4632 matches found
GO-2026-5444 mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure
mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure...
GO-2026-5212 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers in github.com/sigstore/gitsign
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers in github.com/sigstore/gitsign...
GO-2026-5238 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls...
GO-2026-4989 MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx
MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx...
GO-2026-4845 Harbor allows the use of the default password for web UI login in github.com/goharbor/harbor
Harbor allows the use of the default password for web UI login in github.com/goharbor/harbor...
GO-2026-4836 NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server...
GO-2026-4816 NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs...
GO-2026-4809 Syft improper temporary file cleanup in github.com/anchore/syft
Syft improper temporary file cleanup in github.com/anchore/syft...
GO-2026-4779 MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio
MinIO has JWT Algorithm Confusion in OIDC Authentication in github.com/minio/minio...
GO-2026-4792 Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration in github.com/traefik/traefik
Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration in github.com/traefik/traefik...
GO-2026-4747 SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel
SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata in github.com/siyuan-note/siyuan/kernel...
GO-2026-4610 Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli...
GO-2026-4646 SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-4454 Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs
Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2026-4488 webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go
webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go...
GO-2025-4272 Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server
Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server...
GO-2025-4170 Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server
Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2025-4160 Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype
Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype...
GO-2025-4025 CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft
CometBFT's invalid BitArray handling can lead to network halt in github.com/cometbft/cometbft...
GO-2025-4115 Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus...
GO-2025-4108 containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd
containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd...
GO-2025-4110 KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt
KubeVirt Vulnerable to Arbitrary Host File Read and Write in kubevirt.io/kubevirt...
GO-2025-4078 Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast
Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast...
GO-2025-3987 Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers
Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers...
GO-2025-4049 OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao
OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao...
GO-2025-4071 Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault
Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault...
GO-2025-4012 Lack of limit when parsing cookies can cause memory exhaustion in net/http
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption...
GO-2025-3983 Rancher update on users can deny the service to the admin in github.com/rancher/rancher
Rancher update on users can deny the service to the admin in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd...
GO-2025-3941 pREST has a Systemic SQL Injection Vulnerability in github.com/prest/prest
pREST has a Systemic SQL Injection Vulnerability in github.com/prest/prest...
GO-2025-3944 Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly...
GO-2025-3912 Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark
Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark...
GO-2025-3897 CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o
CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o...
GO-2025-3768 Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor
Velociraptor vulnerable to privilege escalation via UpdateConfig artifact in www.velocidex.com/golang/velociraptor...
GO-2025-3781 Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus
Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks in github.com/lxc/incus...
GO-2025-3783 OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao
OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao...
GO-2025-3801 Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary in github.com/babylonlabs-io/babylon
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary in github.com/babylonlabs-io/babylon...
GO-2025-3741 kro Confused Deputy vulnerability in github.com/kro-run/kro
kro Confused Deputy vulnerability in github.com/kro-run/kro...
GO-2025-3735 Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go
Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go...
GO-2025-3690 SeaweedFS Vulnerable to SQL Injection in github.com/seaweedfs/seaweedfs
SeaweedFS Vulnerable to SQL Injection in github.com/seaweedfs/seaweedfs...
GO-2025-3693 Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server
Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server...
GO-2025-3607 gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf
gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf...
GO-2025-3557 Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama
Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama...
GO-2025-3418 Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway
Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway...
GO-2024-3228 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Coder vulnerable to post-auth URL redirection to untrusted site 'Open Redirect' in github.com/coder/coder...
GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...
GO-2022-0632 Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0597 Cross-site Scripting in Gogs in gogs.io/gogs
Cross-site Scripting in Gogs in gogs.io/gogs...