4632 matches found
GO-2026-6263 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code...
GO-2026-6259 Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero
Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero...
GO-2026-6254 Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS in github.com/inspektor-gadget/inspektor-gadget
Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS in github.com/inspektor-gadget/inspektor-gadget...
GO-2026-6266 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code...
GO-2026-6285 Mattermost doesn't require system-level permission when patching protected default system roles in github.com/mattermost/mattermost-server
Mattermost doesn't require system-level permission when patching protected default system roles in github.com/mattermost/mattermost-server...
GO-2026-6287 Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached contexthint in github.com/cloudreve/Cloudreve...
GO-2026-6277 netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil
netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil...
GO-2026-6271 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) in github.com/axllent/mailpit
Mailpit: WebSocket origin check bypass via percent-encoded path regression of CVE-2026-22689 in github.com/axllent/mailpit...
GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server
Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...
GO-2026-6272 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit...
GO-2026-6280 Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server
Mattermost doesn't require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server...
GO-2026-6281 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync in github.com/mattermost/mattermost-server
Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync in github.com/mattermost/mattermost-server...
GO-2026-6255 BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit
BuildKit: Custom frontend could bypass Seccomp/AppArmor in github.com/moby/buildkit...
GO-2026-6275 kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding in github.com/getkin/kin-openapi
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding in github.com/getkin/kin-openapi...
GO-2026-6256 BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit...
GO-2026-6278 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket...
GO-2026-6273 Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis...
GO-2026-6274 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS in github.com/getkin/kin-openapi
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS in github.com/getkin/kin-openapi...
GO-2026-6250 Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy...
GO-2026-6268 Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...
GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database in github.com/fleetdm/fleet
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database in github.com/fleetdm/fleet...
GO-2026-6269 Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet
Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet...
GO-2026-4720 SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel
SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...
GO-2026-4950 Authorization bypass via double-encoded paths in github.com/valyala/fasthttp
In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '' as URI delimiters. In applications where authorization guards inspect ctx.Path before passing paths to file-serving...
GO-2026-6216 Cross-forge account takeover on login in codefloe.com/crowci/crow/v6
In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an...
GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution
In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...
GO-2026-6115 WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input: - Unchecked /Size, /Index,...
GO-2026-6172 WITHDRAWN: Backend frame lengths cause pre-validation memory exhaustion in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq allocates the backend-declared PostgreSQL frame payload before applying a protocol length bound or a phase-specific message-type check. A malicious server or active networ...
GO-2026-6163 Panic on malformed XOR-MAPPED-ADDRESS attribute in github.com/pion/stun/v3
In github.com/pion/stun/v3 before 3.1.5, XORMappedAddress.GetFromAs reads the address family header from an XOR-MAPPED-ADDRESS attribute before validating the attribute length. Parsing a malformed STUN message carrying a zero-length XOR-MAPPED-ADDRESS attribute from a tightly sized buffer causes ...
GO-2026-6168 WITHDRAWN: Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The SCRAM client in github.com/lib/pq/scram accepts an attacker-controlled iteration count with no upper bound and immediately performs that many PBKDF2-style HMAC rounds. A PostgreSQL...
GO-2026-6191 Arbitrary file write via --links symlinks in github.com/rclone/rclone
Arbitrary file write via --links symlinks in github.com/rclone/rclone...
GO-2026-6112 Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi
Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi...
GO-2026-6181 Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone...
GO-2026-6095 Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi
Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi...
GO-2026-6234 LDAP injection via unescaped username in github.com/hyperledger/fabric-ca
LDAP injection via unescaped username in github.com/hyperledger/fabric-ca...
GO-2026-6169 WITHDRAWN: Disclosure of wrong .pgpass credential via hostaddr in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile...
GO-2026-6195 Authorization bypass in serve restic in github.com/rclone/rclone
Authorization bypass in serve restic in github.com/rclone/rclone...
GO-2026-6190 Unsafe file permission restoration from metadata in github.com/rclone/rclone
Unsafe file permission restoration from metadata in github.com/rclone/rclone...
GO-2026-6094 JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go
JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go...
GO-2026-6114 Watch API authorization bypass in go.etcd.io/etcd/server/v3
In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey. The Watch RPC handler normalized open-ended range ends prior to authorization...
GO-2026-6170 WITHDRAWN: Malformed backend frame length causes panic in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose...
GO-2026-6199 Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone
Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone...
GO-2026-6197 WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone
WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone...
GO-2026-6187 FTP command injection via custom encoding in github.com/rclone/rclone
FTP command injection via custom encoding in github.com/rclone/rclone...
GO-2026-6188 S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone
S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone...
GO-2026-6183 Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone
During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mount...
GO-2026-6213 Worktree operations may follow symlinks in github.com/go-git/go-git
Worktree operations may follow symlinks in github.com/go-git/go-git...
GO-2026-6238 Integer overflow in BTF parsing in github.com/cilium/ebpf
Integer overflow in BTF parsing in github.com/cilium/ebpf...
GO-2026-6173 WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString0 without a byte limit. A malicious PostgreSQL endpoint or active...