4632 matches found
GO-2025-3729 Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server
Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server...
GO-2025-3705 zot logs secrets in zotregistry.dev/zot
zot logs secrets in zotregistry.dev/zot...
GO-2025-3699 Allows host filesystem access on pull in github.com/containerd/containerd
Allows host filesystem access on pull in github.com/containerd/containerd...
GO-2025-3702 Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env
Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env...
GO-2025-3664 Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2
Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2...
GO-2025-3645 Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes
Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes...
GO-2025-3648 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle MitM attacks in github.com/rancher/stev. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...
GO-2025-3600 Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server
Missing...
GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server
Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server...
GO-2025-3487 Potential denial of service in golang.org/x/crypto
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
GO-2025-3448 Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm
Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm...
GO-2025-3408 WITHDRAWN: DefaultConfig has dangerous defaults causing hung Read in github.com/hashicorp/yamux
This report has been withdrawn with reason: "By request of maintainer in https://github.com/golang/vulndb/issues/3453". The default values for Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout of 30s and 10s create the possibility for timed out writes that most aren't...
GO-2025-3409 Zot IdP group membership revocation ignored in zotregistry.dev/zot
Zot IdP group membership revocation ignored in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2025-3407 Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server
Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server...
GO-2025-3394 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server
Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...
GO-2025-3393 Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server
Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server...
GO-2024-3356 Path Traversal in file update API in gogs in gogs.io/gogs
Path Traversal in file update API in gogs in gogs.io/gogs...
GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5
Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...
GO-2024-3213 Plenti arbitrary file write vulnerability in github.com/plentico/plenti
Plenti arbitrary file write vulnerability in github.com/plentico/plenti...
GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...
GO-2024-3130 CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns
CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns...
GO-2022-1250 usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos
usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos...
GO-2022-1252 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1121 Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul
Missing Authorization in HashiCorp Consul in github.com/hashicorp/consul...
GO-2022-1154 Traefik may display authorization header in the debug logs in github.com/traefik/traefik
Traefik may display authorization header in the debug logs in github.com/traefik/traefik...
GO-2022-0959 Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium
Network Policies & Clusterwide Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium...
GO-2022-0886 Kubernetes Arbitrary Command Injection in k8s.io/kubernetes
Kubernetes Arbitrary Command Injection in k8s.io/kubernetes...
GO-2022-0824 Improper Input Validation in vault-ssh-helper in github.com/hashicorp/vault-ssh-helper
Improper Input Validation in vault-ssh-helper in github.com/hashicorp/vault-ssh-helper...
GO-2022-0622 Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad
Improper Privilege Management in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd
Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd...
GO-2022-0381 Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server
Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server...
GO-2022-0395 GitHub CLI can execute a git binary from the current directory in github.com/cli/cli
GitHub CLI can execute a git binary from the current directory in github.com/cli/cli...
GO-2022-0405 Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
Potential privilege escalation on Kubernetes = v1.19 when the Argo Sever is run with --auth-mode=client in github.com/argoproj/argo-workflows...
GO-2022-0398 Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server
Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server...
GO-2022-0353 Path Traversal in Gitea in code.gitea.io/gitea
Path Traversal in Gitea in code.gitea.io/gitea...
GO-2022-0339 Possible filesystem space exhaustion by local users in github.com/google/fscrypt
Possible filesystem space exhaustion by local users in github.com/google/fscrypt...
GO-2022-0305 Instance config inline secret exposure in Grafana in github.com/grafana/agent
Instance config inline secret exposure in Grafana in github.com/grafana/agent...
GO-2022-0310 Capture-replay in Gitea in code.gitea.io/gitea
Capture-replay in Gitea in code.gitea.io/gitea...
GO-2023-2341 Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes
Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes...
GO-2023-2378 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks...
GO-2023-2355 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving...
GO-2023-2166 SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb
SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb...
GO-2023-2170 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes and k8s.io/mount-utils
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...
GO-2023-2329 HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault...
GO-2023-2079 Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium...
GO-2023-2053 matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo
matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo...