4692 matches found
GO-2025-3678 Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring
Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring...
GO-2025-3652 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno...
GO-2025-3632 GoBGP crashes in the flowspec parser in github.com/osrg/gobgp
GoBGP crashes in the flowspec parser in github.com/osrg/gobgp...
GO-2025-3635 In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium...
GO-2025-3604 Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Proper Access Controls on /api/v4/audits Endpoint in github.com/mattermost/mattermost-server...
GO-2025-3618 Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams
Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3582 Ollama Denial of Service (DoS) via Null Pointer Dereference in github.com/ollama/ollama
Ollama Denial of Service DoS via Null Pointer Dereference in github.com/ollama/ollama...
GO-2025-3559 Ollama Divide By Zero vulnerability in github.com/ollama/ollama
Ollama Divide By Zero vulnerability in github.com/ollama/ollama...
GO-2025-3534 Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server
Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server...
GO-2025-3536 OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive
OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive...
GO-2025-3514 cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node
cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2025-3456 WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core
WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core...
GO-2025-3442 CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft
CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft...
GO-2025-3437 Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine
Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3413 HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug
HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug...
GO-2024-3344 Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age
Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age...
GO-2024-3343 Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm
Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm...
GO-2024-3335 Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary
Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary...
GO-2024-3279 Mismatched bit-length validation in can lead to panic in cosmossdk.io/math
Mismatched bit-length validation in can lead to panic in cosmossdk.io/math...
GO-2024-3277 Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes...
GO-2022-0983 ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
ANSI escape characters not filtered in kubectl in k8s.io/kubernetes...
GO-2022-0933 Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium...
GO-2022-0910 Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes
Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes...
GO-2022-0914 Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc
Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc...
GO-2022-0799 Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver
Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver...
GO-2022-0821 Improper Certificate Validation in HashiCorp Nomad in github.com/hashicorp/nomad
Improper Certificate Validation in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0815 Improper input validation in umoci in github.com/opencontainers/umoci
Improper input validation in umoci in github.com/opencontainers/umoci...
GO-2022-0776 Denial of Service (DoS) in HashiCorp Consul in github.com/hashicorp/consul
Denial of Service DoS in HashiCorp Consul in github.com/hashicorp/consul...
GO-2022-0790 Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy in github.com/oauth2-proxy/oauth2-proxy
Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy in github.com/oauth2-proxy/oauth2-proxy...
GO-2022-0752 Privilege Escalation in Docker in github.com/docker/docker
Privilege Escalation in Docker in github.com/docker/docker...
GO-2022-0708 Arbitrary File Override in Docker Engine in github.com/docker/docker
Arbitrary File Override in Docker Engine in github.com/docker/docker...
GO-2022-0760 Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos
Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos...
GO-2022-0631 Hard coded cryptographic key in Kiali in github.com/kiali/kiali
Hard coded cryptographic key in Kiali in github.com/kiali/kiali...
GO-2022-0496 Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki
Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki...
GO-2022-0442 Arbitrary file deletion in gitea in code.gitea.io/gitea
Arbitrary file deletion in gitea in code.gitea.io/gitea...
GO-2022-0231 Cross-site Scripting in github.com/schollz/rwtxt
Cross-site Scripting in github.com/schollz/rwtxt...
GO-2022-0309 Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea
Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea...
GO-2023-2080 Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium...
GO-2023-2063 HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault
HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault...
GO-2023-1965 Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer
Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer...
GO-2023-1888 1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel
1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel...
GO-2023-1901 Pipelines do not validate child UIDs in github.com/tektoncd/pipeline
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline...
GO-2023-1808 Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells
Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells...
GO-2023-1719 Answer vulnerable to account takeover because password reset links do not expire in github.com/answerdev/answer
Answer vulnerable to account takeover because password reset links do not expire in github.com/answerdev/answer...
GO-2023-1671 Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process in tailscale.com
Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process in tailscale.com...
GO-2023-1612 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1550 Answer contains Improper Access Control vulnerability in github.com/answerdev/answer
Answer contains Improper Access Control vulnerability in github.com/answerdev/answer...
GO-2024-3038 In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient
In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient...
GO-2024-2970 Gogs allows deletion of internal files in github.com/gogs/gogs
Gogs allows deletion of internal files in github.com/gogs/gogs...
GO-2024-2550 MongoDB Tools Improper Certificate Validation vulnerability in github.com/mongodb/mongo-tools
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates. NOTE: this module uses its own versioning scheme that is not fully...