4632 matches found
GO-2025-3956 Unexpected paths returned from LookPath in os/exec
If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", ".", and "..", can result in the binaries listed in the PATH being unexpectedly returned...
GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3921 Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder...
GO-2025-3852 operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd in github.com/operator-framework/operator-sdk
operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd in github.com/operator-framework/operator-sdk...
GO-2025-3843 Grafana Infinity Datasource Plugin SSRF Vulnerability in github.com/grafana/grafana-infinity-datasource
Grafana Infinity Datasource Plugin SSRF Vulnerability in github.com/grafana/grafana-infinity-datasource...
GO-2025-3832 OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 in github.com/oauth2-proxy/oauth2-proxy
OAuth2-Proxy's --gitlab-group GitLab Group Authorization config flag stopped working in v7.0.0 in github.com/oauth2-proxy/oauth2-proxy...
GO-2025-3833 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion in github.com/oauth2-proxy/oauth2-proxy
OAuth2-Proxy has authentication bypass in oauth2-proxy skipauthroutes due to Query Parameter inclusion in github.com/oauth2-proxy/oauth2-proxy...
GO-2025-3829 Moby firewalld reload removes bridge network isolation in github.com/docker/docker
Moby firewalld reload removes bridge network isolation in github.com/docker/docker...
GO-2025-3784 filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser
filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser...
GO-2025-3762 New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd
New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd...
GO-2025-3810 Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager
Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager...
GO-2025-3767 OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr...
GO-2025-3804 Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju
Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju...
GO-2025-3757 Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server
Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server...
GO-2025-3743 CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns...
GO-2025-3740 Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3737 Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi
Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3689 Ollama Divide by Zero Vulnerability in github.com/ollama/ollama
Ollama Divide by Zero Vulnerability in github.com/ollama/ollama...
GO-2025-3631 GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp
GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp...
GO-2025-3634 Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik
Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik...
GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server...
GO-2025-3611 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3586 Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher
Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...
GO-2025-3537 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza
OWASP Coraza WAF has parser confusion which leads to wrong URI in REQUESTFILENAME in github.com/corazawaf/coraza...
GO-2025-3561 Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium
Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium...
GO-2025-3517 Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go
Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go...
GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...
GO-2025-3492 Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos
Memos Server-Side Request Forgery SSRF in github.com/usememos/memos...
GO-2025-3485 DoS in go-jose Parsing in github.com/go-jose/go-jose
DoS in go-jose Parsing in github.com/go-jose/go-jose...
GO-2025-3418 Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway
Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway...
GO-2025-3401 matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo
matrix-media-repo MMR allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo...
GO-2024-3360 OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive...
GO-2024-3248 KubeSphere IDOR vulnerability in github.com/kubesphere/kubesphere
An Insecure Direct Object Reference IDOR vulnerability in KubeSphere allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. NOTE: A fix is expected in v4.1.3 in January 2025...
GO-2024-3313 Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd
Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd...
GO-2024-3282 Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager
Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager...
GO-2024-3275 Unpatched Remote Code Execution in Gogs in gogs.io/gogs
Unpatched Remote Code Execution in Gogs in gogs.io/gogs...
GO-2024-3230 Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno
Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno...
GO-2024-3217 User Registration Bypass in Zitadel in github.com/zitadel/zitadel
User Registration Bypass in Zitadel in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3223 Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher
Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3162 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault...
GO-2024-3173 JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju
JUJUCONTEXTID is a predictable authentication secret in github.com/juju/juju...
GO-2024-3182 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu...
GO-2024-3141 OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa
OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions...
GO-2024-3124 Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp
Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function...
GO-2024-3102 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver...
GO-2022-1107 Container build can leak any path on the host into the container in github.com/docker/docker
Container build can leak any path on the host into the container in github.com/docker/docker...
GO-2022-1066 Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node
Potential inter-blockchain communication IBC protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node...