4684 matches found
GO-2026-4881 Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus...
GO-2026-4884 Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus...
GO-2026-4882 Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus...
GO-2026-4885 Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus...
GO-2026-4886 Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus...
GO-2026-4808 Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd
Nested etcd transactions bypass RBAC authorization checks in go.etcd.io/etcd...
GO-2026-4790 Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service in github.com/elastic/beats
Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service in github.com/elastic/beats...
GO-2026-4910 Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git
Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git...
GO-2026-4736 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute in github.com/osrg/gobgp
GoBGP vulnerable to a denial of service via the NEXTHOP path attribute in github.com/osrg/gobgp...
GO-2026-4772 CVE-2026-33816 in github.com/jackc/pgx
Memory-safety vulnerability in github.com/jackc/pgx/v5...
GO-2026-4738 File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser
File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser...
GO-2026-4771 CVE-2026-33815 in github.com/jackc/pgx
Memory-safety vulnerability in github.com/jackc/pgx/v5...
GO-2026-4920 KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai
KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai...
GO-2026-4923 WITHDRAWN: out-of-range-index in go.etcd.io/bbolt
This report has been withdrawn with reason: "Reporter and maintainer have confirmed this as false positive". Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt...
GO-2026-4924 Juju has a resource poisoning vulnerability in github.com/juju/juju
Juju has a resource poisoning vulnerability in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...
GO-2026-4892 A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet
A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet...
GO-2026-4902 nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval in github.com/0xJacky/Nginx-UI
nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval in github.com/0xJacky/Nginx-UI...
GO-2026-4872 Ella Core Panics during NAS Authentication Response/Failure with missing IEs in github.com/ellanetworks/core
Ella Core Panics during NAS Authentication Response/Failure with missing IEs in github.com/ellanetworks/core...
GO-2026-4888 Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet
Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4873 Ella Core has Privilege Escalation via Database Restore by NetworkManager role in github.com/ellanetworks/core
Ella Core has Privilege Escalation via Database Restore by NetworkManager role in github.com/ellanetworks/core...
GO-2026-4899 Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted in github.com/bishopfox/sliver
Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel rportfwd close is attempted in github.com/bishopfox/sliver...
GO-2026-4915 Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...
GO-2026-4880 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik...
GO-2026-4890 act: actions/cache server allows malicious cache injection in github.com/nektos/act
act: actions/cache server allows malicious cache injection in github.com/nektos/act...
GO-2026-4901 nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys in github.com/0xJacky/nginx-ui
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys in github.com/0xJacky/nginx-ui...
GO-2026-4874 Ella Core has a Denial of Service via SCTP connection cleanup deadlock in github.com/ellanetworks/core
Ella Core has a Denial of Service via SCTP connection cleanup deadlock in github.com/ellanetworks/core...
GO-2026-4894 Flannel has cross-node remote code execution via extension backend BackendData injection in github.com/flannel-io/flannel
Flannel has cross-node remote code execution via extension backend BackendData injection in github.com/flannel-io/flannel...
GO-2026-4875 Ella Core panics when processing a crafted NGAP LocationReport message in github.com/ellanetworks/core
Ella Core panics when processing a crafted NGAP LocationReport message in github.com/ellanetworks/core...
GO-2026-4914 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet...
GO-2026-4903 nginx-ui Backup Restore Allows Tampering with Encrypted Backups in github.com/0xJacky/Nginx-UI
nginx-ui Backup Restore Allows Tampering with Encrypted Backups in github.com/0xJacky/Nginx-UI...
GO-2026-4905 Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) in github.com/gotenberg/gotenberg
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme bypass of GHSA-rh2x-ccvw-q7r3 in github.com/gotenberg/gotenberg...
GO-2026-4916 Mattermost doesn't rate limit login requests, allowing DoS in github.com/mattermost/mattermost-server
Mattermost doesn't rate limit login requests, allowing DoS in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-4906 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse in github.com/0xJacky/Nginx-UI
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse in github.com/0xJacky/Nginx-UI...
GO-2026-4876 Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor
Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor...
GO-2026-4912 Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet
Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet...
GO-2026-4891 act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act
act: Unrestricted set-env and add-path command processing enables environment injection in github.com/nektos/act...
GO-2026-4907 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI...
GO-2026-4913 Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet...
GO-2026-4889 Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet
Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-4904 nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover in github.com/0xJacky/Nginx-UI
nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover in github.com/0xJacky/Nginx-UI...
GO-2026-4893 Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField in github.com/traefik/traefik
Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField in github.com/traefik/traefik...
GO-2026-4896 MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers in github.com/minio/minio...
GO-2026-4863 Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast
Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast...
GO-2026-4883 Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker...
GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker...
GO-2026-4897 Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency CVE-2026-33186 in github.com/traefik/traefik...
GO-2026-4911 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) in github.com/docker/model-runner
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery SSRF in github.com/docker/model-runner...
GO-2026-4919 Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy
On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release...