4632 matches found
GO-2025-4159 Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon
Babylon's BIP322 signature implementation is not fully compliant to the spec in github.com/babylonlabs-io/babylon...
GO-2025-4096 Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc
Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc...
GO-2025-4103 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt...
GO-2025-4102 KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes in kubevirt.io/kubevirt
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes in kubevirt.io/kubevirt...
GO-2025-4070 HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault...
GO-2025-4039 OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao
OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-4068 Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula
Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula...
GO-2025-4010 Insufficient validation of bracketed IPv6 hostnames in net/url
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...
GO-2025-3962 esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh
esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh...
GO-2025-3955 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...
GO-2025-3940 Atlantis Exposes Service Version Publicly on /status API Endpoint in github.com/runatlantis/atlantis
Atlantis Exposes Service Version Publicly on /status API Endpoint in github.com/runatlantis/atlantis...
GO-2025-3918 NeuVector admin account has insecure default password in github.com/neuvector/neuvector
NeuVector admin account has insecure default password in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3856 OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3837 Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault
Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault...
GO-2025-3842 Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault
Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault...
GO-2025-3834 1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core
1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3814 Grafana's insecure DingDing Alert integration exposes sensitive information in github.com/grafana/grafana
Grafana's insecure DingDing Alert integration exposes sensitive information in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3788 Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault
Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault...
GO-2025-3811 File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser
File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser...
GO-2025-3802 Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm
Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm...
GO-2025-3751 Sensitive headers not cleared on cross-origin redirect in net/http
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...
GO-2025-3719 Traefik allows path traversal using url encoding in github.com/traefik/traefik
Traefik allows path traversal using url encoding in github.com/traefik/traefik...
GO-2025-3701 Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd
Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd...
GO-2025-3619 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server
Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...
GO-2024-3112 CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft
CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft...
GO-2022-1181 AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity
AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity...
GO-2022-0590 HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault
HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault...
GO-2022-0595 Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server
Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server...
GO-2022-0303 SQL Injection in Casdoor in github.com/casdoor/casdoor
SQL Injection in Casdoor in github.com/casdoor/casdoor...
GO-2023-2397 User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs
User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs...
GO-2024-3012 Malicious code in github.com/PromonLogicalis/asn1
Version 7bdca06d0edf of the github.com/PromonLogicalis/asn1 module contains malicious code which downloads a program from a remote web server and executes it...
GO-2024-2923 Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt
Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt...
GO-2024-2899 apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko...
GO-2026-6265 Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder...
GO-2026-6191 Arbitrary file write via --links symlinks in github.com/rclone/rclone
Arbitrary file write via --links symlinks in github.com/rclone/rclone...
GO-2026-5576 LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd
LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd...
GO-2026-4601 Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...
GO-2026-4528 Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo
Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo...
GO-2025-4121 LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd
LXD vulnerable to a local privilege escalation through custom storage volumes in lxd in github.com/canonical/lxd...
GO-2025-4017 Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go
Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go...
GO-2025-4005 Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd...
GO-2025-4043 NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector
NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2025-4009 Quadratic complexity when parsing some invalid inputs in encoding/pem
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs...
GO-2025-3884 Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf
Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...
GO-2025-3892 HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter
HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter...
GO-2025-3605 Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver
Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver...
GO-2025-3817 Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana
Grafana is vulnerable to XSS attacks through open redirects and path traversal in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2025-3780 OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk
OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk...