator...
GO-2026-4983 ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction in github.com/ydb-platform/ydb-go-sdk
ydb-go-sdk's transactions are not committed using the options.WithCommit option on last call table.Transaction.Execute in transaction in github.com/ydb-platform/ydb-go-sdk...
GO-2026-4703 Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo...
GO-2026-4713 File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely in github.com/filebrowser/filebrowser
File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely in github.com/filebrowser/filebrowser...
GO-2026-4766 SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass) in github.com/siyuan-note/siyuan/kernel
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home GHSA-h5vh-m7fg-w5h6 Bypass in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2026-4729 Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server
Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causi...
GO-2026-4750 Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf
Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf...
GO-2026-4684 Traefik: HTTP/2 frames can cause a running server to panic in github.com/traefik/traefik
Traefik: HTTP/2 frames can cause a running server to panic in github.com/traefik/traefik...
GO-2026-4540 Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3...
GO-2026-4524 Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server
Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2025-3875 Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2025-3412 Excessive resource consumption when unmarshalling Compose file with recursive loop in github.com/compose-spec/compose-go/v2
Excessive resource consumption when unmarshalling Compose file with recursive loop in github.com/compose-spec/compose-go/v2...
GO-2024-3324 SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel...
GO-2024-3137 ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel
ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2022-1147 containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd
containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd...
GO-2022-1021 HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault
HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault...
GO-2022-0922 ExternalName Services can be used to gain access to Envoy's admin interface in github.com/projectcontour/contour
ExternalName Services can be used to gain access to Envoy's admin interface in github.com/projectcontour/contour...
GO-2022-0903 Denial-of-Service within Docker container in ktbs.dev/teler
Denial-of-Service within Docker container in ktbs.dev/teler...
GO-2022-0845 Local Privilege Escalation in cloudflared in github.com/cloudflare/cloudflared
Local Privilege Escalation in cloudflared in github.com/cloudflare/cloudflared...
GO-2022-0828 Path Traversal in Buildah in github.com/containers/buildah
Path Traversal in Buildah in github.com/containers/buildah...
GO-2022-0788 Insecure Permissions in Gogs in gogs.io/gogs
Insecure Permissions in Gogs in gogs.io/gogs...
GO-2022-0645 Access control flaw in Kiali in github.com/kiali/kiali
Access control flaw in Kiali in github.com/kiali/kiali...
GO-2022-0709 Improper network isolation in Hashicorp Nomad in github.com/hashicorp/nomad
Improper network isolation in Hashicorp Nomad in github.com/hashicorp/nomad...
GO-2022-0641 Improper Authorization in github.com/containers/libpod
Improper Authorization in github.com/containers/libpod...
GO-2022-0507 KubeEdge Edge ServiceBus module DoS in github.com/kubeedge/kubeedge
KubeEdge Edge ServiceBus module DoS in github.com/kubeedge/kubeedge...
GO-2022-0550 Off-by-one Error in v2fly/v2ray-core in github.com/v2fly/v2ray-core
Off-by-one Error in v2fly/v2ray-core in github.com/v2fly/v2ray-core...
GO-2023-1895 Zinc Cross-site Scripting vulnerability in github.com/zinclabs/zinc
Zinc Cross-site Scripting vulnerability in github.com/zinclabs/zinc...
GO-2023-1699 Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker
Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker...
GO-2023-1533 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in github.com/anchore/syft
Credential disclosure in syft when SYFTATTESTPASSWORD environment variable set in github.com/anchore/syft...
GO-2024-2515 Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana
Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugges...
GO-2024-2531 1Panel set-cookie is missing the Secure keyword in github.com/1Panel-dev/1Panel
1Panel set-cookie is missing the Secure keyword in github.com/1Panel-dev/1Panel...
GO-2024-2510 Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana
Grafana Cross-site Scripting XSS in github.com/grafana/grafana...
GO-2024-2472 Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry
Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry...
GO-2024-2527 Insecure ciphers are allowed by default in go.etcd.io/etcd
The TLS ciphers list supported by etcd contains insecure cipher suites. Users may specify that an insecure cipher is used via “--cipher-suites” flag. A list of secure suites is used by default...
GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...
GO-2024-2947 Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp
URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file...