4632 matches found
GO-2022-0405 Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows
Potential privilege escalation on Kubernetes = v1.19 when the Argo Sever is run with --auth-mode=client in github.com/argoproj/argo-workflows...
GO-2022-0398 Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server
Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server...
GO-2022-0339 Possible filesystem space exhaustion by local users in github.com/google/fscrypt
Possible filesystem space exhaustion by local users in github.com/google/fscrypt...
GO-2022-0310 Capture-replay in Gitea in code.gitea.io/gitea
Capture-replay in Gitea in code.gitea.io/gitea...
GO-2022-0305 Instance config inline secret exposure in Grafana in github.com/grafana/agent
Instance config inline secret exposure in Grafana in github.com/grafana/agent...
GO-2023-2355 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving...
GO-2023-2329 HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault...
GO-2023-2071 Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc
Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc...
GO-2023-2079 Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium...
GO-2023-2053 matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo
matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo...
GO-2023-1997 Answer Missing Authorization vulnerability in github.com/answerdev/answer
Answer Missing Authorization vulnerability in github.com/answerdev/answer...
GO-2023-1980 Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane
Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane...
GO-2023-1730 Debug mode leaks confidential data in Cilium in github.com/cilium/cilium
Debug mode leaks confidential data in Cilium in github.com/cilium/cilium...
GO-2023-1747 Hop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper
Hop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper...
GO-2023-1592 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1471 Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server
Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server...
GO-2023-1492 Kubernetes Privilege Escalation in k8s.io/kubernetes
Kubernetes Privilege Escalation in k8s.io/kubernetes...
GO-2024-2951 Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft
A malicious peer can cause a syncing node to panic during blocksync. The syncing node may enter into a catastrophic invalid syncing state or get stuck in blocksync mode, never switching to consensus. Nodes that are vulnerable to this state may experience a Denial of Service condition in which...
GO-2024-2441 The DES/3DES cipher was used as part of the TLS protocol by installation tools in github.com/karmada-io/karmada
The DES/3DES cipher was used as part of the TLS protocol by installation tools in github.com/karmada-io/karmada...
GO-2024-2594 Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server
Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2529 Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd
Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd...
GO-2024-2513 Grafana information disclosure in github.com/grafana/grafana
Grafana information disclosure in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...
GO-2024-2939 SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb...
GO-2024-2922 Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium
Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium...
GO-2024-2726 Traefik affected by HTTP/2 CONTINUATION flood in net/http in github.com/traefik/traefik
Traefik affected by HTTP/2 CONTINUATION flood in net/http in github.com/traefik/traefik...
GO-2024-2872 github.com/bincyber/go-sqlcrypter vulnerable to IV collision
github.com/bincyber/go-sqlcrypter vulnerable to IV collision...
GO-2024-2647 CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli
CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli...
GO-2024-2846 Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd
Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd...
GO-2022-1004 Improper handling of keys in github.com/theupdateframework/go-tuf
An attacker with the ability to insert public keys into a TUF repository can cause clients to accept a staged change that has not been signed by the correct threshold of signatures...
GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...
GO-2026-6655 SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel
SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths Workspace Boundary Bypass in github.com/siyuan-note/siyuan/kernel...
GO-2026-6657 SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU Bypass of CheckHostSSRF in github.com/siyuan-note/siyuan/kernel...
GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...
GO-2026-6581 Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin - remote node memory/goroutine exhaustion DoS in github.com/klever-io/klever-go...
GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...
GO-2026-6563 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...
GO-2026-6521 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule...
GO-2026-6464 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone...
GO-2026-6458 rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone
rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone...
GO-2026-6463 rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone
rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone...
GO-2026-6373 SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel...
GO-2026-6440 Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle
Dozzle: SSRF guard bypass via IPv6 transition addresses 6to4/NAT64/Teredo in webhook notification dispatcher in github.com/amir20/dozzle...
GO-2026-6345 Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea...
GO-2026-6344 Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea...
GO-2026-6363 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit...
GO-2026-6367 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match in github.com/cilium/cilium...
GO-2026-6364 SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass in github.com/siyuan-note/siyuan/kernel...
GO-2026-6313 Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api
Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-6297 linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request in github.com/andreimarcu/linx-server
linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service DoS via a crafted POST request in github.com/andreimarcu/linx-server...