4632 matches found
GO-2026-5433 DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace
DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5451 Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju
Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju...
GO-2026-5460 Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon...
GO-2026-5480 Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer
Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5402 SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs in github.com/siyuan-note/siyuan/kernel
SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs in github.com/siyuan-note/siyuan/kernel...
GO-2026-5415 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio...
GO-2026-5424 klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go...
GO-2026-5440 Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon
Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: in github.com/xyproto/algernon...
GO-2026-5442 Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server
Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields in github.com/mattermost/mattermost-server...
GO-2026-5468 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs POST multipart upload in github.com/patrickhener/goshs...
GO-2026-5483 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga...
GO-2026-5502 Ella Core has handover failures during concurrent Security Mode Command in github.com/ellanetworks/core
Ella Core has handover failures during concurrent Security Mode Command in github.com/ellanetworks/core...
GO-2026-5401 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon...
GO-2026-5403 Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos
Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos...
GO-2026-5404 Mattermost doesn't check if {{team_id}} was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks
Mattermost doesn't check if teamid was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks...
GO-2026-5414 listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk...
GO-2026-5418 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd...
GO-2026-5421 PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman
PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman...
GO-2026-5422 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
apko doesn't verify downloaded apk packages against APKINDEX checksum package substitution possible in chainguard.dev/apko...
GO-2026-5431 Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session in github.com/lin-snow/ech0
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5434 monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr
monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr...
GO-2026-5436 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave...
GO-2026-5438 Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor
Velociraptor vulnerability in the query plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor...
GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef
free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...
GO-2026-5457 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc...
GO-2026-5459 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery
Anyquery has Path Traversal through clearplugincache, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5465 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb
SpiceDB's SPICEDBDATASTORECONNURI is leaked on startup logs in github.com/authzed/spicedb...
GO-2026-5481 File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser
File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser...
GO-2026-5445 HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad
HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad...
GO-2026-5450 KubeVirt's authorization mechanism improperly truncates subresource names in kubevirt.io/kubevirt
KubeVirt's authorization mechanism improperly truncates subresource names in kubevirt.io/kubevirt...
GO-2026-5453 ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace in github.com/shellhub-io/shellhub
ShellHub has cross-tenant IDOR in GET /api/devices/:uid that discloses device data of any namespace in github.com/shellhub-io/shellhub...
GO-2026-5470 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr...
GO-2026-5479 goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs...
GO-2026-5484 Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server
Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-5489 Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings
Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings...
GO-2026-5494 Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks...
GO-2026-5497 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
apko DiscoverKeys has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko...
GO-2026-5507 Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server
Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server...
GO-2026-5500 Open Redirect Bypass in miniflux-v2 in miniflux.app
Open Redirect Bypass in miniflux-v2 in miniflux.app...
GO-2026-5499 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio...
GO-2026-5398 NietThijmen ShoppingCart: Command injection in the connect function in github.com/NietThijmen/ShoppingCart
NietThijmen ShoppingCart: Command injection in the connect function in github.com/NietThijmen/ShoppingCart...
GO-2026-5487 HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault...
GO-2026-5477 Gogs has Stored XSS in `.ipynb` Preview in gogs.io/gogs
Gogs has Stored XSS in .ipynb Preview in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2026-5400 Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium...
GO-2026-5474 Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow in github.com/mattermost/mattermost-server
Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
GO-2026-5462 Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor in github.com/argoproj/argo-workflows
Argo Vulnerable to Unauthenticated Memory Exhaustion DoS in Webhook Interceptor in github.com/argoproj/argo-workflows...
GO-2026-5399 nebula-mesh's stores enrollment tokens unhashed in SQLite in github.com/juev/nebula-mesh
nebula-mesh's stores enrollment tokens unhashed in SQLite in github.com/juev/nebula-mesh...
GO-2026-5478 free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) in github.com/free5gc/udr
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion single authenticated request in github.com/free5gc/udr...
GO-2026-5172 Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-5476 Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend...