4684 matches found
GO-2026-5468 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs POST multipart upload in github.com/patrickhener/goshs...
GO-2026-5345 Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content in github.com/safedep/gryph
Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content in github.com/safedep/gryph...
GO-2026-5391 ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider in github.com/zitadel/zitadel
ZITADEL: Missing Token Audience Validation aud in JWT IdP Provider in github.com/zitadel/zitadel...
GO-2026-5377 ExternalSecrets vulnerable to privilege escalation with secret overwriting in github.com/external-secrets/external-secrets/apis
ExternalSecrets vulnerable to privilege escalation with secret overwriting in github.com/external-secrets/external-secrets/apis. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5286 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea
Gitea: Stored XSS via glTF extensionsRequired in Gitea 3D File Viewer in code.gitea.io/gitea...
GO-2026-5296 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances in github.com/steveiliop56/tinyauth...
GO-2026-5305 Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs
Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5257 Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option in github.com/hahwul/dalfox
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via output Option in github.com/hahwul/dalfox...
GO-2026-5196 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder
Coder: PKCS7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder...
GO-2026-5097 Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall
Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall...
GO-2026-5079 Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox...
GO-2026-5104 AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5043 Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule
Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule...
GO-2026-5049 nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints in github.com/juev/nebula-mesh
nebula-mesh's web UI lacks CSRF tokens on /ui/ mutating endpoints in github.com/juev/nebula-mesh...
GO-2026-4945 Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
The go-jose package is subject to a panic when decrypting certain JSON Web Encryption JWE tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service...
GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring now returns an error when...
GO-2026-4953 goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs
goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs...
GO-2026-4951 Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output in code.vikunja.io/api
Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2026-4964 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-4986 Quadratic string concatentation in consumeComment in net/mail
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...
GO-2026-4980 Escaper bypass leads to XSS in html/template
If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
GO-2026-4924 Juju has a resource poisoning vulnerability in github.com/juju/juju
Juju has a resource poisoning vulnerability in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...
GO-2026-4915 Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...
GO-2026-4717 Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo...
GO-2026-4756 free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter in github.com/free5gc/nrf
free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter in github.com/free5gc/nrf...
GO-2026-4689 Tinyauth's OIDC authorization codes are not bound to client on token exchange in github.com/steveiliop56/tinyauth
Tinyauth's OIDC authorization codes are not bound to client on token exchange in github.com/steveiliop56/tinyauth. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2026-4669 SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS in github.com/siyuan-note/siyuan/kernel
SiYuan has a SVG Sanitizer Bypass via Whitespace in javascript: URI — Unauthenticated XSS in github.com/siyuan-note/siyuan/kernel...
GO-2026-4617 Gogs: Release tag option injection in release deletion in gogs.io/gogs
Gogs: Release tag option injection in release deletion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugge...
GO-2026-4485 webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule in github.com/quic-go/webtransport-go
webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WTCLOSESESSION Capsule in github.com/quic-go/webtransport-go...
GO-2026-4418 EVE: SSH as Root Unlockable Without Triggering Measured Boot in github.com/lf-edge/eve
EVE: SSH as Root Unlockable Without Triggering Measured Boot in github.com/lf-edge/eve...
GO-2026-4308 Shiori is vulnerable to authentication bypass via a brute force attack in github.com/go-shiori/shiori
Shiori is vulnerable to authentication bypass via a brute force attack in github.com/go-shiori/shiori...
GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve
Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve...
GO-2026-4289 CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns
CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns...
GO-2025-4217 memos vulnerability allows the creation of arbitrary accounts in github.com/usememos/memos
memos vulnerability allows the creation of arbitrary accounts in github.com/usememos/memos...
GO-2025-3805 Juju allows arbitrary executable uploads via authenticated endpoint without authorization in github.com/juju/juju
Juju allows arbitrary executable uploads via authenticated endpoint without authorization in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2025-3671 ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel
ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...
GO-2025-3521 Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes
Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes...
GO-2025-3400 Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo
Matrix Media Repo MMR allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo...
GO-2025-3377 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3342 Traefik affected by CVE-2024-53259 in github.com/traefik/traefik
Traefik affected by CVE-2024-53259 in github.com/traefik/traefik...
GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator
The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...
GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
GO-2024-3243 Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul
Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul...
GO-2024-3237 NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit
NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit...
GO-2022-1065 Gitea vulnerable to Argument Injection in code.gitea.io/gitea
Gitea vulnerable to Argument Injection in code.gitea.io/gitea...
GO-2022-1014 CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o...
GO-2022-1060 Gogs vulnerable to Cross-site Scripting in gogs.io/gogs
Gogs vulnerable to Cross-site Scripting in gogs.io/gogs...
GO-2022-0907 Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes
Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes...
GO-2022-0906 Authentication Bypass in tyk-identity-broker in github.com/TykTechnologies/tyk-identity-broker
Authentication Bypass in tyk-identity-broker in github.com/TykTechnologies/tyk-identity-broker...