4692 matches found
GO-2024-3308 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) in github.com/kolide/launcher
Kolide Agent Privilege Escalation Windows, Versions = 1.5.3, 1.12.3 in github.com/kolide/launcher...
GO-2024-3291 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs...
GO-2024-3189 Consensus failure in github.com/btcsuite/btcd
The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split accepting an invalid block or Denial of Service DoS attacks rejecting a valid block...
GO-2024-3185 XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready
XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready...
GO-2024-3166 Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf
Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf...
GO-2022-0890 Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes
Server Side Request Forgery SSRF in Kubernetes in k8s.io/kubernetes...
GO-2022-0908 Incomplete List of Disallowed Inputs in Kubernetes in k8s.io/kubernetes
Incomplete List of Disallowed Inputs in Kubernetes in k8s.io/kubernetes...
GO-2022-0869 Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd...
GO-2022-0833 Denial of Service in docker2aci in github.com/appc/docker2aci
Denial of Service in docker2aci in github.com/appc/docker2aci...
GO-2022-0705 Directory Traversal in Docker in github.com/docker/docker
Directory Traversal in Docker in github.com/docker/docker...
GO-2022-0625 Access Restriction Bypass in Docker in github.com/docker/docker
Access Restriction Bypass in Docker in github.com/docker/docker...
GO-2022-0591 Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad
Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad...
GO-2022-0556 OS Command Injection in file editor in Gogs in gogs.io/gogs
OS Command Injection in file editor in Gogs in gogs.io/gogs...
GO-2022-0562 Path Traversal in Git HTTP endpoints in Gogs in gogs.io/gogs
Path Traversal in Git HTTP endpoints in Gogs in gogs.io/gogs...
GO-2023-2330 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...
GO-2023-2072 Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc
Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc...
GO-2023-2069 Croc may expose secret to local users in github.com/schollz/croc
Croc may expose secret to local users in github.com/schollz/croc...
GO-2023-1979 Denial of service from large image in github.com/crossplane/crossplane
Denial of service from large image in github.com/crossplane/crossplane...
GO-2023-1644 Cilium eBPF filters may be temporarily removed during agent restart in github.com/cilium/cilium
Cilium eBPF filters may be temporarily removed during agent restart in github.com/cilium/cilium...
GO-2023-1622 Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation
Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation...
GO-2024-3033 Filestash configured to skip TLS certificate verification when using the FTPS protocol in github.com/mickael-kerjean/filestash
Filestash configured to skip TLS certificate verification when using the FTPS protocol in github.com/mickael-kerjean/filestash...
GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd
The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd...
GO-2024-2528 Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd
Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd...
GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2755 Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes
Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes...
GO-2024-2856 Grafana Race condition allowing privilege escalation in github.com/grafana/grafana
Grafana Race condition allowing privilege escalation in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-2703 Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia...
GO-2024-2572 Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk
Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk...
GO-2024-2694 Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go
Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go...
GO-2024-2660 Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl
Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack...
GO-2023-1535 Panic during unmarshal of Server Hello in github.com/pion/dtls/v2
Unmarshalling a Server Hello can panic, which could allow a denial of service...
GO-2022-0503 Denial of service via malformed CAR data in github.com/ipld/go-car and go-car/v2
Decoding malformed CAR data can cause panics or excessive memory usage...
GO-2022-0563 Cross-site request forgery in github.com/filebrowser/filebrowser/v2
A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...
GO-2026-6609 Lack of limit on size of parsed Range headers in net/http
When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...
GO-2026-6613 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
GO-2026-6620 fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf...
GO-2026-6559 SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo
SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo...
GO-2026-6555 Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth
Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth...
GO-2026-6554 OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao
OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...
GO-2026-6480 Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler in github.com/mattermost/mattermost-server
Mattermost doesn't enforce administrator authorization on the setDefaultInstance call within the /gitlab connect command handler in github.com/mattermost/mattermost-server...
GO-2026-6526 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive...
GO-2026-6487 emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core
emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core...
GO-2026-6514 Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses...
GO-2026-6541 Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana
Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik
Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik...
GO-2026-6435 Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore
Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore...
GO-2026-6357 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo...
GO-2026-6371 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore...
GO-2026-6379 SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered in github.com/siyuan-note/siyuan/kernel
SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc publish mode: reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered in github.com/siyuan-note/siyuan/kernel...
GO-2026-6428 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation in github.com/openchoreo/openchoreo...