4692 matches found
GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome
Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...
GO-2025-3476 Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk
Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk...
GO-2025-3462 Unencrypted transmission in Temporal api-go library in go.temporal.io/api
Unencrypted transmission in Temporal api-go library in go.temporal.io/api...
GO-2025-3485 DoS in go-jose Parsing in github.com/go-jose/go-jose
DoS in go-jose Parsing in github.com/go-jose/go-jose...
GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...
GO-2025-3487 Potential denial of service in golang.org/x/crypto
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
GO-2025-3458 SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo
SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3456 WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core
WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core...
GO-2025-3457 WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core
WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core...
GO-2025-3428 Arbitrary code execution during build on darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...
GO-2025-3447 Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private...
GO-2025-3448 Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm
Malicious smart contract can crash the chain in github.com/CosmWasm/wasmvm...
GO-2025-3449 wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm
wasmvm: Malicious smart contract can slow down block production in github.com/CosmWasm/wasmvm...
GO-2025-3450 MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun
MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun...
GO-2025-3455 Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast
Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast...
GO-2025-3454 Plenti - Code Injection - Denial of Services in github.com/plentico/plenti
Plenti - Code Injection - Denial of Services in github.com/plentico/plenti...
GO-2025-3451 Vulnerability in github.com/boltdb-go/bolt
This module is a malicious typosquat, attempting to take advantage of confusion with the github.com/boltdb/bolt module...
GO-2025-3442 CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft
CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft...
GO-2025-3443 CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft
CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft...
GO-2025-3445 Ability to view Agent list with no privilege access in wazuh-dashboard in github.com/wazuh/wazuh
Ability to view Agent list with no privilege access in wazuh-dashboard in github.com/wazuh/wazuh...
GO-2025-3437 Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine
Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2025-3431 kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest
kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest...
GO-2025-3433 Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd
Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd...
GO-2025-3434 KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources in github.com/kubewarden/kubewarden-controller
KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources in github.com/kubewarden/kubewarden-controller...
GO-2025-3438 Grafana Alerting VictorOps integration could be exposed to users with Viewer permission in github.com/grafana/grafana
Grafana Alerting VictorOps integration could be exposed to users with Viewer permission in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3444 Improper Access Control in wazuh-agent in github.com/wazuh/wazuh
Improper Access Control in wazuh-agent in github.com/wazuh/wazuh...
GO-2025-3436 Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum
Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum...
GO-2025-3435 Kubewarden-Controller information leak via AdmissionPolicyGroup Resource in github.com/kubewarden/kubewarden-controller
Kubewarden-Controller information leak via AdmissionPolicyGroup Resource in github.com/kubewarden/kubewarden-controller...
GO-2025-3412 Excessive resource consumption when unmarshalling Compose file with recursive loop in github.com/compose-spec/compose-go/v2
Excessive resource consumption when unmarshalling Compose file with recursive loop in github.com/compose-spec/compose-go/v2...
GO-2025-3408 WITHDRAWN: DefaultConfig has dangerous defaults causing hung Read in github.com/hashicorp/yamux
This report has been withdrawn with reason: "By request of maintainer in https://github.com/golang/vulndb/issues/3453". The default values for Session.config.KeepAliveInterval and Session.config.ConnectionWriteTimeout of 30s and 10s create the possibility for timed out writes that most aren't...
GO-2025-3427 Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator
Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator...
GO-2025-3426 CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o...
GO-2025-3424 Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x
Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2025-3422 imgproxy is vulnerable to SSRF against 0.0.0.0 in github.com/imgproxy/imgproxy
imgproxy is vulnerable to SSRF against 0.0.0.0 in github.com/imgproxy/imgproxy...
GO-2025-3414 Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah...
GO-2025-3409 Zot IdP group membership revocation ignored in zotregistry.dev/zot
Zot IdP group membership revocation ignored in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2025-3415 DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium
DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium...
GO-2025-3419 Updatecli exposes Maven credentials in console output in github.com/updatecli/updatecli
Updatecli exposes Maven credentials in console output in github.com/updatecli/updatecli...
GO-2025-3413 HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug
HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug...
GO-2025-3416 Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium
Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium...
GO-2025-3410 Insecure default config access in WriteFreely in github.com/writefreely/writefreely
Insecure default config access in WriteFreely in github.com/writefreely/writefreely...
GO-2025-3418 Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway
Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway...
GO-2025-3372 Vulnerability when creating log files in github.com/golang/glog
When logs are written to a widely-writable directory the default, an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that...
GO-2025-3383 GOAUTH credential leak in cmd/go
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file...
GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however,...
GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs...
GO-2025-3421 ParsePKCS1PrivateKey panic with partial keys in crypto/x509
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...
GO-2025-3407 Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server
Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server...
GO-2025-3396 Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib
Server-Side Request Forgery SSRF on redirects and federation in github.com/matrix-org/gomatrixserverlib...