SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel

Improper Authentication in Capsule Proxy in github.com/clastix/capsule-proxy

The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability.

Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.

gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey

Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env

Traefik's errors middleware by default forwards all original request headers to the error page service. If the error page service is in a separate trust domain, this can lead to the disclosure of sensitive information such as Authorization or Cookie headers.

The fix adds an errorRequestHeaders option to the Errors middleware, allowing users to explicitly list which headers should be forwarded.

HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. An untrusted request can cause the server to allocate large amounts of memory resulting in a denial of service.

Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v5.3.0 before v8.3.10, from v8.4.0 before v8.4.10, from v8.5.0 before v8.5.9, from v9.0.0 before v9.0.3.

# x/crisis does NOT cause chain halt

### Impact
If an invariant check fails on a Cosmos SDK network and a transaction is sent to the `x/crisis` module to halt the chain, the chain does not halt. All versions of the `x/crisis` module is affected on all versions of the Cosmos SDK.

### Details
The `x/crisis` module is supposed to allow anyone to halt a chain in the event of a violated invariant by sending a `MsgVerifyInvariant` with the name of the invariant. Processing this message is supposed to cause the nodes to panic. However, because the panic is within a transaction, it is caught by the SDK’s built-in panic-recovery machinery and just treated as a normal “invalid” transaction (ie. it returns a non-zero abci Code). Thus the `x/crisis` transactions don’t actually cause chains to halt. If there is an invariant violation, it can be confirmed with an `x/crisis` transaction, but it won’t cause any nodes to halt, they will just continue processing blocks.

That said, any node running with `start --inv-check-period X` will actually panic when it runs the periodic check (though it will still not panic just by processing an `x/crisis` transaction). Since this panic is located in EndBlock, it is not caught by the panic-recovery machinery and does actually crash the node. Presumably few if any nodes actually run with this in production because of how long the invariant checks take, and this runs all of them every `X` blocks.

### Patches
No patches will be released.

The `x/crisis` module was originally intended to allow chains to halt rather than continue with some unknown behaviour in the case of an invariant violation (safety over liveness). However, as chains mature, and especially as the potential [cost of halting increases](https://github.com/osmosis-labs/osmosis/issues/570), chains should consider carefully what invariants they really want to halt for, and what invariants are just sort of helpful sanity checks, but may not be worth halting for.

In some cases, chains have already broken the invariant calculations but have dealt with the consequences off-chain or during development. Halting these chains would be counter-productive.

The SDK team is working on new modules that allow chain developers to fine-tune the chain invariants and the necessary actions.

Hence, the decision was made that the `x/crisis` module will not be patched for chain halts. The module will be deprecated when new modules take over its responsibilities.

### Workarounds
In case of a valid invariant check failure that requires a chain halt, the network validators are encouraged to coordinate off-chain for network halts. This has been an already established process for security patches.

### References
SDK developer epic about invariant checking: https://github.com/cosmos/cosmos-sdk/issues/15706
Public report: https://github.com/cosmos/cosmos-sdk/issues/15325

QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api

Juju allows arbitrary executable uploads via authenticated endpoint without authorization in github.com/juju/juju.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/juju/juju before v0.0.0-20250619215741-4034aa13c7cf.

A ZipSlip vulnerability exists when using the fileutil package to unzip files.

If the file authentication backend is being used, the ewatch option is set to true, the refresh interval is configured to a non-disabled value, and an administrator changes a user's groups, then that user may be able to access resources that their previous groups had access to.

Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories in code.gitea.io/gitea

Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v4.0.0-rc.1 before v4.7.1.

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display in github.com/prometheus/prometheus

Flux controllers are vulnerable to a denial of service attack.

Users that have permissions to change Flux's objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout (and structured variations of these fields), causing the entire object type to stop being processed.

The issue has two root causes: a) the Kubernetes type metav1.Duration is not fully compatible with the Go type time.Duration as explained in https://github.com/kubernetes/apimachinery/issues/131, and b) a lack of validation within Flux to restrict allowed values.

ReverseProxy can panic after encountering a problem copying a proxied response body.

