4632 matches found
GO-2026-4661 Linkdave Missing Authentication on REST and WebSocket endpoints in github.com/shi-gg/linkdave
Linkdave Missing Authentication on REST and WebSocket endpoints in github.com/shi-gg/linkdave...
GO-2026-4595 Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd
Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd...
GO-2026-4618 Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs
Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs...
GO-2026-4578 openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References in github.com/openshift/openshift-apiserver
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References in github.com/openshift/openshift-apiserver...
GO-2026-4568 Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio
Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio...
GO-2026-4584 OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin
OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin...
GO-2026-4587 OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login in github.com/OliveTin/OliveTin
OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login in github.com/OliveTin/OliveTin...
GO-2026-4572 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-4577 malcontent: Nested archive extraction failure can drop content from scan inputs in github.com/chainguard-dev/malcontent
malcontent: Nested archive extraction failure can drop content from scan inputs in github.com/chainguard-dev/malcontent...
GO-2026-4559 Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic...
GO-2026-4501 Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs
Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-4519 Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom
Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom...
GO-2026-4426 ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx in k8s.io/ingress-nginx
ingress-nginx's rules.http.paths.path Ingress field can be used to inject configuration into nginx in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-4411 Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints in github.com/navidrome/navidrome
Navidrome affected by Denial of Service and disk exhaustion via oversized size parameter in /rest/getCoverArt and /share/img/ endpoints in github.com/navidrome/navidrome...
GO-2026-4343 SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel
SiYuan has a Reflected Cross-Site Scripting XSS via /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel...
GO-2026-4382 Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno
Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno...
GO-2026-4339 Arbitrary file write using cgo pkg-config directive in cmd/go
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...
GO-2026-4321 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs...
GO-2026-4278 HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad...
GO-2025-4168 Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...
GO-2025-4220 memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos
memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos...
GO-2025-4210 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-4202 Mattermost Server allows attackers to create buttons that can launch API requests in github.com/mattermost/mattermost-server
Mattermost Server allows attackers to create buttons that can launch API requests in github.com/mattermost/mattermost-server...
GO-2025-4214 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond in github.com/babylonlabs-io/babylon...
GO-2025-4163 NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST in github.com/free5gc/nssf
NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST in github.com/free5gc/nssf...
GO-2025-4164 Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API in github.com/free5gc/pcf
Free5GC is vulnerable to DoS through its NpcfBDTPolicyControl POST API in github.com/free5gc/pcf...
GO-2025-4138 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh
esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh...
GO-2025-4157 Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon
Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon...
GO-2025-4158 LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in github.com/lf-edge/ekuiper
LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in github.com/lf-edge/ekuiper...
GO-2025-4126 Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost
Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-4104 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2025-4100 containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd
containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd...
GO-2025-4027 Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto
Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto...
GO-2025-4050 Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server...
GO-2025-4048 Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server...
GO-2025-4034 MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS in github.com/minio/minio
MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS in github.com/minio/minio...
GO-2025-4026 Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor
Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2025-4031 Guest user can discover active public channels in github.com/mattermost/mattermost-server
Guest user can discover active public channels in github.com/mattermost/mattermost-server...
GO-2025-4056 Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...
GO-2025-4062 Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server
Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server...
GO-2025-4029 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-4040 NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird
NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird...
GO-2025-3994 Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd
Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd...
GO-2025-3982 Rancher sends sensitive information to external services through the `/meta/proxy` endpoint in github.com/rancher/rancher
Rancher sends sensitive information to external services through the /meta/proxy endpoint in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3943 listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk...
GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...
GO-2025-3923 Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher
Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3921 Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder...
GO-2025-3907 Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server
Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server...