4692 matches found
GO-2026-6322 arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset in github.com/basekick-labs/arc
arc has unauthenticated cluster node admission when cluster.sharedsecret is unset in github.com/basekick-labs/arc...
GO-2026-6284 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui...
GO-2026-6108 Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh
Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh...
GO-2026-6242 New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
New API: Integer overflow in quota billing yields negative charges self-crediting in github.com/QuantumNous/new-api...
GO-2026-6156 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings...
GO-2026-6071 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` in gitea.dev
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via /api/v1/user/starred and private issue titles via /api/v1/user/times in gitea.dev...
GO-2026-6080 Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea
Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag in go-gitea/gitea. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-6059 Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev
Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...
GO-2026-6068 Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 in gitea.dev
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR 38145 in gitea.dev...
GO-2026-5346 Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy
Caddy: FastCGI header normalization bypass in forwardauth copyheaders in github.com/caddyserver/caddy...
GO-2026-5542 Path traversal via malicious package name in github.com/zarf-dev/zarf
A path traversal vulnerability in Zarf allows an attacker to write arbitrary files on the host system by providing a malicious package name in the package metadata. This occurs when Zarf generates SBOM or documentation outputs, or when creating a package, as it fails to properly sanitize the...
GO-2026-6043 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea...
GO-2026-6045 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 in gitea.dev
Gitea: Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118 in gitea.dev...
GO-2026-5979 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery
Anyquery: Arbitrary File Write AFW which could lead to Remote Code Execution RCE via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery...
GO-2026-5982 TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy...
GO-2026-5990 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery
Anyquery: Local File Read LFR via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...
GO-2026-6014 ZPan Uses Hard-Coded Password in github.com/saltbo/zpan
ZPan Uses Hard-Coded Password in github.com/saltbo/zpan...
GO-2026-5998 open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator
open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator...
GO-2026-5676 HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go
HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go...
GO-2026-5410 SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack
SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack...
GO-2026-5920 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder...
GO-2026-5870 MCP Toolbox for Databases vulnerable to DNS rebinding attacks in github.com/googleapis/mcp-toolbox
MCP Toolbox for Databases vulnerable to DNS rebinding attacks in github.com/googleapis/mcp-toolbox...
GO-2026-5898 Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest in github.com/casdoor/casdoor
Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest in github.com/casdoor/casdoor...
GO-2026-5915 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder...
GO-2026-5906 Coder: User-admin role can reset owner account password in github.com/coder/coder
Coder: User-admin role can reset owner account password in github.com/coder/coder...
GO-2026-5891 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico
Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2026-5873 Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet
Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml in github.com/rancher/fleet...
GO-2026-5890 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery
Kerberos Hub private key X-Kerberos-Hub-PrivateKey leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery...
GO-2026-5871 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet
Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet...
GO-2026-5833 Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github
Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github...
GO-2026-5857 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation in github.com/fission/fission...
GO-2026-5757 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio
MinIO vulnerable to Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5692 Juju: CloudSpec method leaking cloud credentials in github.com/juju/juju
Juju: CloudSpec method leaking cloud credentials in github.com/juju/juju...
GO-2026-5642 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions in github.com/free5gc/nef
free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions in github.com/free5gc/nef...
GO-2026-5739 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet
Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet...
GO-2026-5687 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification in github.com/nezhahq/nezha
Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification in github.com/nezhahq/nezha...
GO-2026-5686 klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go...
GO-2026-5656 Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli
Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go...
GO-2026-5691 File Browser has a DoS Vulnerability via Public Login API in github.com/filebrowser/filebrowser
File Browser has a DoS Vulnerability via Public Login API in github.com/filebrowser/filebrowser...
GO-2026-5545 Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs
Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-5608 Vikunja has Algorithmic Complexity DoS in Repeating Task Handler in code.vikunja.io/api
Vikunja has Algorithmic Complexity DoS in Repeating Task Handler in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5524 Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements in github.com/mattermost/focalboard
Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements in github.com/mattermost/focalboard...
GO-2026-5575 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno...
GO-2026-5600 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles in github.com/daytonaio/daytona
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles in github.com/daytonaio/daytona...
GO-2026-5559 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex in github.com/oauth2-proxy/oauth2-proxy
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skipauthroutes and skipauthregex in github.com/oauth2-proxy/oauth2-proxy...
GO-2026-5626 Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0
Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0...
GO-2026-5534 TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5457 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc...
GO-2026-5451 Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju
Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju...
GO-2026-5508 axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go
axonflow-sdk-go: Webhook signing-key HMAC-SHA256 not exposed by SDK type, preventing signature verification in github.com/getaxonflow/axonflow-sdk-go...