GO-2025-3937 Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos...

GO-2025-3923 Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher

Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2025-3930 Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve

Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve...

GO-2025-3925 Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw

Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw...

GO-2025-3917 NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector

NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3916 simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core

simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core...

GO-2025-3927 Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet...

GO-2025-3884 Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...

GO-2025-3912 Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark

Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark...

GO-2025-3900 Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure

Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure...

GO-2025-3892 HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter

HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter...

GO-2025-3905 Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server

Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server...

GO-2025-3894 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2025-3910 Mattermost Fails to Sanitize File Names in github.com/mattermost/mattermost-server

Mattermost Fails to Sanitize File Names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2025-3909 Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel

Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel...

GO-2025-3913 traQ Allows Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ

traQ Allows Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2025-3901 Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server

Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2025-3911 Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server

Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3904 Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server

Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3895 HydrAIDE Authentication Bypass Vulnerability in github.com/hydraide/hydraide

HydrAIDE Authentication Bypass Vulnerability in github.com/hydraide/hydraide. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2025-3907 Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server

Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server...

GO-2025-3906 Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server

Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server...

GO-2025-3902 Mattermost Fails to Properly Validate Team Role Modification in github.com/mattermost/mattermost-server

Mattermost Fails to Properly Validate Team Role Modification in github.com/mattermost/mattermost-server...

GO-2025-3893 Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule...

GO-2025-3897 CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o

CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o...

GO-2025-3896 Default Credentials in nginx-defender Configuration Files in github.com/Anipaleja/nginx-defender

Default Credentials in nginx-defender Configuration Files in github.com/Anipaleja/nginx-defender...

GO-2025-3903 Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server

Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server...

GO-2025-3888 Helm May Panic Due To Incorrect YAML Content in helm.sh/helm

Helm May Panic Due To Incorrect YAML Content in helm.sh/helm...

GO-2025-3887 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm...

GO-2025-3869 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3875 Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3885 External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access in github.com/external-secrets/external-secrets...

GO-2025-3861 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3865 Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin is Missing Authentication for Critical Function in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3874 Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari

Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari...

GO-2025-3864 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3866 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3867 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3862 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3868 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3873 Komari vulnerable to 2FA Authentication Bypass in github.com/komari-monitor/komari

Komari vulnerable to 2FA Authentication Bypass in github.com/komari-monitor/komari...

GO-2025-3872 Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Improper Validation of Specified Type of Input in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3891 Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent

Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent...

GO-2025-3886 OliveTin OS Command Injection vulnerability in github.com/OliveTin/OliveTin

OliveTin OS Command Injection vulnerability in github.com/OliveTin/OliveTin...

GO-2025-3871 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3863 Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3870 Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence

Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-plugin-confluence...

GO-2025-3851 Ollama allows deletion of arbitrary files in github.com/ollama/ollama

Ollama allows deletion of arbitrary files in github.com/ollama/ollama...

GO-2025-3858 Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao

Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3856 OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao

OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...