4692 matches found
GO-2023-1764 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen...
GO-2023-1761 imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy
imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy...
GO-2023-1661 Answer has Observable Timing Discrepancy in github.com/answerdev/answer
Answer has Observable Timing Discrepancy in github.com/answerdev/answer...
GO-2024-3074 Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium...
GO-2024-2977 IP addresses were encoded in the wrong byte order in github.com/google/nftables
IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which did not work as intended might block or not block the desired addresses...
GO-2024-2505 Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul
Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2444 Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2927 Evmos is missing create validator check in github.com/evmos/evmos
Evmos is missing create validator check in github.com/evmos/evmos...
GO-2024-2769 Gitea allowed assignment of private issues in code.gitea.io/gitea
Gitea allowed assignment of private issues in code.gitea.io/gitea...
GO-2024-2648 Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server
Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server...
GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter
There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...
GO-2023-2379 Denial of service due to malicious parameters in github.com/lestrrat-go/jwx
The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force...
GO-2023-2074 Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown
Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown...
GO-2022-1187 Open redirect vulnerability in github.com/go-macaron/i18n
A user controlled string could lead to open redirect...
GO-2022-0619 Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3
CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy. The AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regula...
GO-2022-0252 Panic on misconfigured IP address in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits...
GO-2026-6571 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei
Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...
GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...
GO-2026-6324 Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances in github.com/portainer/portainer
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6300 Filestash allows attackers to escalate privileges via sending a crafted request in github.com/mickael-kerjean/filestash
Filestash allows attackers to escalate privileges via sending a crafted request in github.com/mickael-kerjean/filestash...
GO-2026-6285 Mattermost doesn't require system-level permission when patching protected default system roles in github.com/mattermost/mattermost-server
Mattermost doesn't require system-level permission when patching protected default system roles in github.com/mattermost/mattermost-server...
GO-2026-6138 Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td
Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td...
GO-2026-6181 Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone...
GO-2026-6127 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission...
GO-2026-6249 Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer
Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2026-6231 Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution in github.com/kubev2v/assisted-migration-agent
Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution in github.com/kubev2v/assisted-migration-agent...
GO-2026-6140 Weaviate has an Improper Authorization issue in github.com/weaviate/weaviate
Weaviate has an Improper Authorization issue in github.com/weaviate/weaviate...
GO-2026-6062 Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev
Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...
GO-2026-6069 Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private in gitea.dev
Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private in gitea.dev...
GO-2026-5116 Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah
Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...
GO-2026-5736 Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server
Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server...
GO-2026-5886 GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber...
GO-2026-5336 Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git
Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git...
GO-2026-6053 Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints in gitea.dev
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints in gitea.dev...
GO-2026-5916 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder...
GO-2026-5812 Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet
Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet...
GO-2026-5907 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder
Coder's OIDC emailverified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder...
GO-2026-5902 SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo
SFTPGo has path confinement bypass in public browsable share partial ZIP download in github.com/drakkan/sftpgo...
GO-2026-5909 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder...
GO-2026-5865 Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast...
GO-2026-5860 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover in github.com/fission/fission
Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover in github.com/fission/fission...
GO-2026-5849 Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission...
GO-2026-5831 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS in github.com/nezhahq/nezha
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5825 gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic
gonic: Path Traversal in playlist id bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic...
GO-2026-5843 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
GO-2026-5768 ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) in github.com/zitadel/zitadel
ZITADEL: Missing clientid binding in OIDC authorization code exchange and refresh token flows RFC 6749 Section 4.1.3 violation in github.com/zitadel/zitadel...
GO-2026-5772 Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon...
GO-2026-5674 OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao
OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao...
GO-2026-5717 free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef
free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef...