GO-2025-3722 Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio

Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio...

GO-2025-3721 ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3718 Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast

Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast...

GO-2025-3699 Allows host filesystem access on pull in github.com/containerd/containerd

Allows host filesystem access on pull in github.com/containerd/containerd...

GO-2025-3684 Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm...

GO-2025-3640 Memory exhaustion in github.com/vbatts/tar-split

Memory exhaustion in github.com/vbatts/tar-split...

GO-2025-3630 GoBGP does not properly check the input length in github.com/osrg/gobgp

GoBGP does not properly check the input length in github.com/osrg/gobgp...

GO-2025-3637 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno

Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...

GO-2025-3599 bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta

bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta...

GO-2025-3587 Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer

Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer...

GO-2025-3548 Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP in github.com/ollama/ollama

Ollama Vulnerable to Denial of Service DoS via Crafted GZIP in github.com/ollama/ollama...

GO-2025-3545 CVE-2024-53348 in github.com/loxilb-io/loxilb

CVE-2024-53348 in github.com/loxilb-io/loxilb...

GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server

Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server...

GO-2025-3564 ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx

ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3554 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin

Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin...

GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...

GO-2025-3528 containerd has an integer overflow in User ID handling in github.com/containerd/containerd

containerd has an integer overflow in User ID handling in github.com/containerd/containerd...

GO-2025-3494 IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go

IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go...

GO-2025-3466 Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping

Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping...

GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server

Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server...

GO-2025-3487 Potential denial of service in golang.org/x/crypto

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

GO-2025-3415 DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium

DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium...

GO-2025-3419 Updatecli exposes Maven credentials in console output in github.com/updatecli/updatecli

Updatecli exposes Maven credentials in console output in github.com/updatecli/updatecli...

GO-2025-3410 Insecure default config access in WriteFreely in github.com/writefreely/writefreely

Insecure default config access in WriteFreely in github.com/writefreely/writefreely...

GO-2025-3396 Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib

Server-Side Request Forgery SSRF on redirects and federation in github.com/matrix-org/gomatrixserverlib...

GO-2025-3392 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GO-2025-3397 matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo

matrix-media-repo MMR allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo...

GO-2025-3390 Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs

Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs...

GO-2025-3367 Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git...

GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs

Remote Command Execution in file editing in gogs in gogs.io/gogs...

GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather

OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3340 Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server

Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server...

GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5

Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...

GO-2024-3262 Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad

Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad...

GO-2024-3220 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2024-3184 Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome

Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome...

GO-2024-3130 CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns

CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns...

GO-2024-3100 Chisel's AUTH environment variable not respected in server entrypoint in github.com/jpillora/chisel

Chisel's AUTH environment variable not respected in server entrypoint in github.com/jpillora/chisel...

GO-2024-3079 Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana

Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2022-1250 usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos

usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos...

GO-2022-1206 CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation in github.com/cri-o/cri-o

CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation in github.com/cri-o/cri-o...

GO-2022-1151 Buildah (as part of Podman) vulnerable to Link Following in github.com/containers/podman

Buildah as part of Podman vulnerable to Link Following in github.com/containers/podman...

GO-2022-1121 Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul

Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul...

GO-2022-1029 HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul

HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul...

GO-2022-0859 Improper Input Validation in HashiCorp Consul in github.com/hashicorp/consul

Improper Input Validation in HashiCorp Consul in github.com/hashicorp/consul...

GO-2022-0886 Kubernetes Arbitrary Command Injection in k8s.io/kubernetes

Kubernetes Arbitrary Command Injection in k8s.io/kubernetes...

GO-2022-0885 Improper Authentication in Kubernetes in k8s.io/kubernetes

Improper Authentication in Kubernetes in k8s.io/kubernetes...

GO-2022-0829 Cronos vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos

Cronos vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos...

GO-2022-0839 Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform

Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform...