4632 matches found
GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea
Gitea has improper access control for uploaded attachments in code.gitea.io/gitea...
GO-2026-4341 Memory exhaustion in query parameter parsing in net/url
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containi...
GO-2026-4310 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails in github.com/axllent/mailpit
Mailpit is vulnerable to Cross-Site WebSocket Hijacking CSWSH allowing unauthenticated access to emails in github.com/axllent/mailpit. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-4273 Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server
Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2026-4309 Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign...
GO-2025-4268 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea...
GO-2025-4254 Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls
Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls...
GO-2025-4245 Expr has Denial of Service via Unbounded Recursion in Builtin Functions in github.com/expr-lang/expr
Expr has Denial of Service via Unbounded Recursion in Builtin Functions in github.com/expr-lang/expr...
GO-2025-4240 Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes
Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes...
GO-2025-4233 HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go...
GO-2025-4161 VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM in github.com/VictoriaMetrics/VictoriaMetrics
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM in github.com/VictoriaMetrics/VictoriaMetrics...
GO-2025-4136 authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io
authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-4223 RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows...
GO-2025-4181 step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates
step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates...
GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN .example.com...
GO-2025-4160 Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype
Grype has a credential disclosure vulnerability in its JSON output in github.com/anchore/grype...
GO-2025-4123 Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token high compression ratio in github.com/dvsekhvalnov/jose2go
Denial-of-Service DoS via crafted JSON Web Encryption JWE token high compression ratio in github.com/dvsekhvalnov/jose2go...
GO-2025-4119 AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql...
GO-2025-4115 Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus
Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus...
GO-2025-4114 Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus
Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2025-4095 Kgateway transformation policy template can emit files from the container in github.com/kgateway-dev/kgateway
Kgateway transformation policy template can emit files from the container in github.com/kgateway-dev/kgateway...
GO-2025-4116 Potential denial of service in golang.org/x/crypto/ssh/agent
SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...
GO-2025-4082 Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul
Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul...
GO-2025-4022 Omni vulnerable to information leak via API in github.com/siderolabs/omni
Omni vulnerable to information leak via API in github.com/siderolabs/omni...
GO-2025-4024 Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows
Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows...
GO-2025-4087 Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto
Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto...
GO-2025-4044 NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector
NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector...
GO-2025-4073 Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher
Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher...
GO-2025-4071 Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault
Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault...
GO-2025-4032 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-4035 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2025-4052 OpenBao and Vault Leak []byte Fields in Audit Logs in github.com/openbao/openbao
OpenBao and Vault Leak byte Fields in Audit Logs in github.com/openbao/openbao...
GO-2025-4041 Cosmos EVM Vulnerability in github.com/cosmos/evm
Cosmos EVM Vulnerability in github.com/cosmos/evm...
GO-2025-4013 Panic when validating certificates with DSA public keys in crypto/x509
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains...
GO-2025-4012 Lack of limit when parsing cookies can cause memory exhaustion in net/http
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption...
GO-2025-4008 ALPN negotiation error contains attacker controlled information in crypto/tls
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...
GO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...
GO-2025-3983 Rancher update on users can deny the service to the admin in github.com/rancher/rancher
Rancher update on users can deny the service to the admin in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-4018 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar...
GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd...
GO-2025-3915 Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes
Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes...
GO-2025-3944 Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly...
GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3926 Harness Allows Arbitrary File Write in Gitness LFS server in github.com/harness/gitness
Harness Allows Arbitrary File Write in Gitness LFS server in github.com/harness/gitness...
GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...
GO-2025-3916 simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core
simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core...
GO-2025-3912 Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark
Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark...
GO-2025-3903 Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server
Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server...