4632 matches found
GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik
Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik...
GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik
Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik...
GO-2025-4139 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh...
GO-2025-4146 Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to a Denial of Service attack through invitepeople command in github.com/mattermost/mattermost-server...
GO-2025-4126 Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost
Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-4100 containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd
containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd...
GO-2025-4099 IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-4002 Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd...
GO-2025-4031 Guest user can discover active public channels in github.com/mattermost/mattermost-server
Guest user can discover active public channels in github.com/mattermost/mattermost-server...
GO-2025-3996 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd...
GO-2025-3919 NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3861 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...
GO-2025-3830 Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker...
GO-2025-3778 Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs
Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs...
GO-2025-3758 Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad...
GO-2025-3794 File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser
File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser...
GO-2025-3803 Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk
Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk...
GO-2025-3733 Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome
Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome...
GO-2025-3698 Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener
Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener...
GO-2025-3585 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input in github.com/beego/beego
Beego allows Reflected/Stored XSS in Beego's RenderForm Function Due to Unescaped User Input in github.com/beego/beego...
GO-2025-3529 Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive...
GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however,...
GO-2024-3101 Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts...
GO-2024-3288 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig...
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3220 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2022-0894 Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul
Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul...
GO-2022-0778 Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault
Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0617 WITHDRAWN: Potential proxy IP restriction bypass in Kubernetes in k8s.io/kubernetes
This report has been withdrawn from the Go vulnerability database with reason: "Low severity issue with no fix available or planned. Likely to cause false positives."...
GO-2022-0612 Stored Cross-site Scripting in gitea in code.gitea.io/gitea
Stored Cross-site Scripting in gitea in code.gitea.io/gitea...
GO-2022-0584 Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad
Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0368 Improper random number generation in github.com/coredns/coredns
Improper random number generation in github.com/coredns/coredns...
GO-2022-0387 Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd
Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd...
GO-2022-0360 Ambiguous OCI manifest parsing in github.com/containerd/containerd
Ambiguous OCI manifest parsing in github.com/containerd/containerd...
GO-2022-0365 User object created with invalid provider data in GoTrue in github.com/netlify/gotrue
User object created with invalid provider data in GoTrue in github.com/netlify/gotrue...
GO-2022-0363 Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o
Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o...
GO-2022-0315 Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea...
GO-2023-1991 Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher
Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher...
GO-2023-1950 Traefik Missing Authentication in github.com/traefik/traefik
Traefik Missing Authentication in github.com/traefik/traefik...
GO-2023-1828 Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul...
GO-2023-1793 secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver
secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver...
GO-2023-1643 Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium...
GO-2024-3068 Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia
Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia...
GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server
Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2530 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd...
GO-2024-2732 Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos
Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos...