4632 matches found
GO-2026-5748 Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader in github.com/ollama/ollama
Ollama is vulnerable to a heap out-of-bounds read in its GGUF model loader. A specially crafted GGUF file can cause the loader to read beyond the allocated heap buffer, potentially leading to a denial of service crash...
GO-2026-5966 File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser
File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser...
GO-2026-5951 GoClaw has a Command Injection issue in github.com/nextlevelbuilder/goclaw
GoClaw has a Command Injection issue in github.com/nextlevelbuilder/goclaw...
GO-2026-6005 Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway...
GO-2026-5590 uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli...
GO-2026-5538 Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS in github.com/harvester/harvester
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS in github.com/harvester/harvester...
GO-2026-5444 mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure
mercure has Topic Selector Cache Key Collision in github.com/dunglas/mercure...
GO-2026-5423 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga...
GO-2026-5280 Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus
Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus...
GO-2026-5299 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea...
GO-2026-5129 Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2026-4864 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the ATSYMLINKNOFOLLOW flag, which Root.Chmod uses to...
GO-2026-4879 Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus
Local Incus UI web server vulnerable to nuthentication bypass in github.com/lxc/incus...
GO-2026-4860 OpenBao lacks user confirmation for OIDC direct callback mode in github.com/openbao/openbao
OpenBao lacks user confirmation for OIDC direct callback mode in github.com/openbao/openbao...
GO-2026-4836 NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server
NATS has MQTT plaintext password disclosure in github.com/nats-io/nats-server...
GO-2026-4832 NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server
NATS JetStream has an authorization bypass through its Management API in github.com/nats-io/nats-server...
GO-2026-4816 NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter in github.com/kubernetes-csi/csi-driver-nfs...
GO-2026-4716 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API in github.com/siyuan-note/siyuan/kernel
SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API in github.com/siyuan-note/siyuan/kernel...
GO-2026-4718 Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/chall-manager/deploy
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/chall-manager/deploy...
GO-2026-4792 Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration in github.com/traefik/traefik
Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration in github.com/traefik/traefik...
GO-2026-4765 mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo
mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo...
GO-2026-4727 Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server
Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-4740 WITHDRAWN: Denial of service in github.com/shamaton/msgpack
This report has been withdrawn with reason: "Duplicate of 4513"...
GO-2026-4686 AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass in github.com/AdguardTeam/AdGuardHome
AdGuard Home: HTTP/2 Cleartext h2c Upgrade Authentication Bypass in github.com/AdguardTeam/AdGuardHome...
GO-2026-4644 Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy
Caddy's varsregexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy...
GO-2026-4646 SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2026-4360 Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats
Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats...
GO-2026-4568 Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio
Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio...
GO-2026-4603 URLs in meta content attribute actions are not escaped in html/template
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...
GO-2026-4538 Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2
Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2...
GO-2026-4541 Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2
Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2...
GO-2026-4548 Sliver has Potential Zip Bomb Denial of Service in GzipEncoder in github.com/bishopfox/sliver
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder in github.com/bishopfox/sliver...
GO-2026-4533 nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server
nats-server websockets are vulnerable to pre-auth memory DoS in github.com/nats-io/nats-server...
GO-2026-4497 Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings...
GO-2026-4519 Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom
Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels in github.com/mattermost/mattermost-plugin-zoom...
GO-2026-4504 emp3r0r Affected by Concurrent Map Access DoS (panic/crash) in github.com/jm33-m0/emp3r0r/core
emp3r0r Affected by Concurrent Map Access DoS panic/crash in github.com/jm33-m0/emp3r0r/core...
GO-2026-4471 Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() on crypto/rand failure in github.com/gofiber/fiber
Fiber has an insecure fallback in utils.UUIDv4 / utils.UUID — predictable / zero‑UUID on crypto/rand failure in github.com/gofiber/fiber...
GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik
Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik...
GO-2026-4452 Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4454 Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs
Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2026-4465 LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-4488 webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go
webtransport-go: CloseWithError can block indefinitely in github.com/quic-go/webtransport-go...
GO-2026-4442 FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-4398 WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow in github.com/h44z/wg-portal
WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow in github.com/h44z/wg-portal. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2026-4408 melange pipeline working-directory could allow command injection in chainguard.dev/melange
melange pipeline working-directory could allow command injection in chainguard.dev/melange...
GO-2026-4330 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...
GO-2026-4381 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall in github.com/kyverno/kyverno
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall in github.com/kyverno/kyverno...
GO-2026-4349 Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf
Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf...
GO-2026-4356 Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly...
GO-2026-4355 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor
Rekor affected by Server-Side Request Forgery SSRF via provided public key URL in github.com/sigstore/rekor...