4692 matches found
GO-2025-3537 OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza
OWASP Coraza WAF has parser confusion which leads to wrong URI in REQUESTFILENAME in github.com/corazawaf/coraza...
GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server...
GO-2025-3556 Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server...
GO-2025-3521 Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes
Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes...
GO-2025-3565 ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3528 containerd has an integer overflow in User ID handling in github.com/containerd/containerd
containerd has an integer overflow in User ID handling in github.com/containerd/containerd...
GO-2025-3530 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
Bare Metal Operator BMO can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis...
GO-2025-3527 buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx
buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx...
GO-2025-3529 Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive...
GO-2025-3525 Memory Exhaustion in Expr Parser with Unrestricted Input in github.com/expr-lang/expr
Memory Exhaustion in Expr Parser with Unrestricted Input in github.com/expr-lang/expr...
GO-2025-3516 Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/
Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/...
GO-2025-3517 Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go
Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go...
GO-2025-3508 LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper
LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper...
GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...
GO-2025-3515 CVE-2025-26260 in github.com/plentico/plenti
CVE-2025-26260 in github.com/plentico/plenti...
GO-2025-3511 Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify
Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify...
GO-2025-3509 Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server
Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server...
GO-2025-3512 kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver
kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3514 cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node
cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...
GO-2025-3500 In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone
In-memory stored Cross-site scripting XSS vulnerability in pineconesim in github.com/matrix-org/pinecone...
GO-2025-3463 DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware
DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware...
GO-2025-3498 Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus
Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus...
GO-2025-3499 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3505 Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet
Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3504 Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway
Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway...
GO-2025-3507 Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux
Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux...
GO-2025-3494 IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cosmos/ibc-go...
GO-2025-3461 go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative
go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative...
GO-2025-3472 SSRF in sliver teamserver in github.com/bishopfox/sliver
SSRF in sliver teamserver in github.com/bishopfox/sliver...
GO-2025-3477 S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation in github.com/oxyno-zeta/s3-proxy
S3-Proxy allows Reflected Cross-site Scripting XSS in template implementation in github.com/oxyno-zeta/s3-proxy...
GO-2025-3475 Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes
Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes...
GO-2025-3468 Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia
Authelia applies regulation separately to Username-based logins to Email-based logins in github.com/authelia/authelia...
GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...
GO-2025-3482 Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server
Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server...
GO-2025-3466 Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping
Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping...
GO-2025-3465 Node Denial of Service via kubelet Checkpoint API in k8s.io/kubernetes
Node Denial of Service via kubelet Checkpoint API in k8s.io/kubernetes...
GO-2025-3491 Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2025-3474 MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping
MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping...
GO-2025-3459 Remote code execution in Wazuh server in github.com/wazuh/wazuh
Remote code execution in Wazuh server in github.com/wazuh/wazuh...
GO-2025-3470 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3481 Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server
Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server...
GO-2025-3483 Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server
Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server...
GO-2025-3495 MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio
MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3479 lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs
lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs...
GO-2025-3480 Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server
Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server...
GO-2025-3489 Rancher's SAML-based login via CLI can be denied by unauthenticated users in github.com/rancher/rancher
Rancher's SAML-based login via CLI can be denied by unauthenticated users in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome
Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...
GO-2025-3467 `gh attestation verify` returns incorrect exit code during verification if no attestations are present in github.com/cli/cli
gh attestation verify returns incorrect exit code during verification if no attestations are present in github.com/cli/cli...