4632 matches found
GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A...
GO-2026-6186 Path traversal via local backend encoding in github.com/rclone/rclone
Path traversal via local backend encoding in github.com/rclone/rclone...
GO-2026-6165 Panic while parsing crafted ECDHE_PSK ServerKeyExchange in github.com/pion/dtls/v3
In github.com/pion/dtls/v3 before 3.1.4, MessageServerKeyExchange.Unmarshal does not verify that data remains after parsing the PSK identity hint when handling ECDHEPSK key exchange messages. A remote peer sending a crafted ServerKeyExchange message where the PSK hint consumes all remaining data...
GO-2026-6189 Path traversal in serve s3 in github.com/rclone/rclone
Path traversal in serve s3 in github.com/rclone/rclone...
GO-2026-6139 Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4
In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid...
GO-2026-6182 Command execution via PowerShell smart quotes in github.com/rclone/rclone
PowerShell treats several Unicode smart-quote characters U+2018, U+2019, U+201A, U+201B as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename wit...
GO-2026-6185 Path traversal via crafted archive paths in github.com/rclone/rclone
Path traversal via crafted archive paths in github.com/rclone/rclone...
GO-2026-6095 Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi
Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi...
GO-2026-6196 S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone
S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone...
GO-2026-6093 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk...
GO-2026-6237 Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in ...
GO-2026-6166 WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS...
GO-2026-6184 Path traversal in serve restic in github.com/rclone/rclone
In rclone serve restic, the WithRemote middleware fails to properly sanitize URL paths beginning with "../" or containing ".". Because path.Clean preserves leading parent directory components in relative paths, requests with leading traversal sequences bypass validation. On affected backends such...
GO-2026-6214 Path traversal via crafted reference names in github.com/go-git/go-git
Path traversal via crafted reference names in github.com/go-git/go-git...
GO-2026-6234 LDAP injection via unescaped username in github.com/hyperledger/fabric-ca
LDAP injection via unescaped username in github.com/hyperledger/fabric-ca...
GO-2026-6212 Gophish contains a denial of service vulnerability in github.com/gophish/gophish
Gophish contains a denial of service vulnerability in github.com/gophish/gophish...
GO-2026-6160 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...
GO-2026-6128 grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai
grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai...
GO-2026-6132 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs
goshs SFTP authentication bypass via empty password incomplete fix of CVE-2026-40884 in goshs.de/goshs...
GO-2026-6242 New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
New API: Integer overflow in quota billing yields negative charges self-crediting in github.com/QuantumNous/new-api...
GO-2026-6221 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...
GO-2026-6240 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...
GO-2026-6119 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend...
GO-2026-6131 Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks in github.com/fission/fission
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks in github.com/fission/fission...
GO-2026-6209 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik
Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik...
GO-2026-6144 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output in github.com/OliveTin/OliveTin
OliveTin: StartActionAndWait Endpoints Bypass logs Permission and Return Action Output in github.com/OliveTin/OliveTin...
GO-2026-6152 Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer
Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer...
GO-2026-6202 Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false in github.com/traefik/traefik
Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false in github.com/traefik/traefik...
GO-2026-6204 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing in github.com/traefik/traefik
Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing in github.com/traefik/traefik...
GO-2026-6224 Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API in github.com/kubev2v/migration-planner
Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API in github.com/kubev2v/migration-planner...
GO-2026-6249 Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer
Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2026-6135 openhole-server vulnerable to path traversal via URL-decoded request path in github.com/bablilayoub/openhole
openhole-server vulnerable to path traversal via URL-decoded request path in github.com/bablilayoub/openhole...
GO-2026-6159 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings...
GO-2026-6130 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape in github.com/fission/fission
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape in github.com/fission/fission...
GO-2026-6153 Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer
Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/answer...
GO-2026-6243 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api...
GO-2026-6161 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure in github.com/free5gc/ausf
free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure in github.com/free5gc/ausf...
GO-2026-6208 Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware in github.com/traefik/traefik
Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware in github.com/traefik/traefik...
GO-2026-6126 songquanpeng one-api has an issue that results in business logic errors
songquanpeng one-api has an issue that results in business logic errors. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-6120 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted file.create permissions in github.com/pterodactyl/wings...
GO-2026-6105 Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite
Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite...
GO-2026-6201 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik...
GO-2026-6230 Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket in github.com/lima-vm/lima
Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket in github.com/lima-vm/lima...
GO-2026-6127 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission...
GO-2026-6156 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings...
GO-2026-6124 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens in github.com/azukaar/cosmos-server
Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens in github.com/azukaar/cosmos-server...
GO-2026-6098 Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails in github.com/cloudreve/Cloudreve
Cloudreve: Information Exposure in GET /api/v4/user/search: SearchActive omits the active-status predicate, leaking inactive/banned account emails in github.com/cloudreve/Cloudreve...
GO-2026-6125 grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai
grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai...
GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings
Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...
GO-2026-6129 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption in github.com/fission/fission
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAPSYSTIME and cross-tenant node wall-clock corruption in github.com/fission/fission...