4632 matches found
GO-2026-5951 GoClaw has a Command Injection issue in github.com/nextlevelbuilder/goclaw
GoClaw has a Command Injection issue in github.com/nextlevelbuilder/goclaw...
GO-2026-5952 sigstore-go has a multi-log threshold bypass via single compromised log in github.com/sigstore/sigstore-go
sigstore-go has a multi-log threshold bypass via single compromised log in github.com/sigstore/sigstore-go...
GO-2026-5933 netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil...
GO-2026-5760 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding in github.com/traefik/traefik...
GO-2026-5749 DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph
A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value...
GO-2026-5766 Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster in go.temporal.io/server
Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster in go.temporal.io/server...
GO-2026-5745 Blocky DNSSEC validation bypass and validation-cache scope pollution in github.com/0xERR0R/blocky
Blocky DNSSEC validation bypass and validation-cache scope pollution in github.com/0xERR0R/blocky...
GO-2026-5605 Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine in github.com/gotenberg/gotenberg...
GO-2026-5527 Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows
Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS gatekeeper.go in github.com/argoproj/argo-workflows...
GO-2026-5615 CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3
CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3...
GO-2026-5415 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio...
GO-2026-5445 HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad
HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad...
GO-2026-5413 ots has a negative expire override that can bypass its secret retention policy in github.com/Luzifer/ots
ots has a negative expire override that can bypass its secret retention policy in github.com/Luzifer/ots...
GO-2026-5231 Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex
Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex...
GO-2026-5262 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS in github.com/hashicorp/vault
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS in github.com/hashicorp/vault...
GO-2026-5247 HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault...
GO-2026-5260 SiYuan has incomplete fix for CVE-2026-33066: XSS in github.com/siyuan-note/siyuan/kernel
SiYuan has incomplete fix for CVE-2026-33066: XSS in github.com/siyuan-note/siyuan/kernel...
GO-2026-5149 Traefik: Pre-authentication decision bypass due to forwarded alias spoofing in github.com/traefik/traefik
Traefik: Pre-authentication decision bypass due to forwarded alias spoofing in github.com/traefik/traefik...
GO-2026-5064 containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd
containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd...
GO-2026-5013 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...
GO-2026-4946 Inefficient policy validation in crypto/x509
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the...
GO-2026-4866 Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the...
GO-2026-4910 Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git
Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git...
GO-2026-4736 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute in github.com/osrg/gobgp
GoBGP vulnerable to a denial of service via the NEXTHOP path attribute in github.com/osrg/gobgp...
GO-2026-4753 Loop Variable Capture Signature Bypass in goxmldsig in github.com/russellhaering/goxmldsig
Loop Variable Capture Signature Bypass in goxmldsig in github.com/russellhaering/goxmldsig...
GO-2026-4837 NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server
NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server...
GO-2026-4844 Zoraxy: Authenticated Path Traversal in Config Import leads to RCE in github.com/tobychui/zoraxy
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE in github.com/tobychui/zoraxy...
GO-2026-4815 OOM from malicious IFD offset in golang.org/x/image/tiff
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error...
GO-2026-4805 Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api
Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2026-4737 Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd
Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 in github.com/argoproj-labs/terraform-provider-argocd...
GO-2026-4727 Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server
Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-4518 Denial of service in github.com/jackc/pgproto3/v2
The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic...
GO-2026-4692 Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core...
GO-2026-4671 Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval in github.com/anchore/quill
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval in github.com/anchore/quill...
GO-2026-4618 Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs
Gogs: Stored XSS in branch and wiki views through author and committer names in gogs.io/gogs...
GO-2026-4568 Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio
Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio...
GO-2026-4584 OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin
OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin...
GO-2026-4599 Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered...
GO-2026-4519 Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom
Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom...
GO-2026-4333 Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit
Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit...
GO-2026-4382 Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno
Kyverno Denial of Service via Context Variable Amplification in Policy Engine in github.com/kyverno/kyverno...
GO-2026-4384 KubeVirt Guest Agent DoS via Excessive Network Interface Reports in kubevirt.io/kubevirt
KubeVirt Guest Agent DoS via Excessive Network Interface Reports in kubevirt.io/kubevirt...
GO-2025-4261 Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea...
GO-2025-4210 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik...
GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN .example.com...
GO-2025-4163 NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST in github.com/free5gc/nssf
NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST in github.com/free5gc/nssf...
GO-2025-4126 Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost
Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-4100 containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd
containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd...
GO-2025-4048 Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server...