4692 matches found
GO-2026-4515 Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints in github.com/akuity/kargo
Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints in github.com/akuity/kargo...
GO-2026-4464 Mattermost Server has X.509 Improper Certificate Validation in github.com/mattermost/mattermost-server
Mattermost Server has X.509 Improper Certificate Validation in github.com/mattermost/mattermost-server...
GO-2026-4480 Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api
Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api...
GO-2026-4362 Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea
Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea...
GO-2026-4313 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in github.com/flipped-aurora/gin-vue-admin
Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in github.com/flipped-aurora/gin-vue-admin...
GO-2026-4314 High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum
High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2026-4295 Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server...
GO-2026-4299 Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint in github.com/mattermost/mattermost-server
Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint in github.com/mattermost/mattermost-server...
GO-2025-4242 OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator
OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator...
GO-2025-4243 Libredesk has Improper Neutralization of HTML Tags in a Web Page in github.com/abhinavxd/libredesk
Libredesk has Improper Neutralization of HTML Tags in a Web Page in github.com/abhinavxd/libredesk...
GO-2025-4228 Algernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon
Algernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon...
GO-2025-4199 Mattermost Server exposes team creator's e-mail address to other members in github.com/mattermost/mattermost-server
Mattermost Server exposes team creator's e-mail address to other members in github.com/mattermost/mattermost-server...
GO-2025-4098 Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc
Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc...
GO-2025-4129 Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server
Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server...
GO-2025-4090 lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs
lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs...
GO-2025-4111 Soft Serve is vulnerable to SSRF through its Webhooks in github.com/charmbracelet/soft-serve
Soft Serve is vulnerable to SSRF through its Webhooks in github.com/charmbracelet/soft-serve...
GO-2025-4088 sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls
sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls...
GO-2025-4079 Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver
Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver...
GO-2025-4063 Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server
Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server...
GO-2025-4030 Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-4065 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server...
GO-2025-4077 Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations in github.com/docker/compose
Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations in github.com/docker/compose...
GO-2025-3974 DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly
DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly...
GO-2025-3901 Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server
Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3786 filebrowser Allows Shell Commands to Spawn Other Commands in github.com/filebrowser/filebrowser
filebrowser Allows Shell Commands to Spawn Other Commands in github.com/filebrowser/filebrowser...
GO-2025-3570 SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver
SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver...
GO-2025-3717 ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse in github.com/arkmq-org/activemq-artemis-operator
ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse in github.com/arkmq-org/activemq-artemis-operator...
GO-2025-3657 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3647 Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher
Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3633 GoBGP does not verify that the input length in github.com/osrg/gobgp
GoBGP does not verify that the input length in github.com/osrg/gobgp...
GO-2025-3608 Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events...
GO-2025-3558 Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama
Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama...
GO-2025-3556 Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server...
GO-2025-3498 Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus
Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus...
GO-2025-3470 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3459 Remote code execution in Wazuh server in github.com/wazuh/wazuh
Remote code execution in Wazuh server in github.com/wazuh/wazuh...
GO-2025-3426 CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o...
GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs...
GO-2025-3399 Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation in github.com/t2bot/matrix-media-repo
Matrix Media Repo MMR allows Server-Side Request Forgery SSRF on redirects and federation in github.com/t2bot/matrix-media-repo...
GO-2025-3391 Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher
Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3311 NULL Pointer Dereference on moby image history in github.com/moby/moby
NULL Pointer Dereference on moby image history in github.com/moby/moby...
GO-2024-3310 Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli...
GO-2024-3308 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) in github.com/kolide/launcher
Kolide Agent Privilege Escalation Windows, Versions = 1.5.3, 1.12.3 in github.com/kolide/launcher...
GO-2024-3291 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs...
GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...
GO-2024-3189 Consensus failure in github.com/btcsuite/btcd
The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split accepting an invalid block or Denial of Service DoS attacks rejecting a valid block...
GO-2024-3185 XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready
XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready...
GO-2024-3166 Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf
Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf...