4692 matches found
GO-2026-4546 FileBrowser Quantum: Password Protection Not Enforced on Shared File Links in github.com/gtsteffaniak/filebrowser/backend
FileBrowser Quantum: Password Protection Not Enforced on Shared File Links in github.com/gtsteffaniak/filebrowser/backend...
GO-2026-4500 Unauthenticated File Upload in Gogs in gogs.io/gogs
Unauthenticated File Upload in Gogs in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2026-4476 Mattermost Server password reset email requests can be sent to attacker-provided email addresses in github.com/mattermost/mattermost-server
Mattermost Server password reset email requests can be sent to attacker-provided email addresses in github.com/mattermost/mattermost-server...
GO-2026-4404 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS) in github.com/stefanprodan/podinfo
Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting XSS in github.com/stefanprodan/podinfo...
GO-2026-4396 OpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList
OpenList vulnerable to Path Traversal in file copy and remove handlers in github.com/OpenListTeam/OpenList...
GO-2026-4348 Client DoS via malformed server response in github.com/theupdateframework/go-tuf
Client DoS via malformed server response in github.com/theupdateframework/go-tuf...
GO-2026-4297 Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server
Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server...
GO-2025-4191 Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server
Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-4231 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality in github.com/1Panel-dev/1Panel
1Panel contains a cross-site request forgery CSRF vulnerability in the web port configuration functionality in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4179 Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway...
GO-2025-4097 Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc
Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc...
GO-2025-4130 Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server
Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server...
GO-2025-4083 Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel
Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2025-4047 Mattermost Server: initial_load API exposes unnecessary information in github.com/mattermost/mattermost-server
Mattermost Server: initialload API exposes unnecessary information in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-3984 Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher
Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-3773 Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg
Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg...
GO-2025-3650 Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake
Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake...
GO-2025-3625 cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps
cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps...
GO-2025-3526 Index out-of-range panic in github.com/onosproject/onos-lib-go
Index out-of-range panic in github.com/onosproject/onos-lib-go...
GO-2025-3530 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Bare Metal Operator BMO can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis...
GO-2025-3511 Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify
Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify...
GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome
Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...
GO-2025-3451 Vulnerability in github.com/boltdb-go/bolt
This module is a malicious typosquat, attempting to take advantage of confusion with the github.com/boltdb/bolt module...
GO-2025-3436 Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum
Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2024-3334 Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server
Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server...
GO-2024-3295 Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh
Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh...
GO-2024-3208 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium...
GO-2024-3083 Openshift Console insufficient entropy vulnerability in github.com/openshift/console
Openshift Console insufficient entropy vulnerability in github.com/openshift/console...
GO-2022-0989 Dendrite signature checks not applied to some retrieved missing events in github.com/matrix-org/dendrite
Dendrite signature checks not applied to some retrieved missing events in github.com/matrix-org/dendrite...
GO-2022-0987 Gophish before 0.12.0 vulnerable to Open Redirect in github.com/gophish/gophish
Gophish before 0.12.0 vulnerable to Open Redirect in github.com/gophish/gophish...
GO-2022-0936 Improperly Implemented path matching for in-toto-golang in github.com/in-toto/in-toto-golang
Improperly Implemented path matching for in-toto-golang in github.com/in-toto/in-toto-golang...
GO-2022-0887 Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap
Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap...
GO-2022-0644 Access Control Bypass in github.com/rancher/rancher
Access Control Bypass in github.com/rancher/rancher...
GO-2022-0770 Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad
Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0630 Arbitrary Code Execution in Docker in github.com/docker/docker
Arbitrary Code Execution in Docker in github.com/docker/docker...
GO-2022-0640 Arbitrary Code Execution in github.com/docker/docker
Arbitrary Code Execution in github.com/docker/docker...
GO-2022-0606 Command Injection in CasaOS in github.com/IceWhaleTech/CasaOS
Command Injection in CasaOS in github.com/IceWhaleTech/CasaOS...
GO-2022-0482 containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd
containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd...
GO-2022-0418 Opened exploitable ports in default docker-compose.yaml in go-ipfs in github.com/ipfs/go-ipfs
Opened exploitable ports in default docker-compose.yaml in go-ipfs in github.com/ipfs/go-ipfs...
GO-2022-0249 Infinite certificate chain depth results in OctoRPKI running forever in github.com/cloudflare/cfrpki
Infinite certificate chain depth results in OctoRPKI running forever in github.com/cloudflare/cfrpki...
GO-2023-2088 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault...
GO-2023-1972 Gogs XSS Vulnerability in gogs.io/gogs
Gogs XSS Vulnerability in gogs.io/gogs...
GO-2023-1915 containernetworking/plugins vulnerable to MitM attacks in github.com/containernetworking/plugins
containernetworking/plugins vulnerable to MitM attacks in github.com/containernetworking/plugins...
GO-2023-1939 Mattermost Server Sensitive Data Exposure in github.com/mattermost/mattermost
Mattermost Server Sensitive Data Exposure in github.com/mattermost/mattermost...
GO-2023-1887 1Panel vulnerable to command injection when adding container repositories in github.com/1Panel-dev/1Panel
1Panel vulnerable to command injection when adding container repositories in github.com/1Panel-dev/1Panel...
GO-2023-1804 Kyverno vulnerable due to usage of insecure cipher in github.com/kyverno/kyverno
Kyverno vulnerable due to usage of insecure cipher in github.com/kyverno/kyverno...
GO-2023-1551 Answer subject to Cross-site Scripting vulnerability in github.com/answerdev/answer
Answer subject to Cross-site Scripting vulnerability in github.com/answerdev/answer...
GO-2024-3039 Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean
Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean...
GO-2024-2999 Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker
Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker...