4692 matches found
GO-2026-6013 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-6026 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) in github.com/filebrowser/filebrowser
File Browser: Archive builder turns backslash filenames into path traversal zip-slip in github.com/filebrowser/filebrowser...
GO-2026-6016 oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen...
GO-2026-5930 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api...
GO-2026-6012 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5977 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly...
GO-2026-5761 Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc
Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc...
GO-2026-5814 Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings...
GO-2026-5837 DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph
The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language DQL injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to brea...
GO-2026-5778 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor...
GO-2026-5816 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) in github.com/juev/nebula-mesh
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks read, block, delete in github.com/juev/nebula-mesh...
GO-2026-5853 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio...
GO-2026-5842 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...
GO-2026-5827 gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host in go.senan.xyz/gonic
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host in go.senan.xyz/gonic...
GO-2026-5828 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key in github.com/nezhahq/nezha
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwtsecretkey in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-5721 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes in code.gitea.io/gitea
Gitea: Public-only tokens bypass private-resource restrictions on /api/v1/user self routes in code.gitea.io/gitea...
GO-2026-5715 Singularity: Incorrect path matching for 'limit container paths' directive in github.com/sylabs/singularity
Singularity: Incorrect path matching for 'limit container paths' directive in github.com/sylabs/singularity...
GO-2026-5727 Mattermost doesn't prevent disclosure of created user password in github.com/mattermost/mattermost-server
Mattermost doesn't prevent disclosure of created user password in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5733 Nginx-UI: Disabled users retain full API access through previously issued bearer tokens in github.com/0xJacky/Nginx-UI
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens in github.com/0xJacky/Nginx-UI...
GO-2026-5659 File Browser share links remain accessible after Share/Download permissions are revoked in github.com/filebrowser/filebrowser
File Browser share links remain accessible after Share/Download permissions are revoked in github.com/filebrowser/filebrowser...
GO-2026-5633 Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update in github.com/portainer/portainer
Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5654 In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation in github.com/monetr/monetr
In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation in github.com/monetr/monetr...
GO-2026-5512 Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope in github.com/mattermost/mattermost-server
Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope in github.com/mattermost/mattermost-server...
GO-2026-5558 OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu...
GO-2026-5628 Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go
Klever-Go KVM: Unauthenticated remote node crash nil-pointer DoS in klever-go P2P transaction interceptor txVersionChecker nil RawData - potential chain halt in github.com/klever-io/klever-go...
GO-2026-5520 Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet...
GO-2026-5621 Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno...
GO-2026-5625 goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs...
GO-2026-5627 Gotenberg has a Server-Side Request Forgery (SSRF) Issue in github.com/gotenberg/gotenberg
Gotenberg has a Server-Side Request Forgery SSRF Issue in github.com/gotenberg/gotenberg...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
GO-2026-5420 kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution in github.com/platform-mesh/kubernetes-graphql-gateway
kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution in github.com/platform-mesh/kubernetes-graphql-gateway...
GO-2026-5430 Authelia Missing Username Canonicalization in Basic Auth (LDAP) in github.com/authelia/authelia
Authelia Missing Username Canonicalization in Basic Auth LDAP in github.com/authelia/authelia...
GO-2026-5439 Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members in github.com/nezhahq/nezha
Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members in github.com/nezhahq/nezha...
GO-2026-5459 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery
Anyquery has Path Traversal through clearplugincache, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5453 ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace in github.com/shellhub-io/shellhub
ShellHub has cross-tenant IDOR in GET /api/devices/:uid that discloses device data of any namespace in github.com/shellhub-io/shellhub...
GO-2026-5401 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon...
GO-2026-5436 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave...
GO-2026-5291 nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node
nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node...
GO-2026-5311 Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server
Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server...
GO-2026-5332 Grafana has a Cross-site Scripting issue in github.com/grafana/grafana
Grafana has a Cross-site Scripting issue in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugge...
GO-2026-5379 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go...
GO-2026-5364 Oxia has an OIDC token audience validation bypass via SkipClientIDCheck in github.com/oxia-db/oxia
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck in github.com/oxia-db/oxia...
GO-2026-5223 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml in github.com/juev/nebula-mesh
nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml in github.com/juev/nebula-mesh...
GO-2026-5265 OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages in go.opentelemetry.io/obi...
GO-2026-5201 SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated) in github.com/siyuan-note/siyuan/kernel
SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG getDynamicIcon, unauthenticated in github.com/siyuan-note/siyuan/kernel...
GO-2026-5249 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner
Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...
GO-2026-5207 Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
Fleet: Helm impersonation bypass of RESTClientGetter retains cluster-admin during template rendering in github.com/rancher/fleet...
GO-2026-5179 AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf
AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5165 Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain in github.com/mezo-org/mezod
Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain in github.com/mezo-org/mezod. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...