GO-2022-0914 Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc...

GO-2022-0859 Improper Input Validation in HashiCorp Consul in github.com/hashicorp/consul

Improper Input Validation in HashiCorp Consul in github.com/hashicorp/consul...

GO-2022-0886 Kubernetes Arbitrary Command Injection in k8s.io/kubernetes

Kubernetes Arbitrary Command Injection in k8s.io/kubernetes...

GO-2022-0885 Improper Authentication in Kubernetes in k8s.io/kubernetes

Improper Authentication in Kubernetes in k8s.io/kubernetes...

GO-2022-0854 Authorization bypass in Openshift in github.com/openshift/origin

Authorization bypass in Openshift in github.com/openshift/origin...

GO-2022-0839 Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform

Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform...

GO-2022-0829 Cronos vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos

Cronos vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos...

GO-2022-0821 Improper Certificate Validation in HashiCorp Nomad in github.com/hashicorp/nomad

Improper Certificate Validation in HashiCorp Nomad in github.com/hashicorp/nomad...

GO-2022-0824 Improper Input Validation in vault-ssh-helper in github.com/hashicorp/vault-ssh-helper

Improper Input Validation in vault-ssh-helper in github.com/hashicorp/vault-ssh-helper...

GO-2022-0823 Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea

Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea...

GO-2022-0776 Denial of Service (DoS) in HashiCorp Consul in github.com/hashicorp/consul

Denial of Service DoS in HashiCorp Consul in github.com/hashicorp/consul...

GO-2022-0609 Gitea Missing Authorization vulnerability in code.gitea.io/gitea

Gitea Missing Authorization vulnerability in code.gitea.io/gitea...

GO-2022-0580 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki in github.com/cloudflare/cfrpki

Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki in github.com/cloudflare/cfrpki...

GO-2022-0577 HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling in github.com/hashicorp/nomad

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling in github.com/hashicorp/nomad...

GO-2022-0509 KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge

KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge...

GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd

Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd...

GO-2022-0496 Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki

Path traversal mitigation bypass in OctoRPKI in github.com/cloudflare/cfrpki...

GO-2022-0442 Arbitrary file deletion in gitea in code.gitea.io/gitea

Arbitrary file deletion in gitea in code.gitea.io/gitea...

GO-2022-0396 Devices resource list treated as a blacklist by default in github.com/opencontainers/runc

Devices resource list treated as a blacklist by default in github.com/opencontainers/runc...

GO-2022-0381 Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server

Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server...

GO-2023-2355 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving

Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving...

GO-2023-2341 Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes

Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes...

GO-2023-2422 Deis Workflow Manager race condition vulnerability in github.com/deis/workflow-manager

Deis Workflow Manager race condition vulnerability in github.com/deis/workflow-manager...

GO-2023-2170 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes and k8s.io/mount-utils

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

GO-2023-2051 Answer Missing Authentication for Critical Function in github.com/answerdev/answer

Answer Missing Authentication for Critical Function in github.com/answerdev/answer...

GO-2023-1853 HashiCorp Consul vulnerable to Origin Validation Error in github.com/hashicorp/consul

HashiCorp Consul vulnerable to Origin Validation Error in github.com/hashicorp/consul...

GO-2023-1785 Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium

Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium...

GO-2023-1612 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer

Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...

GO-2023-1550 Answer contains Improper Access Control vulnerability in github.com/answerdev/answer

Answer contains Improper Access Control vulnerability in github.com/answerdev/answer...

GO-2023-1581 Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad

Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad...

GO-2024-3066 open-telemetry has an Observable Timing Discrepancy in github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension

open-telemetry has an Observable Timing Discrepancy in github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension...

GO-2024-3019 soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve...

GO-2024-2994 Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes

Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes...

GO-2024-2969 github.com/gogs/gogs affected by CVE-2024-39930

github.com/gogs/gogs affected by CVE-2024-39930...

GO-2024-2445 Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport

Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2024-2590 Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server

Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server

Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2024-2566 Mattermost fails to check the required permissions in github.com/mattermost/mattermost-server

Mattermost fails to check the required permissions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2024-2666 Insecure IPsec transparent encryption in github.com/cilium/cilium

Insecure IPsec transparent encryption in github.com/cilium/cilium...

GO-2023-1881 The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk

If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is not charged. No patch will be released, as the package is planned to be deprecated and replaced...

GO-2026-6599 Reset context tracking on consecutive template expressions in html/template

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...

GO-2026-6664 Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana

Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-6645 LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI...

GO-2026-6622 SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel...

GO-2026-6635 SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel...

GO-2026-6626 SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel...

GO-2026-6616 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk...

GO-2026-6619 Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer

Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer...

GO-2026-6492 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go...

GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...