4692 matches found
GO-2026-4795 Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api
Vikunja read-only users can delete project background images via broken object-level authorization in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2026-4556 Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api
Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api...
GO-2026-4561 Fleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet
Fleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet...
GO-2026-4563 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet...
GO-2026-4502 Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5
Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5...
GO-2026-4546 FileBrowser Quantum: Password Protection Not Enforced on Shared File Links in github.com/gtsteffaniak/filebrowser/backend
FileBrowser Quantum: Password Protection Not Enforced on Shared File Links in github.com/gtsteffaniak/filebrowser/backend...
GO-2026-4498 Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs
Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-4500 Unauthenticated File Upload in Gogs in gogs.io/gogs
Unauthenticated File Upload in Gogs in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2026-4423 ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx in k8s.io/ingress-nginx
ingress-nginx's nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-4396 OpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList
OpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList...
GO-2026-4348 Client DoS via malformed server response in github.com/theupdateframework/go-tuf
Client DoS via malformed server response in github.com/theupdateframework/go-tuf...
GO-2026-4297 Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server
Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server...
GO-2025-4191 Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server
Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-4231 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality in github.com/1Panel-dev/1Panel
1Panel contains a cross-site request forgery CSRF vulnerability in the web port configuration functionality in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4179 Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway...
GO-2025-4097 Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc
Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc...
GO-2025-4130 Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server
Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server...
GO-2025-4083 Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel
Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2025-4047 Mattermost Server: initial_load API exposes unnecessary information in github.com/mattermost/mattermost-server
Mattermost Server: initialload API exposes unnecessary information in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-3979 Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni
Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni...
GO-2025-3984 Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher
Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-3773 Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg
Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg...
GO-2025-3650 Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake
Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake...
GO-2025-3625 cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps
cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps...
GO-2025-3526 Index out-of-range panic in github.com/onosproject/onos-lib-go
Index out-of-range panic in github.com/onosproject/onos-lib-go...
GO-2025-3530 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Bare Metal Operator BMO can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis...
GO-2025-3509 Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server
Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server...
GO-2025-3504 Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway
Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway...
GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome
Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...
GO-2025-3451 Vulnerability in github.com/boltdb-go/bolt
This module is a malicious typosquat, attempting to take advantage of confusion with the github.com/boltdb/bolt module...
GO-2025-3436 Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum
Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2025-3382 notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go
notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go...
GO-2024-3334 Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server
Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server...
GO-2024-3287 Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer
Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer...
GO-2024-3239 NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability in github.com/NVIDIA/nvidia-container-toolkit
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use TOCTOU vulnerability in github.com/NVIDIA/nvidia-container-toolkit...
GO-2024-3208 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium...
GO-2024-3116 sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go...
GO-2024-3083 Openshift Console insufficient entropy vulnerability in github.com/openshift/console
Openshift Console insufficient entropy vulnerability in github.com/openshift/console...
GO-2022-1033 Dapr Dashboard vulnerable to Incorrect Access Control in github.com/dapr/dashboard
Dapr Dashboard vulnerable to Incorrect Access Control in github.com/dapr/dashboard...
GO-2022-0987 Gophish before 0.12.0 vulnerable to Open Redirect in github.com/gophish/gophish
Gophish before 0.12.0 vulnerable to Open Redirect in github.com/gophish/gophish...
GO-2022-0989 Dendrite signature checks not applied to some retrieved missing events in github.com/matrix-org/dendrite
Dendrite signature checks not applied to some retrieved missing events in github.com/matrix-org/dendrite...
GO-2022-0995 Talos worker join token can be used to get elevated access level to the Talos API in github.com/talos-systems/talos
Talos worker join token can be used to get elevated access level to the Talos API in github.com/talos-systems/talos...
GO-2022-0936 Improperly Implemented path matching for in-toto-golang in github.com/in-toto/in-toto-golang
Improperly Implemented path matching for in-toto-golang in github.com/in-toto/in-toto-golang...
GO-2022-0861 Denial of Service (DoS) in HashiCorp Consul in github.com/hashicorp/consul
Denial of Service DoS in HashiCorp Consul in github.com/hashicorp/consul...
GO-2022-0802 Kubernetes kubectl cp Vulnerable to Symlink Attack in k8s.io/kubernetes
Kubernetes kubectl cp Vulnerable to Symlink Attack in k8s.io/kubernetes...
GO-2022-0797 Insecure Permissions in Gogs in gogs.io/gogs
Insecure Permissions in Gogs in gogs.io/gogs...
GO-2022-0700 Kiali Authentication Bypass vulnerability in github.com/kiali/kiali
Kiali Authentication Bypass vulnerability in github.com/kiali/kiali...
GO-2022-0644 Access Control Bypass in github.com/rancher/rancher
Access Control Bypass in github.com/rancher/rancher...