4692 matches found
GO-2025-3978 Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards
Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards...
GO-2025-3965 Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly
Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly...
GO-2025-3972 Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly...
GO-2025-3966 Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly
Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly...
GO-2025-3974 DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly
DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly...
GO-2025-3962 esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh
esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh...
GO-2025-3968 Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly...
GO-2025-3976 Grafana-Zabbix ReDoS vulnerability in github.com/alexanderzobnin/grafana-zabbix
Grafana-Zabbix ReDoS vulnerability in github.com/alexanderzobnin/grafana-zabbix. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3973 DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly
DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly...
GO-2025-3970 DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly...
GO-2025-3963 Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly
Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly...
GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh
esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...
GO-2025-3969 DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly
DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly...
GO-2025-3964 Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly
Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly...
GO-2025-3977 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3971 DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly
DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly...
GO-2025-3955 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...
GO-2025-3956 Unexpected paths returned from LookPath in os/exec
If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", ".", and "..", can result in the binaries listed in the PATH being unexpectedly returned...
GO-2025-3915 Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes
Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes...
GO-2025-3945 WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly
WebSocket endpoint /api/v2/ws/logs reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly...
GO-2025-3953 Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server
Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server...
GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller
secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...
GO-2025-3942 CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns...
GO-2025-3954 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3950 Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3961 Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman
Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman...
GO-2025-3938 Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder
Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder...
GO-2025-3958 Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3943 listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk...
GO-2025-3952 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3941 pREST has a Systemic SQL Injection Vulnerability in github.com/prest/prest
pREST has a Systemic SQL Injection Vulnerability in github.com/prest/prest...
GO-2025-3960 Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server
Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2025-3959 Mattermost makes Use of Weak Hash in github.com/mattermost/mattermost-server
Mattermost makes Use of Weak Hash in github.com/mattermost/mattermost-server...
GO-2025-3949 Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh
Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3944 Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly...
GO-2025-3951 Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2025-3929 Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark
Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark...
GO-2025-3940 Atlantis Exposes Service Version Publicly on /status API Endpoint in github.com/runatlantis/atlantis
Atlantis Exposes Service Version Publicly on /status API Endpoint in github.com/runatlantis/atlantis...
GO-2025-3926 Harness Allows Arbitrary File Write in Gitness LFS server in github.com/harness/gitness
Harness Allows Arbitrary File Write in Gitness LFS server in github.com/harness/gitness...
GO-2025-3922 Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz
Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz...
GO-2025-3924 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault...
GO-2025-3916 simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core
simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core...
GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...
GO-2025-3918 NeuVector admin account has insecure default password in github.com/neuvector/neuvector
NeuVector admin account has insecure default password in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3936 Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos
Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos...
GO-2025-3919 NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector
NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
GO-2025-3923 Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher
Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...