HashiCorp Consul vulnerable to Origin Validation Error in github.com/hashicorp/consul

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

The bluemonday HTML sanitizer can leak the contents of a "style" element into HTML output, potentially causing XSS vulnerabilities.

The default bluemonday sanitization policies are not vulnerable. Only user-defined policies allowing "select", "style", and "option" elements are affected.

Permitting the "style" element in policies is hazardous, because bluemonday does not contain a CSS sanitizer. Newer versions of bluemonday suppress "style" and "script" elements even when allowed by a policy unless the policy explicitly requests unsafe processing.

Velocidex Velociraptor has an Incorrect Authorization issue in www.velocidex.com/golang/velociraptor

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack.

**What did you expect to see?**
I expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)

I would generate salt per tenant at least (maybe per organization).

When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service.

Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/forceu/gokapi before v2.0.0.

Previously, if MultiScalarMult was invoked on an initialized point who was not the identity point, MultiScalarMult produced an incorrect result. If called on an uninitialized point, MultiScalarMult exhibited undefined behavior.

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/chaos-mesh/chaos-mesh before v2.7.3.

WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora

Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel

Name: ISA-2025-001: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt
Component: IBC-Go
Criticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))
Affected versions: IBC-Go >= v7; Earlier IBC-Go versions MAY also be affected.
Affected users: Validators, Full nodes, IBC Middleware authors

### Description

An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain. The following patch is in addition to the previous patch which now extends the same protection to all applications beyond transfer.

### Patches

The new IBC-Go releases below address this issue:

* [v7.10.0](https://github.com/cosmos/ibc-go/releases/tag/v7.10.0)
* [v8.7.0](https://github.com/cosmos/ibc-go/releases/tag/v8.7.0)

### Workarounds

To prevent this state from being introduced to a chain, it is possible to permission Channel Opening as a workaround.

### Notes on Re-Release

This is an extension of the previous patch, please update to the latest patch to get full coverage against the reported issue.

#### Is this state breaking?

This patch is not state breaking unless an exploit is submitted before the patch is applied across the network in which case the chain will halt just as if it was unpatched. Thus, you can safely apply this patch in a rolling manner and encourage validators to patch as soon as possible in order to prevent any chain halts (and we've already cut new versions of these for you).

#### Testing we have done to gain more confidence in this release
* In addition to testing ibc-go, we also did the following:
* Tested PFM v7 and v8 after bumping dependencies
* Tested ibc-hooks v7 and v8 after bumping dependencies
* Ran a patched node on Cosmos Hub Mainnet and triggered failing and successful transactions that used PFM
* Ran a patched node on Osmosis mainnet and triggered failing and successful transactions that used ibc-hooks
This is a more thorough process than before, so we have higher confidence.

This issue was reported to the Cosmos Bug Bounty Program by swelf19 on HackerOne on February 18, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

If you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.  

A Github Security Advisory for this issue is available in the IBC-Go [repository](https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v).

Monitoring is vulnerable to Archive Slip due to missing checks in sanitization in github.com/ctfer-io/monitoring

An attacker can craft malicious WebSocket frames that cause an integer overflow in a variable which tracks the number of bytes remaining. This may cause the server or client to get stuck attempting to read frames in a loop, which can be used as a denial of service vector.

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL in github.com/authorizerdev/authorizer

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails in github.com/cloudreve/Cloudreve

When decrypting JsonWebEncryption objects with multiple recipients
or JsonWebSignature objects with multiple signatures the Decrypt
and Verify methods do not indicate which recipient or signature was
valid. This may lead a caller to rely on protected headers from an
invalid recipient or signature.


SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) in github.com/siyuan-note/siyuan/kernel

SiYuan has a Full-Read SSRF via /api/network/forwardProxy in github.com/siyuan-note/siyuan/kernel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.6.0.

Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security

Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage in github.com/devtron-labs/devtron

OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent in go.opentelemetry.io/obi

Exposure of server configuration in github.com/go-vela/server in github.com/go-vela/compiler

Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd

Memory Exhaustion in Expr Parser with Unrestricted Input in github.com/expr-lang/expr

Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection in github.com/gotenberg/gotenberg

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.2.1.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace in github.com/shellhub-io/shellhub

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server

There is a potential vulnerability in Traefik managing HTTP/3 connections.

