4692 matches found
GO-2026-4354 Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor
Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message in github.com/sigstore/rekor...
GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea...
GO-2026-4304 CVE-2017-18901 in github.com/mattermost/mattermost-server
CVE-2017-18901 in github.com/mattermost/mattermost-server...
GO-2026-4302 Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server...
GO-2026-4303 Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server...
GO-2026-4281 Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer
Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer...
GO-2026-4285 Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno
Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno...
GO-2026-4292 WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora
WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora...
GO-2025-4241 Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access in github.com/RedHatInsights/runtimes-inventory-operator
Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access in github.com/RedHatInsights/runtimes-inventory-operator...
GO-2025-4239 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go...
GO-2025-4237 Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate
Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate...
GO-2025-4229 1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality in github.com/1Panel-dev/1Panel
1Panel contains a cross-site request forgery CSRF vulnerability in the Change Username functionality in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-4213 ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in github.com/zitadel/zitadel
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-4211 Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in github.com/babylonlabs-io/babylon
Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in github.com/babylonlabs-io/babylon...
GO-2025-4201 Mattermost Server is vulnerable to webhook and slash command manipulation in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to webhook and slash command manipulation in github.com/mattermost/mattermost-server...
GO-2025-4209 1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel
1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel...
GO-2025-4180 Step CA Has Authorization Bypass in ACME and SCEP Provisioners in github.com/smallstep/certificates
Step CA Has Authorization Bypass in ACME and SCEP Provisioners in github.com/smallstep/certificates...
GO-2025-4186 Mattermost Server does not prevent System Admin from arbitrary file creation in github.com/mattermost/mattermost-server
Mattermost Server does not prevent System Admin from arbitrary file creation in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-4178 Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost
Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost...
GO-2025-4190 Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server...
GO-2025-4184 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to Denial of Service through @ character prefix inserted into JavaScript field names in github.com/mattermost/mattermost-server...
GO-2025-4182 Coder logs sensitive objects unsanitized in github.com/coder/coder
Coder logs sensitive objects unsanitized in github.com/coder/coder...
GO-2025-4152 Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault
Vault’s Terraform Provider incorrectly set default denynullbind parameter for LDAP auth method to false by default in github.com/hashicorp/terraform-provider-vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2025-4133 Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server
Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4131 Mattermost allows regular users to access archived channel content and files in github.com/mattermost/mattermost-server
Mattermost allows regular users to access archived channel content and files in github.com/mattermost/mattermost-server...
GO-2025-4122 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost...
GO-2025-4101 OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu...
GO-2025-4112 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves in github.com/evervault/evervault-go
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves in github.com/evervault/evervault-go...
GO-2025-4086 Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode in github.com/TecharoHQ/anubis
Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode in github.com/TecharoHQ/anubis...
GO-2025-4084 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-4074 Rancher exposes sensitive information through audit logs in github.com/rancher/rancher
Rancher exposes sensitive information through audit logs in github.com/rancher/rancher...
GO-2025-4064 Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server...
GO-2025-4066 Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server
Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server...
GO-2025-4028 go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents in github.com/in-toto/go-witness
go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents in github.com/in-toto/go-witness...
GO-2025-4060 Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server
Mattermost Server allows System Admin to modify LDAP account names and email addresses in github.com/mattermost/mattermost-server...
GO-2025-4058 Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through lack of link relationship attributes noreferrer and noopener in github.com/mattermost/mattermost-server...
GO-2025-4067 OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3981 Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws...
GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd...
GO-2025-3990 go-f3 module vulnerable to integer overflow leading to panic in github.com/filecoin-project/go-f3
go-f3 module vulnerable to integer overflow leading to panic in github.com/filecoin-project/go-f3...
GO-2025-3976 Grafana-Zabbix ReDoS vulnerability in github.com/alexanderzobnin/grafana-zabbix
Grafana-Zabbix ReDoS vulnerability in github.com/alexanderzobnin/grafana-zabbix. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3927 Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet...
GO-2025-3905 Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server
Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server...
GO-2025-3902 Mattermost Fails to Properly Validate Team Role Modification in github.com/mattermost/mattermost-server
Mattermost Fails to Properly Validate Team Role Modification in github.com/mattermost/mattermost-server...
GO-2025-3873 Komari vulnerable to 2FA Authentication Bypass in github.com/komari-monitor/komari
Komari vulnerable to 2FA Authentication Bypass in github.com/komari-monitor/komari...
GO-2025-3847 Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego
Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego...
GO-2025-3844 RatPanel can perform remote command execution without authorization in github.com/tnborg/panel in github.com/TheTNB/panel
RatPanel can perform remote command execution without authorization in github.com/tnborg/panel in github.com/TheTNB/panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2025-3754 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl...
GO-2025-3756 Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server
Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server...
GO-2025-3749 Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...