GO-2025-3393 Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server

Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server...

GO-2025-3392 Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server...

GO-2025-3399 Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation in github.com/t2bot/matrix-media-repo

Matrix Media Repo MMR allows Server-Side Request Forgery SSRF on redirects and federation in github.com/t2bot/matrix-media-repo...

GO-2025-3400 Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo

Matrix Media Repo MMR allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo...

GO-2025-3397 matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo

matrix-media-repo MMR allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo...

GO-2025-3401 matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo

matrix-media-repo MMR allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo...

GO-2025-3398 matrix-media-repo (MMR) allows a denial of service through memory exhaustion in github.com/t2bot/matrix-media-repo

matrix-media-repo MMR allows a denial of service through memory exhaustion in github.com/t2bot/matrix-media-repo...

GO-2025-3390 Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs

Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs...

GO-2025-3391 Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher

Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2025-3382 notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go

notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go...

GO-2025-3381 notation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go

notation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go...

GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GO-2025-3377 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2025-3376 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset...

GO-2025-3380 Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server

Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3374 Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve

Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve...

GO-2025-3371 WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal

WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

GO-2025-3368 Argument Injection via the URL field in github.com/go-git/go-git

Argument Injection via the URL field in github.com/go-git/go-git...

GO-2025-3367 Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git...

GO-2025-3362 SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel

SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel...

GO-2024-3357 Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome

Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome...

GO-2024-3356 Path Traversal in file update API in gogs in gogs.io/gogs

Path Traversal in file update API in gogs in gogs.io/gogs...

GO-2024-3359 GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast

GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast...

GO-2025-3363 Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada

Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada...

GO-2024-3360 OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive

OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive...

GO-2025-3364 Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada

Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada...

GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs

Remote Command Execution in file editing in gogs in gogs.io/gogs...

GO-2024-3358 SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol

SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol...

GO-2025-3361 GoPhish sends cleartext passwords in github.com/gophish/gophish

GoPhish sends cleartext passwords in github.com/gophish/gophish...

GO-2024-3344 Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age

Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age...

GO-2024-3101 Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts...

GO-2024-3350 WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core

WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core...

GO-2024-3343 Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm

Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm...

GO-2024-3354 Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad

Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad...

GO-2024-3342 Traefik affected by CVE-2024-53259 in github.com/traefik/traefik

Traefik affected by CVE-2024-53259 in github.com/traefik/traefik...

GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator

The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...

GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather

OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3333 Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

GO-2024-3339 Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk

Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk...

GO-2024-3337 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server...

GO-2024-3338 Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server

Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server...

GO-2024-3340 Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server

Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server...

GO-2024-3334 Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server

Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server...

GO-2024-3335 Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary

Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary...

GO-2024-3336 MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio

MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio...

GO-2024-3331 Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego

Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego...

GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5

Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...

GO-2024-3330 Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy in github.com/ryanbekhen/nanoproxy

Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy in github.com/ryanbekhen/nanoproxy...

GO-2022-0635 In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...