More details in the [CVE-2024-53259](https://nvd.nist.gov/vuln/detail/CVE-2024-53259).

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.15
- https://github.com/traefik/traefik/releases/tag/v3.2.2

## Workarounds

No workaround

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras

Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-20250729073403-517ae758cd02.

Authorization bypasses in multiple APIs in go.etcd.io/etcd

In rclone serve restic, the WithRemote middleware fails to properly sanitize URL paths beginning with "../" or containing ".". Because path.Clean preserves leading parent directory components in relative paths, requests with leading traversal sequences bypass validation. On affected backends (such as WebDAV, FTP, SFTP, HTTP, and memory), an attacker with access to the REST endpoint can read, create, overwrite, or delete objects outside the configured root directory.

Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost

NeuVector admin account has insecure default password in github.com/neuvector/neuvector.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/neuvector/neuvector from v5.0.0 before v5.4.6.

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery in github.com/enchant97/note-mark/backend

HTTP handlers provide unauthenticated access to the local filesystem.

The Bleve http package is intended for demonstration purposes and contains no authentication, authorization, or validation of user inputs. Exposing handlers from this package can permit attackers to create files and delete directories.

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw

Mattermost Server is vulnerable to DoS through maliciously crafted posts in github.com/mattermost/mattermost-server

lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit

CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/cubefs/cubefs before v3.3.1.

An attacker can cause its peer to run out of memory by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate.

Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service in gitea.dev

Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui

Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server

Gitea Remote Code Execution (RCE) in code.gitea.io/gitea

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser

Information Exposure in jaeger in github.com/jaegertracing/jaeger

OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR in go.opentelemetry.io/obi

notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei

Gitea: Open Redirect via redirect_to in code.gitea.io/gitea

OpenBao leaks HTTPRawBody in Audit Logs in github.com/openbao/openbao

Croc may expose secret to local users in github.com/schollz/croc

Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS in github.com/getkin/kin-openapi

SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev

Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer from v2.39.0 before v2.39.4, from v2.40.0 before v2.43.0.

Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Protections against directory traversal during archive extraction can be bypassed by chaining multiple symbolic links within the archive. This allows a malicious attacker to cause files to be created outside of the target directory. Additionally if the attacker is able to read extracted files they may create symbolic links to arbitrary files on the system which the unpacker has permissions to read.

