4632 matches found
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito
Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2022-0894 Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul
Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul...
GO-2022-0778 Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault
Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0751 Path Traversal in Docker in github.com/docker/docker
Path Traversal in Docker in github.com/docker/docker...
GO-2022-0612 Stored Cross-site Scripting in gitea in code.gitea.io/gitea
Stored Cross-site Scripting in gitea in code.gitea.io/gitea...
GO-2022-0584 Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad
Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0559 HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul...
GO-2022-0368 Improper random number generation in github.com/coredns/coredns
Improper random number generation in github.com/coredns/coredns...
GO-2022-0365 User object created with invalid provider data in GoTrue in github.com/netlify/gotrue
User object created with invalid provider data in GoTrue in github.com/netlify/gotrue...
GO-2022-0315 Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea...
GO-2022-0360 Ambiguous OCI manifest parsing in github.com/containerd/containerd
Ambiguous OCI manifest parsing in github.com/containerd/containerd...
GO-2023-1991 Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher
Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher...
GO-2023-1950 Traefik Missing Authentication in github.com/traefik/traefik
Traefik Missing Authentication in github.com/traefik/traefik...
GO-2023-1793 secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver
secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver...
GO-2023-1828 Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul...
GO-2023-1643 Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium...
GO-2024-3068 Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia
Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia...
GO-2024-2593 Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server
Mattermost fails to check the "inviteguest" permission in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server
Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2737 IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker
IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker...
GO-2024-2732 Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos
Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos...
GO-2024-2534 Unauthenticated cross-site scripting in github.com/rancher/apiserver
Unauthenticated cross-site scripting in github.com/rancher/apiserver...
GO-2026-6665 Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake
Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake...
GO-2026-6624 SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel...
GO-2026-6502 RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go...
GO-2026-6582 Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go
Klever-Go Account takeover: kleverUpdateAccountPermission authorizes on attacker-controlled RecipientAddr instead of the authenticated caller in github.com/klever-io/klever-go...
GO-2026-6578 Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve...
GO-2026-6596 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium...
GO-2026-6569 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge
KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge...
GO-2026-6586 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go...
GO-2026-6561 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet...
GO-2026-6548 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel
Dasel: Selector lexer panics on trailing whitespace in parseCurRune in github.com/tomwright/dasel...
GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...
GO-2026-6516 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this i...
GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot...
GO-2026-6488 OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga
OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected and with another relation that also grants that user in github.com/openfga/openfga...
GO-2026-6474 ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange in github.com/zitadel/zitadel
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-6468 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik
Traefik: Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' and Incorrect Authorization in github.com/traefik/traefik...
GO-2026-6361 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs
SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs...
GO-2026-6365 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel
SiYuan: path traversal via /export/temp/ short-circuit branch incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f in github.com/siyuan-note/siyuan/kernel...
GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf
ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...
GO-2026-6307 Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment in code.vikunja.io/api
Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via projectviewid mass-assignment in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile...
GO-2026-6112 Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi
Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi...
GO-2026-6094 JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go
JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go...
GO-2026-6203 Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef in github.com/traefik/traefik
Traefik: allowCrossNamespace=false bypass via @kubernetescrd TraefikService backendRef in github.com/traefik/traefik...