GO-2025-4081 Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul

Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul...

GO-2025-4001 Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd

Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd...

GO-2025-4087 Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto

Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto...

GO-2025-4044 NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector

NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector...

GO-2025-4032 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-4035 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2025-4049 OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao

OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao...

GO-2025-4052 OpenBao and Vault Leak []byte Fields in Audit Logs in github.com/openbao/openbao

OpenBao and Vault Leak byte Fields in Audit Logs in github.com/openbao/openbao...

GO-2025-4008 ALPN negotiation error contains attacker controlled information in crypto/tls

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...

GO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...

GO-2025-4006 Excessive CPU consumption in ParseAddress in net/mail

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...

GO-2025-3915 Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes

Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes...

GO-2025-3924 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault

HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault...

GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...

GO-2025-3916 simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core

simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core...

GO-2025-3925 Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw

Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw...

GO-2025-3888 Helm May Panic Due To Incorrect YAML Content in helm.sh/helm

Helm May Panic Due To Incorrect YAML Content in helm.sh/helm...

GO-2025-3887 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm...

GO-2025-3872 Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3871 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3857 OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao

OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2025-3838 Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault...

GO-2025-3836 Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault

Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault...

GO-2025-3828 Unexpected command execution in untrusted VCS repositories in cmd/go

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VCS e.g. Mercurial...

GO-2025-3823 Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service in github.com/kyverno/kyverno

Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service in github.com/kyverno/kyverno...

GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...

GO-2025-3809 Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout in github.com/ctfer-io/chall-manager

Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout in github.com/ctfer-io/chall-manager...

GO-2025-3776 Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs

Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs...

GO-2025-3755 CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd

CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd...

GO-2025-3750 Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2025-3704 Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana

Grafana Cross-Site-Scripting XSS via custom loaded frontend plugin in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3703 Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg

Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg...

GO-2025-3695 Ollama Server Vulnerable to Denial of Service (DoS) Attack in github.com/ollama/ollama

Ollama Server Vulnerable to Denial of Service DoS Attack in github.com/ollama/ollama...

GO-2025-3687 Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon

Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon...

GO-2025-3663 Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault

Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault...

GO-2025-3527 buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx

buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx...

GO-2025-3483 Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server

Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server...

GO-2025-3461 go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative

go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative...

GO-2024-3350 WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core

WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core...

GO-2024-3319 Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd

Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd...

GO-2024-3259 CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft...

GO-2024-3219 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses...

GO-2024-3175 Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju

Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2022-1204 Yapscan's report receiver server vulnerable to path traversal and log injection in github.com/fkie-cad/yapscan

Yapscan's report receiver server vulnerable to path traversal and log injection in github.com/fkie-cad/yapscan...

GO-2022-0554 Unrestricted Upload of File with Dangerous Type in Gogs in gogs.io/gogs

Unrestricted Upload of File with Dangerous Type in Gogs in gogs.io/gogs...

GO-2022-0374 S3 storage write is not aborted on errors leading to unbounded memory usage in github.com/foxcpp/maddy

S3 storage write is not aborted on errors leading to unbounded memory usage in github.com/foxcpp/maddy...

GO-2022-0388 Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows

Argo Server TLS requests could be forged by attacker with network access in github.com/argoproj/argo-workflows...

GO-2022-0375 Improper Access Control in github.com/treeverse/lakefs

Improper Access Control in github.com/treeverse/lakefs...

GO-2023-2340 Attacker can cause Kyverno user to unintentionally consume insecure image in github.com/kyverno/kyverno

Attacker can cause Kyverno user to unintentionally consume insecure image in github.com/kyverno/kyverno...