CVE ID↕	Published↕	CVSS↑
GO-2026-6663	Oct 7, 2026	N/A
GO-2022-0329	Aug 21, 2024	N/A
GO-2023-1860	Jun 15, 2023	N/A
GO-2024-2593	Jun 28, 2024	N/A
GO-2025-4174	Dec 2, 2025	N/A
GO-2025-3702	May 23, 2025	N/A
GO-2026-5532	Aug 11, 2026	N/A
GO-2024-2821	May 10, 2024	N/A
GO-2024-2852	Jun 5, 2024	N/A
GHSA-qfc5-6r3j-jj22	Jun 2, 2023	N/A
GO-2026-5652	Jun 25, 2026	N/A
GO-2025-3805	Jul 28, 2025	N/A
GO-2022-1114	Dec 7, 2022	N/A
GO-2024-2744	Apr 26, 2024	N/A
GO-2024-3319	Dec 10, 2024	N/A
GO-2026-6046	Jul 22, 2026	N/A
GO-2025-3550	Mar 25, 2025	N/A
GO-2026-5435	Jul 24, 2026	N/A
GO-2025-4210	Dec 15, 2025	N/A
GO-2026-5381	Jun 25, 2026	N/A
GO-2022-1071	Oct 28, 2022	N/A
GO-2021-0245	Feb 17, 2022	N/A
GO-2023-1853	Aug 20, 2024	N/A
GO-2026-5196	Jun 25, 2026	N/A
GO-2022-0588	Aug 15, 2022	N/A
GO-2026-4997	May 20, 2026	N/A
GO-2020-0047	Apr 14, 2021	N/A
GHSA-g636-q5fc-4pr7	May 24, 2021	N/A
GO-2024-2826	May 10, 2024	N/A
GO-2025-3737	Jun 3, 2025	N/A
GO-2026-4503	Feb 17, 2026	N/A
GO-2025-3951	Sep 17, 2025	N/A
GO-2026-4292	Jan 12, 2026	N/A
GO-2022-0855	Aug 21, 2024	N/A
GO-2026-6632	Oct 7, 2026	N/A
GHSA-4wf3-5qj9-368v	Mar 12, 2025	N/A
GO-2026-4712	Mar 26, 2026	N/A
GO-2020-0019	Apr 14, 2021	N/A
GO-2026-5959	Jul 17, 2026	N/A
GO-2026-6067	Jul 27, 2026	N/A
GO-2026-5842	Jul 7, 2026	N/A
GO-2026-6098	Aug 18, 2026	N/A
GO-2020-0011	Apr 14, 2021	N/A
GO-2025-4269	Jan 12, 2026	N/A
GO-2026-4993	May 20, 2026	N/A
GO-2026-4685	Mar 12, 2026	N/A
GO-2024-3121	Sep 6, 2024	N/A
GO-2026-4416	Feb 5, 2026	N/A
GO-2026-5714	Jun 25, 2026	N/A
GO-2022-0838	Aug 21, 2024	N/A
GO-2025-4000	Nov 5, 2025	N/A
GO-2025-3525	Mar 18, 2025	N/A
GO-2022-1135	Aug 21, 2024	N/A
GO-2026-6423	Sep 10, 2026	N/A
GO-2026-5151	Jun 25, 2026	N/A
GO-2026-4847	Mar 26, 2026	N/A
GO-2026-6089	Aug 13, 2026	N/A
GO-2026-5453	Jun 25, 2026	N/A
GO-2026-6483	Sep 28, 2026	N/A
GHSA-hxr6-2p24-hf98	Dec 17, 2024	N/A
GO-2024-3025	Aug 6, 2024	N/A
GO-2026-6317	Sep 2, 2026	N/A
GO-2025-3380	Jan 9, 2025	N/A
GO-2025-3950	Sep 17, 2025	N/A
GO-2026-4806	Apr 7, 2026	N/A
GO-2026-6184	Aug 18, 2026	N/A
GO-2026-4479	Feb 19, 2026	N/A
GO-2025-4256	Dec 30, 2025	N/A
GO-2025-3918	Sep 8, 2025	N/A
GO-2026-5567	Jun 25, 2026	N/A
GO-2022-0470	Jul 15, 2022	N/A
GO-2026-6443	Sep 15, 2026	N/A
GO-2025-3925	Sep 8, 2025	N/A
GO-2026-4300	Jan 13, 2026	N/A
GO-2023-2398	Aug 21, 2024	N/A
GO-2026-6272	Aug 25, 2026	N/A
GO-2024-2432	Jun 28, 2024	N/A
GO-2024-2682	Apr 5, 2024	N/A
GO-2025-4030	Oct 30, 2025	N/A
GO-2025-3963	Sep 24, 2025	N/A
GO-2026-6064	Jul 27, 2026	N/A
GO-2026-5521	Jun 25, 2026	N/A
GO-2025-3481	Mar 3, 2025	N/A
GO-2022-0844	Aug 21, 2024	N/A
GO-2026-5156	Jun 25, 2026	N/A
GO-2022-0834	Aug 21, 2024	N/A
GO-2026-5253	Jun 25, 2026	N/A
GO-2025-3382	Jan 14, 2025	N/A
GO-2026-6575	Oct 1, 2026	N/A
GO-2026-5448	Jun 25, 2026	N/A
GO-2025-4049	Oct 30, 2025	N/A
GO-2023-2069	Aug 21, 2024	N/A
GO-2025-3831	Aug 11, 2025	N/A
GO-2026-6274	Aug 25, 2026	N/A
GO-2024-3283	Nov 21, 2024	N/A
GO-2026-6058	Jul 27, 2026	N/A
GO-2026-6324	Sep 2, 2026	N/A
GO-2025-4018	Oct 23, 2025	N/A
GO-2025-3621	Apr 22, 2025	N/A
GO-2021-0094	Apr 14, 2021	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.