4684 matches found
GO-2025-3756 Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server
Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server...
GO-2025-3742 Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana
Grafana's datasource proxy API allows authorization checks to be bypassed in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3722 Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio
Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio...
GO-2025-3721 ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3718 Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast
Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3699 Allows host filesystem access on pull in github.com/containerd/containerd
Allows host filesystem access on pull in github.com/containerd/containerd...
GO-2025-3684 Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm
Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm...
GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...
GO-2025-3599 bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta...
GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server...
GO-2025-3554 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin...
GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3528 containerd has an integer overflow in User ID handling in github.com/containerd/containerd
containerd has an integer overflow in User ID handling in github.com/containerd/containerd...
GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server
Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server...
GO-2025-3487 Potential denial of service in golang.org/x/crypto
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
GO-2025-3397 matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo
matrix-media-repo MMR allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo...
GO-2025-3390 Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs
Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs...
GO-2025-3367 Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git
Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git...
GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs
Remote Command Execution in file editing in gogs in gogs.io/gogs...
GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather
OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5
Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...
GO-2024-3262 Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad...
GO-2024-3220 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-3184 Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome
Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome...
GO-2024-3130 CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns
CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns...
GO-2022-1250 usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos
usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos...
GO-2022-1121 Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul
Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul...
GO-2022-0886 Kubernetes Arbitrary Command Injection in k8s.io/kubernetes
Kubernetes Arbitrary Command Injection in k8s.io/kubernetes...
GO-2022-0847 Incorrect Permission Assignment for Critical Resource in Hashicorp Consul in github.com/hashicorp/consul
Incorrect Permission Assignment for Critical Resource in Hashicorp Consul in github.com/hashicorp/consul...
GO-2022-0823 Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea
Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea...
GO-2022-0806 Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad
Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0609 Gitea Missing Authorization vulnerability in code.gitea.io/gitea
Gitea Missing Authorization vulnerability in code.gitea.io/gitea...
GO-2022-0622 Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad
Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0395 GitHub CLI can execute a git binary from the current directory in github.com/cli/cli
GitHub CLI can execute a git binary from the current directory in github.com/cli/cli...
GO-2022-0353 Path Traversal in Gitea in code.gitea.io/gitea
Path Traversal in Gitea in code.gitea.io/gitea...
GO-2022-0310 Capture-replay in Gitea in code.gitea.io/gitea
Capture-replay in Gitea in code.gitea.io/gitea...
GO-2023-2378 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks...
GO-2023-2166 SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb
SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb...
GO-2023-2063 HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault
HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault...
GO-2023-2051 Answer Missing Authentication for Critical Function in github.com/answerdev/answer
Answer Missing Authentication for Critical Function in github.com/answerdev/answer...
GO-2023-2053 matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo
matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo...
GO-2023-1999 Gitea erroneous repo clones in code.gitea.io/gitea
Gitea erroneous repo clones in code.gitea.io/gitea...
GO-2023-1899 Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad...
GO-2023-1892 Kubernetes mountable secrets policy bypass in k8s.io/kubernetes
Kubernetes mountable secrets policy bypass in k8s.io/kubernetes...
GO-2023-1592 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1583 User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation
User data in TPM attestation vulnerable to MITM in github.com/edgelesssys/constellation...
GO-2023-1581 Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad
Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad...
GO-2023-1471 Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server
Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server...
GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server
Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...