4632 matches found
GO-2024-2783 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax
IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...
GO-2024-2763 Heketi Arbitrary Code Execution in github.com/heketi/heketi
Heketi Arbitrary Code Execution in github.com/heketi/heketi...
GO-2024-2579 Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer
Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer...
GO-2024-2609 Comments in display names are incorrectly handled in net/mail
The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...
GO-2023-2119 Proof forgery due to insufficient randomness in github.com/consensys/gnark
A a third party may derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of...
GO-2023-2113 Memory exhaustion in go.opentelemetry.io/contrib/instrumentation
Memory exhaustion in go.opentelemetry.io/contrib/instrumentation...
GO-2023-1497 Leaked user credentials in github.com/sylabs/scs-library-client
When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider...
GO-2021-0058 Signature validation bypass due to XML processing error in github.com/crewjam/saml
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2026-6454 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik...
GO-2026-6455 Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik
Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik...
GO-2026-5992 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker...
GO-2026-5959 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL in github.com/authorizerdev/authorizer
Authorizer: Unvalidated redirecturi in /authorize leaks OAuth2 tokens to attacker-controlled URL in github.com/authorizerdev/authorizer...
GO-2026-5921 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder...
GO-2026-5801 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus
Incus has an arbitrary file write on host via exec-output symlink in crafted image in github.com/lxc/incus...
GO-2026-5922 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder
Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder...
GO-2026-5889 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour
Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour...
GO-2026-5813 Hysteria: http large header with sniff cause server DoS in github.com/apernet/hysteria
Hysteria: http large header with sniff cause server DoS in github.com/apernet/hysteria. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5835 Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server
Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server...
GO-2026-5830 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) in go.senan.xyz/gonic
Subsonic API: any authenticated user can delete or read any other user's playlist IDOR in go.senan.xyz/gonic...
GO-2026-5756 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome...
GO-2026-5722 free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication in github.com/free5gc/udr
free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication in github.com/free5gc/udr...
GO-2026-5632 Pelican Web UI Affected by a Privilege Escalation Attack in github.com/pelicanplatform/pelican
Pelican Web UI Affected by a Privilege Escalation Attack in github.com/pelicanplatform/pelican...
GO-2026-5732 ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider in github.com/zitadel/zitadel
ZITADEL: Missing Token Lifecyle Validation exp and iat in JWT IdP Provider in github.com/zitadel/zitadel...
GO-2026-5645 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) in github.com/nezhahq/nezha
Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks no ownership check in github.com/nezhahq/nezha...
GO-2026-5723 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets
External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...
GO-2026-5673 Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf
Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf...
GO-2026-5738 Contour has Lua code injection via Cookie Path Rewrite Policy in github.com/projectcontour/contour
Contour has Lua code injection via Cookie Path Rewrite Policy in github.com/projectcontour/contour...
GO-2026-5747 File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser
File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser...
GO-2026-5563 Kata Container has CopyFile Policy Subversion via Symlinks in github.com/kata-containers/kata-containers
Kata Container has CopyFile Policy Subversion via Symlinks in github.com/kata-containers/kata-containers...
GO-2026-5561 Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend...
GO-2026-5547 in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang
in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang...
GO-2026-5514 SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb
SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb...
GO-2026-5552 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering in github.com/OliveTin/OliveTin
OliveTin has Unvalidated ot-prefixed Arguments that Bypass Input Filtering in github.com/OliveTin/OliveTin...
GO-2026-5468 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs POST multipart upload in github.com/patrickhener/goshs...
GO-2026-5340 Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) in github.com/getarcaneapp/arcane/backend
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content incl. .env secrets in github.com/getarcaneapp/arcane/backend...
GO-2026-5286 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea
Gitea: Stored XSS via glTF extensionsRequired in Gitea 3D File Viewer in code.gitea.io/gitea...
GO-2026-5296 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth...
GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...
GO-2026-5385 Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon
Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon...
GO-2026-5257 Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option in github.com/hahwul/dalfox
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via output Option in github.com/hahwul/dalfox...
GO-2026-5196 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder
Coder: PKCS7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder...
GO-2026-5097 Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall
Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall...
GO-2026-5079 Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox...
GO-2026-5104 AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5043 Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule
Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule...
GO-2026-5049 nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints in github.com/juev/nebula-mesh
nebula-mesh's web UI lacks CSRF tokens on /ui/ mutating endpoints in github.com/juev/nebula-mesh...
GO-2026-4945 Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
The go-jose package is subject to a panic when decrypting certain JSON Web Encryption JWE tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service...
GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring now returns an error when...
GO-2026-4964 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...