GO-2025-3692 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server

Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server...

GO-2025-3686 Babylon Finality Provider `MsgCommitPubRandList` replay attack in github.com/babylonlabs-io/babylon

Babylon Finality Provider MsgCommitPubRandList replay attack in github.com/babylonlabs-io/babylon...

GO-2025-3688 Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil

Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil...

GO-2025-3662 Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault

Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault...

GO-2025-3620 Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server

Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server...

GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...

GO-2025-3584 go.rgst.io/stencil/v2 vulnerable to Path Traversal

go.rgst.io/stencil/v2 vulnerable to Path Traversal...

GO-2025-3562 Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno

Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno...

GO-2025-3515 CVE-2025-26260 in github.com/plentico/plenti

CVE-2025-26260 in github.com/plentico/plenti...

GO-2025-3449 wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm

wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm...

GO-2025-3450 MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun

MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun...

GO-2025-3443 CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft...

GO-2024-3232 Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server

Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server...

GO-2022-1000 KubeVirt vulnerable to arbitrary file read on host in kubevirt.io/kubevirt

KubeVirt vulnerable to arbitrary file read on host in kubevirt.io/kubevirt...

GO-2022-0576 Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server

Insecure plugin handling in Mattermost in github.com/mattermost/mattermost-server...

GO-2022-0599 Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server

Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server...

GO-2022-0410 Local directory executable lookup in sops (Windows-only) in go.mozilla.org/sops

Local directory executable lookup in sops Windows-only in go.mozilla.org/sops...

GO-2022-0377 SSRF in repository migration in gogs.io/gogs

SSRF in repository migration in gogs.io/gogs...

GO-2022-0340 User login denial of service in github.com/google/fscrypt

User login denial of service in github.com/google/fscrypt...

GO-2023-2388 eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github

eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations in knative.dev/eventing-github...

GO-2023-2156 Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware

Cosmos packet-forward-middleware vulnerable to chain-halt in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware...

GO-2023-2012 lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs...

GO-2023-1862 Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium

Cilium vulnerable to information leakage via incorrect ReferenceGrant handling in github.com/cilium/cilium...

GO-2024-2584 Slashing evasion in github.com/cosmos/cosmos-sdk

Slashing evasion in github.com/cosmos/cosmos-sdk...

GO-2026-6542 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana

Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2026-6506 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns...

GO-2026-6507 CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns

CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns...

GO-2026-6456 rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone

rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone...

GO-2026-6420 SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf in github.com/siyuan-note/siyuan/kernel

SiYuan: The session-cookie signing key Conf.CookieKey is returned to anonymous readers by /api/system/getConf in github.com/siyuan-note/siyuan/kernel...

GO-2026-6262 OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu...

GO-2026-6277 netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil

netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil...

GO-2026-6182 Command execution via PowerShell smart quotes in github.com/rclone/rclone

PowerShell treats several Unicode smart-quote characters U+2018, U+2019, U+201A, U+201B as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename wit...

GO-2026-6223 Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) in github.com/argoproj/argo-workflows

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892 in github.com/argoproj/argo-workflows...

GO-2026-5157 hjson stack exhaustion vulnerability in github.com/hjson/hjson-go

hjson stack exhaustion vulnerability in github.com/hjson/hjson-go...

GO-2026-4857 OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga...

GO-2026-4550 CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl

CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl...

GO-2026-4458 Blocklist Bypass possible via ECDSA Signature Malleability in github.com/slackhq/nebula

Blocklist Bypass possible via ECDSA Signature Malleability in github.com/slackhq/nebula...

GO-2026-4405 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko

apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko...

GO-2026-4344 File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login in github.com/filebrowser/filebrowser

File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login in github.com/filebrowser/filebrowser...

GO-2025-4167 Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium...

GO-2025-4225 Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs...

GO-2025-4159 Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon

Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon...

GO-2025-4150 OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

OpenFGA Improper Policy Enforcement in github.com/openfga/openfga...

GO-2025-4096 Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc

Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc...

GO-2025-4105 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation in kubevirt.io/kubevirt

KubeVirt VMI Denial-of-Service DoS Using Pod Impersonation in kubevirt.io/kubevirt...

GO-2025-4103 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt

KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt...

GO-2025-4102 KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes in kubevirt.io/kubevirt

KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes in kubevirt.io/kubevirt...

GO-2025-4107 KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing in kubevirt.io/kubevirt

KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing in kubevirt.io/kubevirt...

GO-2025-4000 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd

Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd...

GO-2025-3999 Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd

Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd...