4692 matches found
GO-2025-3679 OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey
OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey...
GO-2025-3688 Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil
Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil...
GO-2025-3672 goshs route not protected, allows command execution in github.com/patrickhener/goshs
goshs route not protected, allows command execution in github.com/patrickhener/goshs...
GO-2025-3686 Babylon Finality Provider `MsgCommitPubRandList` replay attack in github.com/babylonlabs-io/babylon
Babylon Finality Provider MsgCommitPubRandList replay attack in github.com/babylonlabs-io/babylon...
GO-2025-3671 ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel
ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest ...
GO-2025-3678 Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring
Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring...
GO-2025-3689 Ollama Divide by Zero Vulnerability in github.com/ollama/ollama
Ollama Divide by Zero Vulnerability in github.com/ollama/ollama...
GO-2025-3683 Vulnerable to CSRF due to non-functional same-origin request checks in github.com/justinas/nosurf
Vulnerable to CSRF due to non-functional same-origin request checks in github.com/justinas/nosurf...
GO-2025-3665 Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget
Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget...
GO-2025-3662 Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault...
GO-2025-3661 Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor...
GO-2025-3656 Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano...
GO-2025-3663 Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault...
GO-2025-3660 OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa
OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa...
GO-2025-3652 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements in github.com/kyverno/kyverno...
GO-2025-3645 Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes
Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes...
GO-2025-3650 Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake
Go Snowflake Driver has race condition checking access to Easy Logging config file in github.com/snowflakedb/gosnowflake...
GO-2025-3649 Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet
Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet...
GO-2025-3647 Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher
Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3648 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle MitM attacks in github.com/rancher/stev. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3646 CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s
CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3644 Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3642 Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2025-3643 Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks
Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3640 Memory exhaustion in github.com/vbatts/tar-split
Memory exhaustion in github.com/vbatts/tar-split...
GO-2025-3639 Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju
Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju...
GO-2025-3638 ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls
Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version e.g., TLS 1.2...
GO-2025-3630 GoBGP does not properly check the input length in github.com/osrg/gobgp
GoBGP does not properly check the input length in github.com/osrg/gobgp...
GO-2025-3633 GoBGP does not verify that the input length in github.com/osrg/gobgp
GoBGP does not verify that the input length in github.com/osrg/gobgp...
GO-2025-3632 GoBGP crashes in the flowspec parser in github.com/osrg/gobgp
GoBGP crashes in the flowspec parser in github.com/osrg/gobgp...
GO-2025-3631 GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp
GoBGP panics due to a zero value for softwareVersionLen in github.com/osrg/gobgp...
GO-2025-3623 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3634 Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik
Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik...
GO-2025-3637 Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3627 Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik
Traefik affected by Go HTTP Request Smuggling Vulnerability in github.com/traefik/traefik...
GO-2025-3625 cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps
cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps...
GO-2025-3635 In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium...
GO-2025-3636 one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api
one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api...
GO-2025-3607 gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf
gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf...
GO-2025-3615 Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno...
GO-2025-3604 Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Proper Access Controls on /api/v4/audits Endpoint in github.com/mattermost/mattermost-server...
GO-2025-3622 Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server
Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server...
GO-2025-3620 Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server
Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server...
GO-2025-3608 Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events...
GO-2025-3610 Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server
Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server...
GO-2025-3609 Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server...
GO-2025-3611 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3619 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...