4632 matches found
GO-2025-3924 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault...
GO-2025-3887 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm...
GO-2025-3704 Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana
Grafana Cross-Site-Scripting XSS via custom loaded frontend plugin in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3706 Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber
Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber...
GO-2025-3703 Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg
Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg...
GO-2025-3688 Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil
Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil...
GO-2025-3687 Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon...
GO-2025-3663 Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault...
GO-2025-3662 Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault...
GO-2025-3562 Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno...
GO-2025-3515 CVE-2025-26260 in github.com/plentico/plenti
CVE-2025-26260 in github.com/plentico/plenti...
GO-2025-3450 MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun
MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun...
GO-2025-3443 CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft
CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft...
GO-2024-3232 Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server
Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server...
GO-2022-0599 Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server...
GO-2022-0576 Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server
Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server...
GO-2023-2388 eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github...
GO-2023-2156 Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware
Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware...
GO-2023-1879 Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource in go.temporal.io/server
Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource in go.temporal.io/server...
GO-2023-1862 Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium
Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium...
GO-2024-2816 kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt
kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt...
GO-2024-2584 Slashing evasion in github.com/cosmos/cosmos-sdk
Slashing evasion in github.com/cosmos/cosmos-sdk...
GO-2024-2583 Encryption bypass in github.com/edgelesssys/marblerun
Encryption bypass in github.com/edgelesssys/marblerun...
GO-2026-6586 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go...
GO-2026-6588 podman quadlet install --replace does not fully replace the old file in github.com/containers/podman
podman quadlet install --replace does not fully replace the old file in github.com/containers/podman...
GO-2026-6549 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...
GO-2026-6583 Klever-Go: /log controls global node logging in github.com/klever-io/klever-go
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go...
GO-2026-6507 CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns
CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns...
GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...
GO-2026-6456 rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone
rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone...
GO-2026-6382 SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeadingTransaction / getBacklinkDoc publish mode in github.com/siyuan-note/siyuan/kernel...
GO-2026-6253 moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive
moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...
GO-2026-6199 Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone
Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone...
GO-2026-6187 FTP command injection via custom encoding in github.com/rclone/rclone
FTP command injection via custom encoding in github.com/rclone/rclone...
GO-2026-6121 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) in github.com/gopacket/gopacket
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded 4 GiB allocation unauthenticated remote DoS in github.com/gopacket/gopacket...
GO-2026-6003 Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway...
GO-2026-5614 arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS in github.com/arnika-project/arnika
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS in github.com/arnika-project/arnika...
GO-2026-5192 OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao
OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao...
GO-2026-5157 hjson stack exhaustion vulnerability in github.com/hjson/hjson-go
hjson stack exhaustion vulnerability in github.com/hjson/hjson-go...
GO-2026-4923 WITHDRAWN: out-of-range-index in go.etcd.io/bbolt
This report has been withdrawn with reason: "Reporter and maintainer have confirmed this as false positive". Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt...
GO-2026-4896 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio...
GO-2026-4764 Unsigned SAML LogoutRequest Acceptance in gosaml2 in github.com/russellhaering/gosaml2
Unsigned SAML LogoutRequest Acceptance in gosaml2 in github.com/russellhaering/gosaml2...
GO-2026-4857 OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga
OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga...
GO-2026-4828 NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server
NATS has mTLS verifyandmap authentication bypass via incorrect Subject DN matching in github.com/nats-io/nats-server...
GO-2026-4600 Panic in name constraint checking for malformed certificates in crypto/x509
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS...
GO-2026-4529 Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign...
GO-2026-4458 Blocklist Bypass possible via ECDSA Signature Malleability in github.com/slackhq/nebula
Blocklist Bypass possible via ECDSA Signature Malleability in github.com/slackhq/nebula...
GO-2026-4405 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko...