4632 matches found
GO-2026-5214 Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected) in github.com/inspektor-gadget/inspektor-gadget
Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF no shipped gadget affected in github.com/inspektor-gadget/inspektor-gadget...
GO-2026-5219 Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this...
GO-2026-5225 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5229 SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView` in github.com/siyuan-note/siyuan/kernel
SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via /api/av/removeUnusedAttributeView in github.com/siyuan-note/siyuan/kernel...
GO-2026-5236 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy...
GO-2026-5241 Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read in github.com/fission/fission
Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read in github.com/fission/fission...
GO-2026-5242 Dapr: Service Invocation path traversal ACL bypass in github.com/dapr/dapr
Dapr: Service Invocation path traversal ACL bypass in github.com/dapr/dapr...
GO-2026-5247 HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault...
GO-2026-5250 File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection in github.com/filebrowser/filebrowser
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection in github.com/filebrowser/filebrowser...
GO-2026-5200 Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall
Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall...
GO-2026-5213 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate in github.com/openbao/openbao
OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate in github.com/openbao/openbao...
GO-2026-5230 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables in github.com/fission/fission
Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables in github.com/fission/fission...
GO-2026-5246 Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go...
GO-2026-5271 GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands in github.com/cli/cli...
GO-2026-5273 MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry
MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry...
GO-2026-5187 PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw
PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw...
GO-2026-5216 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination in github.com/OliveTin/OliveTin
OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination in github.com/OliveTin/OliveTin...
GO-2026-5228 Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence in github.com/juju/juju
Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence in github.com/juju/juju...
GO-2026-5244 Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes in github.com/gotenberg/gotenberg
Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes in github.com/gotenberg/gotenberg...
GO-2026-5275 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals in go.opentelemetry.io/obi...
GO-2026-5279 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses in chainguard.dev/melange
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline.uses in chainguard.dev/melange...
GO-2026-5184 Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs
Gogs: LFS dedupe path leaks private repo content across tenants in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2026-5185 Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
Distribution's tag deletion bypasses storage.delete.enabled configuration in github.com/distribution/distribution...
GO-2026-5196 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder
Coder: PKCS7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder...
GO-2026-5207 Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering in github.com/rancher/fleet
Fleet: Helm impersonation bypass of RESTClientGetter retains cluster-admin during template rendering in github.com/rancher/fleet...
GO-2026-5217 Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer
Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5220 Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs in github.com/getarcaneapp/arcane/backend
Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs in github.com/getarcaneapp/arcane/backend...
GO-2026-5221 goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs...
GO-2026-5226 Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia...
GO-2026-5235 Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows
Argo vulnerable to exposure of artifact repository credentials in github.com/argoproj/argo-workflows...
GO-2026-5237 Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes in github.com/hashicorp/boundary
Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes in github.com/hashicorp/boundary...
GO-2026-5238 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin in github.com/mattermost/mattermost-plugin-calls...
GO-2026-5243 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea...
GO-2026-5245 Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server
Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server...
GO-2026-5193 Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs
Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2026-5190 AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf
AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5252 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import volume omitted in github.com/lxc/incus...
GO-2026-5227 Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI
Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI...
GO-2026-5204 Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches DoS in github.com/klever-io/klever-go...
GO-2026-5284 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio...
GO-2026-5259 Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo in github.com/lin-snow/ech0
Ech0 has Server-Side Request Forgery SSRF via Connect Handler fetchPeerConnectInfo in github.com/lin-snow/ech0...
GO-2026-5186 goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory Path Traversal in github.com/patrickhener/goshs...
GO-2026-5282 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron in github.com/nezhahq/nezha
Nezha Monitoring: RoleMember can run shell on every server cross-tenant RCE via POST /api/v1/cron in github.com/nezhahq/nezha...
GO-2026-5181 Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream in github.com/tilt-dev/tilt
Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream in github.com/tilt-dev/tilt...
GO-2026-5249 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-5270 Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace
Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace...
GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner
Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...
GO-2026-5281 opentelemetry-go's Schema ParseFile leaks file descriptors on each parse in go.opentelemetry.io/otel/schema
opentelemetry-go's Schema ParseFile leaks file descriptors on each parse in go.opentelemetry.io/otel/schema...
GO-2026-5263 Mattermost doesn't verify channel membership when processing AI-assisted message rewrites in github.com/mattermost/mattermost-server
Mattermost doesn't verify channel membership when processing AI-assisted message rewrites in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5248 OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU in go.opentelemetry.io/obi...