4692 matches found
GO-2026-6050 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents in gitea.dev
Gitea: Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents in gitea.dev...
GO-2026-5980 yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu
yutu: Arbitrary File Write via MCP caption-download Tool in github.com/eat-pray-ai/yutu...
GO-2026-5986 nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh
nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh...
GO-2026-6002 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive
ToolHive: SSRF in remote MCP server authentication discovery host-side, bypasses container isolation in github.com/stacklok/toolhive...
GO-2026-5948 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend...
GO-2026-5997 safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl
safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl...
GO-2026-5963 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet in github.com/siyuan-note/siyuan/kernel...
GO-2026-5957 SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML in github.com/siyuan-note/siyuan/kernel...
GO-2026-5984 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh...
GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...
GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5991 nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh
nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh...
GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...
GO-2026-5953 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-5975 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly...
GO-2026-5800 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.Volume,VolumeSnapshots,Pool in github.com/lxc/incus...
GO-2026-5808 Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus
Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus...
GO-2026-5869 Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher
Rancher has over-inclusive team membership expansion in GitHub App authentication provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5872 Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo
Centrifugo's dynamic JWKS key cache keyed only by kid allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo...
GO-2026-5877 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer in github.com/rancher/fleet
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated valuesFrom references in Helm Deployer in github.com/rancher/fleet...
GO-2026-5910 Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile in d7y.io/dragonfly
Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile in d7y.io/dragonfly...
GO-2026-5851 Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority
Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority...
GO-2026-5859 Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration in github.com/fission/fission
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration in github.com/fission/fission...
GO-2026-5823 Blnk has an API key authorization bypass in owner and scope enforcement in github.com/blnkfinance/blnk
Blnk has an API key authorization bypass in owner and scope enforcement in github.com/blnkfinance/blnk...
GO-2026-5066 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...
GO-2026-5771 DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk...
GO-2026-5753 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api...
GO-2026-5670 Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard
Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard...
GO-2026-5688 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms in github.com/axllent/mailpit
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms in github.com/axllent/mailpit...
GO-2026-5701 Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0
Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5601 AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers
AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5531 Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft in github.com/lin-snow/ech0
Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft in github.com/lin-snow/ech0...
GO-2026-5611 Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry
Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry...
GO-2026-5617 Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection
A race condition in the Docker daemon allows an attacker to redirect bind mounts to arbitrary host paths during a "docker cp" operation. The affected code is in the daemon package, specifically the openContainerFS method. This is daemon-owned, Linux-specific code and is not intended for external...
GO-2026-5551 ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function in heckel.io/ntfy
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function in heckel.io/ntfy...
GO-2026-5556 Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2026-5572 Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) in github.com/gotenberg/gotenberg
Gotenberg has ExifTool stdin argument injection via metadata value newlines bypass of key sanitization fix in github.com/gotenberg/gotenberg...
GO-2026-5581 Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse in github.com/ellanetworks/core
Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse in github.com/ellanetworks/core...
GO-2026-5482 free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr
free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr...
GO-2026-5454 Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server
Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server...
GO-2026-5429 SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869) in github.com/siyuan-note/siyuan/kernel
SiYuan: Path Traversal via Double URL Encoding in /export/ Endpoint Incomplete Fix Bypass for CVE-2026-30869 in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If th...
GO-2026-5412 Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef
free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...
GO-2026-5475 containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd
containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd...
GO-2026-5502 Ella Core has handover failures during concurrent Security Mode Command in github.com/ellanetworks/core
Ella Core has handover failures during concurrent Security Mode Command in github.com/ellanetworks/core...
GO-2026-5438 Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor
Velociraptor vulnerability in the query plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor...
GO-2026-5318 SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark in github.com/siyuan-note/siyuan/kernel
SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5243 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea...
GO-2026-5217 Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer
Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...