4632 matches found
GO-2024-2569 Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium...
GO-2024-2721 Cross site scripting in github.com/tiagorlampert/CHAOS
A malicious actor may be able to extract a JWT token via malicious "/command" request. This is a form of cross site scripting XSS...
GO-2024-2497 Privilege escalation in github.com/moby/buildkit
BuildKit provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd...
GO-2023-1640 Path traversal when unzipping files in github.com/dablelv/go-huge-util
Path traversal when unzipping files in github.com/dablelv/go-huge-util...
GO-2022-0462 Improper validation of client certificates in github.com/pion/dtls/v2
Client-provided certificates are not correctly validated, and must not be trusted. DTLS client certificates must be accompanied by proof that the client possesses the private key for the certificate. The Pion DTLS server accepted client certificates unaccompanied by this proof, permitting an...
GO-2021-0092
Uniqueness of JWT IDs jti are not checked, allowing the JWT to be replayed...
GO-2026-6574 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei
Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...
GO-2026-6570 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei...
GO-2026-6473 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel
ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2026-6450 Joker linter executed project-local .jokerd/linter.* files during linting in github.com/candid82/joker
Joker linter executed project-local .jokerd/linter. files during linting in github.com/candid82/joker...
GO-2026-6415 SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel
SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns in github.com/siyuan-note/siyuan/kernel...
GO-2026-6260 vouch-proxy has an Unbounded Multipart Cookie Allocation DoS in github.com/vouch/vouch-proxy
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS in github.com/vouch/vouch-proxy...
GO-2026-6139 Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4
In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid...
GO-2026-5525 GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp
GoBGP has a panic in AdjRib.Update via malformed BGP Update message Nil Pointer Dereference in github.com/osrg/gobgp...
GO-2026-5912 GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber...
GO-2026-5987 Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh
The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token...
GO-2026-6025 File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser
File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser...
GO-2026-5938 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy...
GO-2026-5964 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel
SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel...
GO-2026-5969 TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy...
GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo
Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...
GO-2026-5496 Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git
Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git...
GO-2026-5888 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico
Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2026-5903 Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon...
GO-2026-5878 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs...
GO-2026-5899 Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor
Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor...
GO-2026-5811 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions in github.com/tursodatabase/turso-cli
turso-cli persists Turso platform JWT with world-readable 0o644 file permissions in github.com/tursodatabase/turso-cli...
GO-2026-5824 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-5751 Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows
Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows...
GO-2026-5729 Daytona: Public sandbox previews remain accessible for up to one hour after being made private in github.com/daytonaio/daytona
Daytona: Public sandbox previews remain accessible for up to one hour after being made private in github.com/daytonaio/daytona...
GO-2026-5747 File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser
File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser...
GO-2026-5663 Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server
Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server...
GO-2026-5644 SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2026-5703 OpenMeter: SQL injection through meter creation in github.com/openmeterio/openmeter
OpenMeter: SQL injection through meter creation in github.com/openmeterio/openmeter...
GO-2026-5554 Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest in github.com/ellanetworks/core
Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest in github.com/ellanetworks/core...
GO-2026-5594 Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno...
GO-2026-5416 gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify
gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify...
GO-2026-5499 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio...
GO-2026-5442 Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server
Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server...
GO-2026-5479 goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs...
GO-2026-5489 Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings
Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings...
GO-2026-5455 Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet
Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet...
GO-2026-5172 Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5354 kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router
kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router...
GO-2026-5305 Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs
Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5321 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea...
GO-2026-5328 Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs in github.com/lin-snow/ech0
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-5378 containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd
containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd...
GO-2026-5334 Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea
Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea...
GO-2026-5316 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic in github.com/siderolabs/omni
Omni: Operator can traverse image-factory API paths via unsanitized talosversion in CreateSchematic in github.com/siderolabs/omni...