4632 matches found
GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...
GO-2026-6515 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose...
GO-2026-6521 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule...
GO-2026-6487 emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core
emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core...
GO-2026-6516 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this i...
GO-2026-6486 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha
Nezha: OAuth2 redirecturi Host header injection regression when dashboardhost is empty in github.com/nezhahq/nezha...
GO-2026-6542 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2026-6520 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule...
GO-2026-6488 OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga
OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected and with another relation that also grants that user in github.com/openfga/openfga...
GO-2026-6527 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot...
GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana
Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server
Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...
GO-2026-6480 Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler in github.com/mattermost/mattermost-server
Mattermost doesn't enforce administrator authorization on the setDefaultInstance call within the /gitlab connect command handler in github.com/mattermost/mattermost-server...
GO-2026-6481 Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server
Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server...
GO-2026-6537 nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition
nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition...
GO-2026-6519 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule
Capsule: hostnameRegexHandler.OnUpdate validates stale old Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule...
GO-2026-6518 Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses
Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses...
GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition
nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...
GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...
GO-2026-6544 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6535 Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet
Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet...
GO-2026-6529 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-6514 Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses...
GO-2026-6490 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends in github.com/centrifugal/centrifugo
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends in github.com/centrifugal/centrifugo...
GO-2026-6540 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-6506 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns...
GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp
kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...
GO-2026-6543 Canonical ADSys Uses a Less Trusted Source in github.com/ubuntu/adsys
Canonical ADSys Uses a Less Trusted Source in github.com/ubuntu/adsys. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugges...
GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot...
GO-2026-6526 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive...
GO-2026-6530 Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot...
GO-2026-6522 Obot: Server-Side Request Forgery via remote MCP server URL in github.com/obot-platform/obot
Obot: Server-Side Request Forgery via remote MCP server URL in github.com/obot-platform/obot...
GO-2026-6483 Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server
Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server...
GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses
Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...
GO-2026-6538 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit
k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit...
GO-2026-6507 CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns
CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns...
GO-2026-6485 Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker
Netmaker has a boolean‑based SQL Injection in github.com/gravitl/netmaker...
GO-2026-6508 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc...
GO-2026-6541 Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana
Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2026-6453 Unbounded memory allocation via streaming row reader in github.com/xuri/excelize
In github.com/xuri/excelize/v2, the streaming worksheet reader used by Rows and GetRows does not enforce the maximum row limit TotalRows on row "r" attributes. A crafted spreadsheet with an out-of-bounds row index causes GetRows to allocate empty row slices up to the specified row number, leading...
GO-2026-6452 Panic via negative shared-string index in github.com/xuri/excelize
In github.com/xuri/excelize/v2, parsing a spreadsheet cell with a negative shared-string index causes a runtime panic. The shared-string lookup in xlsxC.getValueFrom checks only the upper bound of the parsed index against the shared-string slice length, causing negative indices such as -1 to bypa...
GO-2026-6464 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone...
GO-2026-6462 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone...
GO-2026-6457 rclone: source object names can escape the configured root on upload in github.com/rclone/rclone
rclone: source object names can escape the configured root on upload in github.com/rclone/rclone...
GO-2026-6459 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone
rclone: Directory metadata chmod/chown/chtimes applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone...
GO-2026-6460 rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone
rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone...
GO-2026-6458 rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone
rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone...
GO-2026-6461 rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone
rclone local: crafted Range request against a translated symlink panics DoS in github.com/rclone/rclone...
GO-2026-6463 rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone
rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone...