GO-2025-4021 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni

Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni...

GO-2025-4088 sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls

sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls...

GO-2025-4079 Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver

Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver...

GO-2025-4084 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel

ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

GO-2025-4022 Omni vulnerable to information leak via API in github.com/siderolabs/omni

Omni vulnerable to information leak via API in github.com/siderolabs/omni...

GO-2025-4085 Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel

Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2025-4083 Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel

Zitadel May Bypass Second Authentication Factor in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...

GO-2025-4082 Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul

Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul...

GO-2025-4020 DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode

DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode...

GO-2025-4081 Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul

Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul...

GO-2025-4024 Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows

Argo Workflow may expose artifact repository credentials in github.com/argoproj/argo-workflows...

GO-2025-3999 Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd

Privilege Escalation via WebSocket Connection Hijacking in Operations API in github.com/canonical/lxd...

GO-2025-4017 Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go

Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go...

GO-2025-3987 Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers

Vulnerable to Improper Validation of Syntactic Correctness of Input in github.com/nyaruka/phonenumbers...

GO-2025-4005 Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd

Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd...

GO-2025-4000 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd

Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd...

GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd...

GO-2025-4087 Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto

Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto...

GO-2025-3988 Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail

Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail...

GO-2025-4001 Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd

Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server in github.com/canonical/lxd...

GO-2025-4002 Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd

Canonical LXD Project Existence Determination Through Error Handling in Image Export Function in github.com/canonical/lxd...

GO-2025-4044 NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector

NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector...

GO-2025-4027 Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto

Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto...

GO-2025-4038 Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs

Git LFS may write to arbitrary files via crafted symlinks in github.com/git-lfs/git-lfs...

GO-2025-4049 OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao

OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao...

GO-2025-4059 Mattermost Server: Insufficient Password-Reset Link Invalidation in github.com/mattermost/mattermost-server

Mattermost Server: Insufficient Password-Reset Link Invalidation in github.com/mattermost/mattermost-server...

GO-2025-4071 Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault...

GO-2025-4031 Guest user can discover active public channels in github.com/mattermost/mattermost-server

Guest user can discover active public channels in github.com/mattermost/mattermost-server...

GO-2025-4056 Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server...

GO-2025-4050 Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server...

GO-2025-4053 Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server

Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server...

GO-2025-4051 Mattermost Server does not enforce rate limits on password change attempts in github.com/mattermost/mattermost-server

Mattermost Server does not enforce rate limits on password change attempts in github.com/mattermost/mattermost-server...

GO-2025-4066 Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server

Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server...

GO-2025-4046 Mattermost Server is vulnerable to Uncontrolled Resource Consumption in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to Uncontrolled Resource Consumption in github.com/mattermost/mattermost-server...

GO-2025-4062 Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server

Mattermost Server exposes information stored by a web browser in github.com/mattermost/mattermost-server...

GO-2025-4039 OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao

OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2025-4036 Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server

Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server...

GO-2025-4057 Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive information via its System Console UI in github.com/mattermost/mattermost-server...

GO-2025-4040 NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird

NetBird VPN does not remove the default password of an admin account in github.com/netbirdio/netbird...

GO-2025-4043 NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector

NeuVector is shipping cryptographic material into its binary in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...

GO-2025-4072 Karmada Dashboard API Unauthorized Access Vulnerability in github.com/karmada-io/dashboard

Karmada Dashboard API Unauthorized Access Vulnerability in github.com/karmada-io/dashboard...

GO-2025-4073 Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher

Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher...

GO-2025-4074 Rancher exposes sensitive information through audit logs in github.com/rancher/rancher

Rancher exposes sensitive information through audit logs in github.com/rancher/rancher...

GO-2025-4076 Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation

Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation...

GO-2025-4064 Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server...

GO-2025-4048 Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server...

GO-2025-4070 HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault

HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault...

GO-2025-4068 Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula

Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula...

GO-2025-4054 Mattermost Server does not check if cookies are used over SSL in github.com/mattermost/mattermost-server

Mattermost Server does not check if cookies are used over SSL in github.com/mattermost/mattermost-server...

GO-2025-4033 Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol

Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol...