4692 matches found
GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef
free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...
GO-2026-5470 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr...
GO-2026-5437 MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio...
GO-2026-5472 Source controller: Improper path handling allows traversal in github.com/fluxcd/source-controller
Source controller: Improper path handling allows traversal in github.com/fluxcd/source-controller...
GO-2026-5384 Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus
Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus...
GO-2026-5403 Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos
Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos...
GO-2026-5404 Mattermost doesn't check if {{team_id}} was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks
Mattermost doesn't check if teamid was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks...
GO-2026-5493 Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal in github.com/tomwright/dasel
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal in github.com/tomwright/dasel...
GO-2026-5407 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr...
GO-2026-5382 Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass in github.com/lin-snow/ech0
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5394 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs PUT Upload in github.com/patrickhener/goshs...
GO-2026-5325 Mattermost doesn't validate 7zip archive structure before processing in github.com/mattermost/mattermost-server
Mattermost doesn't validate 7zip archive structure before processing in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5288 Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled in github.com/apernet/hysteria/core
Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled in github.com/apernet/hysteria/core...
GO-2026-5295 Note Mark has Stored XSS via Unrestricted Asset Upload in github.com/enchant97/note-mark/backend
Note Mark has Stored XSS via Unrestricted Asset Upload in github.com/enchant97/note-mark/backend...
GO-2026-5322 OpenFGA Improper Policy Enforcement in github.com/openfga/openfga
OpenFGA Improper Policy Enforcement in github.com/openfga/openfga...
GO-2026-5189 Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI in github.com/free5gc/pcf
Free5GC PCF: Missing authentication middleware in NpcfSMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI in github.com/free5gc/pcf...
GO-2026-5187 PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw
PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw...
GO-2026-5197 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers in github.com/zitadel/zitadel
ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers in github.com/zitadel/zitadel...
GO-2026-5184 Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs
Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-5185 Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
Distribution's tag deletion bypasses storage.delete.enabled configuration in github.com/distribution/distribution...
GO-2026-5224 Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go...
GO-2026-5250 File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection in github.com/filebrowser/filebrowser
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection in github.com/filebrowser/filebrowser...
GO-2026-5227 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI
Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI...
GO-2026-5225 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5078 Velocidex Velociraptor has an authorization bypass vulnerability in www.velocidex.com/golang/velociraptor
Velocidex Velociraptor has an authorization bypass vulnerability in www.velocidex.com/golang/velociraptor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5124 Gogs has DoS in rendering issue index pattern in gogs.io/gogs
Gogs has DoS in rendering issue index pattern in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edi...
GO-2026-5133 SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb
SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb...
GO-2026-5123 Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export in github.com/lin-snow/ech0
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-5112 Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server
Mattermost doesn't set permissions on downloaded bulk export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5117 IPAM controller service account granted unnecessary full access to Secrets in github.com/metal3-io/ip-address-manager
IPAM controller service account granted unnecessary full access to Secrets in github.com/metal3-io/ip-address-manager...
GO-2026-5150 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser...
GO-2026-5167 File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser
File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser...
GO-2026-5028 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
GO-2026-4981 Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...
GO-2026-4871 Code execution vulnerability in SWIG code generation in cmd/go
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...
GO-2026-4905 Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) in github.com/gotenberg/gotenberg
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme bypass of GHSA-rh2x-ccvw-q7r3 in github.com/gotenberg/gotenberg...
GO-2026-4891 act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act
act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act...
GO-2026-4907 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI...
GO-2026-4883 Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker...
GO-2026-4890 act: actions/cache server allows malicious cache injection in github.com/nektos/act
act: actions/cache server allows malicious cache injection in github.com/nektos/act...
GO-2026-4862 OpenBao has Reflected XSS in its OIDC authentication error message in github.com/openbao/openbao
OpenBao has Reflected XSS in its OIDC authentication error message in github.com/openbao/openbao...
GO-2026-4843 SiYuan has directory traversal within its publishing service in github.com/siyuan-note/siyuan/kernel
SiYuan has directory traversal within its publishing service in github.com/siyuan-note/siyuan/kernel...
GO-2026-4848 Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api
Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-4835 NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing in github.com/nats-io/nats-server...
GO-2026-4850 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4823 PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pinchtab
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution in github.com/pinchtab/pinchtab...
GO-2026-4723 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports in github.com/bishopfox/sliver
Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports in github.com/bishopfox/sliver...
GO-2026-4710 File Browser Signup Grants Admin When Default Permissions Include Admin in github.com/filebrowser/filebrowser
File Browser Signup Grants Admin When Default Permissions Include Admin in github.com/filebrowser/filebrowser...