4632 matches found
GO-2026-5266 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp
GoBGP: Remote Denial of Service Panic in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp...
GO-2026-5471 Kratos has a Confused Deputy issue in github.com/go-kratos/kratos
Kratos has a Confused Deputy issue in github.com/go-kratos/kratos...
GO-2026-5660 Caddy: stripHTML template function bypass in github.com/caddyserver/caddy
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy...
GO-2026-5105 Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git
Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git...
GO-2026-6006 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway...
GO-2026-5966 File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser
File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser...
GO-2026-4970 Root escape via symlink plus trailing slash in os
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...
GO-2026-5073 DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime
DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime...
GO-2026-5713 GoBGP has an out-of-bounds read in the ParseIP6Extended function in github.com/osrg/gobgp
GoBGP has an out-of-bounds read in the ParseIP6Extended function in github.com/osrg/gobgp...
GO-2026-5883 KubeVirt has a Link Following issue in kubevirt.io/kubevirt
KubeVirt has a Link Following issue in kubevirt.io/kubevirt...
GO-2026-5752 Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization in github.com/traefik/traefik
Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization in github.com/traefik/traefik...
GO-2026-5718 HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack in github.com/hashicorp/nomad-driver-exec2
HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack in github.com/hashicorp/nomad-driver-exec2...
GO-2026-5658 MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry
MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry...
GO-2026-5705 OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu...
GO-2026-5668 Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files
A race condition in the Docker daemon allows an attacker to create arbitrary empty files on the host system during a "docker cp" operation by swapping a destination path with a symbolic link. The affected code is in the daemon package, specifically the openContainerFS and createIfNotExists method...
GO-2026-5667 CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns...
GO-2026-5578 Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint in go.temporal.io/server
Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint in go.temporal.io/server...
GO-2026-5587 Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gotenberg/gotenberg
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags in github.com/gotenberg/gotenberg...
GO-2026-5615 CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3
CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3...
GO-2026-5623 Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0
Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0...
GO-2026-5630 Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline...
GO-2026-5590 uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli...
GO-2026-5527 Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows
Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS gatekeeper.go in github.com/argoproj/argo-workflows...
GO-2026-5526 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation in github.com/openbao/openbao...
GO-2026-5538 Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS in github.com/harvester/harvester
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS in github.com/harvester/harvester...
GO-2026-5500 Open Redirect Bypass in miniflux-v2 in miniflux.app
Open Redirect Bypass in miniflux-v2 in miniflux.app...
GO-2026-5487 HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault...
GO-2026-5444 mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure
mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure...
GO-2026-5400 Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium...
GO-2026-5193 Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs
Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2026-5272 Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline...
GO-2026-5238 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls...
GO-2026-5212 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers in github.com/sigstore/gitsign
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers in github.com/sigstore/gitsign...
GO-2026-4989 MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx
MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx...
GO-2026-4884 Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus...
GO-2026-4760 CBC Padding Panic — Unauthenticated Process Crash in github.com/russellhaering/gosaml2
CBC Padding Panic — Unauthenticated Process Crash in github.com/russellhaering/gosaml2...
GO-2026-4845 Harbor allows the use of the default password for web UI login in github.com/goharbor/harbor
Harbor allows the use of the default password for web UI login in github.com/goharbor/harbor...
GO-2026-4836 NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server...
GO-2026-4816 NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs...
GO-2026-4809 Syft improper temporary file cleanup in github.com/anchore/syft
Syft improper temporary file cleanup in github.com/anchore/syft...
GO-2026-4779 MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio
MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio...
GO-2026-4761 Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline...
GO-2026-4768 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel...
GO-2026-4610 Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli...
GO-2026-4539 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2
Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2...
GO-2026-4359 Incus container environment configuration newline injection in github.com/lxc/incus
Incus container environment configuration newline injection in github.com/lxc/incus...
GO-2026-4311 Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
Fulcio is vulnerable to Server-Side Request Forgery SSRF via MetaIssuer Regex Bypass in github.com/sigstore/fulcio...
GO-2025-4272 Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server
Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server...
GO-2025-4244 SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference in github.com/emiago/sipgo
SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference in github.com/emiago/sipgo...
GO-2025-4170 Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server
Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...