4632 matches found
GO-2026-6104 Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored in github.com/cloudreve/Cloudreve
Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored in github.com/cloudreve/Cloudreve...
GO-2026-6155 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule...
GO-2026-6245 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api...
GO-2026-6120 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted file.create permissions in github.com/pterodactyl/wings...
GO-2026-6118 GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler in github.com/github/github-mcp-server...
GO-2026-6088 Add recursion depth guard during decode in encoding/xml
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
GO-2026-5046 CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2
The Avro array and map decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 and arm64 targets. A producer can declare a block of up to...
GO-2026-6076 Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea
Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea...
GO-2026-6067 Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev
Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev...
GO-2026-5880 Hardlink path traversal during tar extraction in oras.land/oras-go
Hardlink path traversal during tar extraction in oras.land/oras-go...
GO-2026-5955 GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp...
GO-2026-5879 Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go
Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go...
GO-2026-5566 Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm...
GO-2026-5885 Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go
Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go...
GO-2026-5684 Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime
Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime...
GO-2026-5506 OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel
OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel...
GO-2026-5585 Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber
Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber...
GO-2026-6057 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface in code.gitea.io/gitea...
GO-2026-6054 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in gitea.dev
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in gitea.dev...
GO-2026-6021 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser...
GO-2026-6022 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim in github.com/cloudreve/Cloudreve
Cloudreve: OAuth access tokens bypass scope enforcement due to missing clientid claim in github.com/cloudreve/Cloudreve...
GO-2026-6044 Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea
Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea...
GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...
GO-2026-6028 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) in gitea.dev
Gitea: Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939 in gitea.dev...
GO-2026-6040 Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev
Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev...
GO-2026-5934 netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil...
GO-2026-5958 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel
SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel...
GO-2026-5941 Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite
Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite...
GO-2026-5978 MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion in github.com/StacklokLabs/mkp
MKP: Unbounded Pod Log Read via Attacker-Controlled limitBytes/tailLines Causes Memory Exhaustion in github.com/StacklokLabs/mkp...
GO-2026-5965 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers in github.com/siyuan-note/siyuan/kernel...
GO-2026-5996 ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive
ToolHive: SSRF guard misses IPv6 NAT64 ranges 64:ff9b::/96, 64:ff9b:1::/48, allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive...
GO-2026-5985 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allowprivate in github.com/forgekeep/nebula-mesh...
GO-2026-5743 Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy...
GO-2026-5798 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus...
GO-2026-5895 Casdoor has an authentication bypass in github.com/casdoor/casdoor
Casdoor has an authentication bypass in github.com/casdoor/casdoor...
GO-2026-5900 SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo
SFTPGo has stored XSS via inline parameter on public shares and user file download in github.com/drakkan/sftpgo...
GO-2026-5836 Mattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github
Mattermost doesn't enforce request body size limits on plugin HTTP endpoints in github.com/mattermost/mattermost-plugin-github...
GO-2026-5818 Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions in github.com/mattermost/mattermost-server
Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions in github.com/mattermost/mattermost-server...
GO-2026-5737 Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri in github.com/authorizerdev/authorizer
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirecturi in github.com/authorizerdev/authorizer...
GO-2026-5728 goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs
goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs...
GO-2026-5648 ZITADEL has LDAP Filter Injection in Login Flow in github.com/zitadel/zitadel
ZITADEL has LDAP Filter Injection in Login Flow in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2026-5607 MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry...
GO-2026-5560 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo...
GO-2026-5539 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads in go.opentelemetry.io/obi...
GO-2026-5583 CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns...
GO-2026-5484 Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server
Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-5425 Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator
Ironic Standalone Operator's controller modifies user-owned resources without consent in github.com/metal3-io/ironic-standalone-operator...
GO-2026-5507 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server
Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server...
GO-2026-5465 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb
SpiceDB's SPICEDBDATASTORECONNURI is leaked on startup logs in github.com/authzed/spicedb...
GO-2026-5480 Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer
Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...