4692 matches found
GO-2025-3621 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...
GO-2025-3618 Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams
Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3600 Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server
Missing...
GO-2025-3595 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
GO-2025-3602 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm...
GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...
GO-2025-3598 bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta
bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta...
GO-2025-3599 bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta...
GO-2025-3594 MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio
MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio...
GO-2025-3591 Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app...
GO-2025-3563 Request smuggling due to acceptance of invalid chunked data in net/http
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...
GO-2025-3587 Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer
Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer...
GO-2025-3588 Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla
Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla...
GO-2025-3586 Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher
Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3585 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input in github.com/beego/beego
Beego allows Reflected/Stored XSS in Beego's RenderForm Function Due to Unescaped User Input in github.com/beego/beego...
GO-2025-3581 github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...
GO-2025-3584 go.rgst.io/stencil/v2 vulnerable to Path Traversal
go.rgst.io/stencil/v2 vulnerable to Path Traversal...
GO-2025-3583 Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow in github.com/NethermindEth/juno
Nethermind Juno Potential Denial of Service DoS via Integer Overflow in github.com/NethermindEth/juno...
GO-2025-3582 Ollama Denial of Service (DoS) via Null Pointer Dereference in github.com/ollama/ollama
Ollama Denial of Service DoS via Null Pointer Dereference in github.com/ollama/ollama...
GO-2025-3557 Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama
Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama...
GO-2025-3548 Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP in github.com/ollama/ollama
Ollama Vulnerable to Denial of Service DoS via Crafted GZIP in github.com/ollama/ollama...
GO-2025-3558 Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama
Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama...
GO-2025-3559 Ollama Divide By Zero vulnerability in github.com/ollama/ollama
Ollama Divide By Zero vulnerability in github.com/ollama/ollama...
GO-2025-3526 Index out-of-range panic in github.com/onosproject/onos-lib-go
Index out-of-range panic in github.com/onosproject/onos-lib-go...
GO-2025-3533 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
Improper Handling of Highly Compressed Data Data Amplification in github.com/getkin/kin-openapi/openapi3filter...
GO-2025-3540 Potential out of order responses when CLIENT SETINFO times out during connection establishment in github.com/redis/go-redis
Potential out of order responses when CLIENT SETINFO times out during connection establishment in github.com/redis/go-redis...
GO-2025-3553 Excessive memory allocation during header parsing in github.com/golang-jwt/jwt
Excessive memory allocation during header parsing in github.com/golang-jwt/jwt...
GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes
Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes...
GO-2025-3560 Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium
Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium...
GO-2025-3561 Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium
Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium...
GO-2025-3545 CVE-2024-53348 in github.com/loxilb-io/loxilb
CVE-2024-53348 in github.com/loxilb-io/loxilb...
GO-2025-3543 WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc
This report has been withdrawn with reason: "Does not affect Go code.". https://nvd.nist.gov/vuln/detail/CVE-2025-27612 lists https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 which caused automation to flag as Go; the affected repo is https://github.com/youki-dev/you...
GO-2025-3564 ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx
ingress-nginx controller - auth secret file path traversal vulnerability in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3538 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp...
GO-2025-3566 ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx
ingress-nginx controller - configuration injection via unsanitized auth-url annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3567 ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx
ingress-nginx admission controller RCE escalation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2025-3522 Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API in k8s.io/kubernetes
Kubernetes allows Command Injection affecting Windows nodes via nodes//logs/query API in k8s.io/kubernetes...
GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3562 Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno
Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno...
GO-2025-3534 Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server
Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server...
GO-2025-3568 ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx
ingress-nginx controller - configuration injection via unsanitized mirror annotations in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server...
GO-2025-3542 LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
LocalAI Cross-Site Scripting XSS vulnerability in its search functionality in github.com/mudler/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3539 OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console
OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console...
GO-2025-3520 cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) in github.com/cheqd/cheqd-node
cheqd-node Security patch for upstream vulnerabilities in IBC-Go ISA-2025-001 and Cosmos SDK ISA-2025-002 in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...
GO-2025-3536 OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive
OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability in github.com/openshift/hive...
GO-2025-3554 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin...
GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...
GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...