Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution in github.com/siyuan-note/siyuan/kernel

Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-20250619095651-9dd0b3943e55.

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool in github.com/Tencent/WeKnora

Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah

containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

# CWA-2025-006: Improper error handling may lead to IBC channel opening despite error

**Severity**

High (Considerable + Likely)[^1]

**Affected versions:**

- wasmd 0.60.0
- wasmd >= 0.51.0 < 0.55.1

**Patched versions:**

- wasmd 0.60.1, 0.55.1, 0.54.1, 0.53.3

## Description of the bug

A contract erroring during IBC channel opening does not prevent the channel from opening.

## Applying the patch

The patch will be shipped in a wasmd release. You will also have to update `libwasmvm` if you build statically.
If you already use the latest / close to latest wasmd, you can update more or less as follows:

1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd`
2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.60.1 (Cosmos SDK 0.53 compatible), 0.55.1 (Cosmos SDK 0.50 compatible), 0.54.1 or 0.53.3; `go mod tidy`; commit.
3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.60.1, 0.55.1, 0.54.1 or 0.53.3.
5. Follow your regular practices to deploy chain upgrades.

The patch is consensus breaking.

## Acknowledgement

This problem was discovered during an audit of the CosmWasm stack performed by Sherlock and funded by ICF/ICL in Q1 2025. Thank you for that work!

If you believe you have found a bug in the Interchain Stack or would like to contribute to the
program by reporting a bug, please see <https://hackerone.com/cosmos>.

## Timeline

- 2025-03-03: Auditor informs Confio about this issue.
- 2025-04-10: Confio developed the patch internally.
- 2025-06-05: Upcoming patch is announced.
- 2025-06-10: Patch is released.

[^1]: following Amulet's Severity Classification Framework ACMv1.2: <https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md>

OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.4.4.

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

Docker Swarm encrypted overlay network with a single endpoint is unauthenticated in github.com/docker/docker

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

(This report has been withdrawn with reason: "Does not affect Go code."). https://nvd.nist.gov/vuln/detail/CVE-2025-27612 lists https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 which caused automation to flag as Go; the affected repo is https://github.com/youki-dev/youki (Rust).

The go command may execute unexpected commands when operating in untrusted VCS repositories.

This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) in github.com/zitadel/zitadel

Mellium allows Authentication Bypass by Spoofing in mellium.im/xmpp

Portainer has a path traversal in backup archive extraction that allows arbitrary file write in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer from v2.33.0 before v2.33.8.

Kubewarden-Controller information leak via AdmissionPolicyGroup Resource in github.com/kubewarden/kubewarden-controller

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-32026.txt>)

### Problem Description

The NATS server by default uses a restricted set of modern ciphersuites for TLS.  This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305.

The configuration system allows for extensive use of CLI options to override configuration settings.  When using these to set a key/cert for TLS, the restricted ciphersuite settings were lost, enabling all ciphersuites supported by Go by default.

None of these additional ciphersuites are broken, so the NATS maintainers have fixed this in public git and the next release is not being hurried, nor is this security advisory embargoed.


### Affected versions

NATS Server:
 * All versions prior to 2.2.3
 * fixed with nats-io/nats-server commit ffccc2e1bd (2021-04-29)


### Impact

If a server administrator chooses to start the nats-server with TLS configuration parameters provided on the command-line, then clients can negotiate TLS ciphersuites which were not expected.


### Workaround

Use a configuration file to set the TLS parameters instead of command-line options.


### Solution

Upgrade the NATS server.


### Credits

This issue was identified and reported by SimCorp.

Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker

Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9

Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions in github.com/free5gc/nef

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator in github.com/juev/nebula-mesh

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation in github.com/nuclio/nuclio.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nuclio/nuclio before v1.15.20.

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea

Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz

gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values in github.com/gmrtd/gmrtd

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio

Improper Authentication in Kubernetes in k8s.io/kubernetes

x402 SDK Security Advisory in github.com/coinbase/x402/go.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/coinbase/x402/go before v2.5.0.

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation in github.com/gardener/external-dns-management

Tillitis TKey Client has an Error in Protocol Implementation in github.com/tillitis/tkeyclient

Path traversal in TAP 4 multirepo client allows arbitrary file write via repo names in github.com/theupdateframework/go-tuf

Mattermost Server does not neutralize HTML content in an Email template field in github.com/mattermost/mattermost-server

Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server

Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer

Nuclei: Local File Read via require() Module Loader Bypass in github.com/projectdiscovery/nuclei

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue.

ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files.

With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous.

In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct.

Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.

SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator

Incorrect Authorization in HashiCorp Consul in github.com/hashicorp/consul

Netmaker has Hardcoded DNS Secret Key in github.com/gravitl/netmaker

github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The CORS Filter feature in go-zero allows users to specify an array of domains allowed in the CORS policy. However, the isOriginAllowed function uses strings.HasSuffix to check the origin, which can lead to a bypass via a domain like "evil-victim.com". This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and retrieve data on behalf of other users.

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.2.1.

elrond-go MultiESDTNFTTransfer call on a SC address with missing function name in github.com/ElrondNetwork/elrond-go

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) in github.com/googleapis/mcp-toolbox

DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum

Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/sylabs/singularity/v4 before v4.1.11.

yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS in github.com/minio/operator.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/minio/operator before v7.1.0.

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme in github.com/gotenberg/gotenberg

The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code.

This can be caused by malicious gcc flags specified via a cgo directive.

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes in github.com/axllent/mailpit

Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token in github.com/siderolabs/omni

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect in github.com/microsoft/kiota-http-go

Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

Gnark-crypto doesn't range check input values during ECDSA and EdDSA deserialization in github.com/consensys/gnark-crypto

DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly

Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber

Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3

Improper Validation of Array Index in github.com/greenpau/caddy-security

Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox

Session data is stored using permissive permissions, allowing local users with filesystem access to read arbitrary data.

SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo

## ASA-2024-004: Default configuration param for Evidence may limit window of validity

**Component**: CometBFT
**Criticality**: Low
**Affected versions**: All
**Affected users**: Validators, Chain Builders + Maintainers

## Summary

A default configuration in CometBFT has been found to be small for common use cases, and may prevent the slashing mechanism from working in specific cases.  The default values for `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` consensus parameters may not be sufficient for common use cases to provide coverage for the entire unbonding period for a chain (`Staking.UnbondingTime`). If the conditions of both of these parameters are exceeded, evidence may be prematurely expired and considered no longer valid, potentially allowing for unpunished Byzantine behavior if evidence is discovered outside of that window.

## Next Steps for Chains and Validators

It is recommended that chain ecosystems and their maintainers set the consensus parameters `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` to values appropriate for their use case:  
- `EvidenceParams.MaxAgeDuration` (set in nanoseconds) should exceed the duration of the chain’s unbonding period
- `EvidenceParams.MaxAgeNumBlocks` should exceed the number of estimated blocks that will be produced by your chain throughout the unbonding period

For more information about evidence in CometBFT, please see: https://docs.cometbft.com/v0.37/spec/consensus/evidence.

For more information about the cosmos-sdk  `x/staking` and `x/slashing` modules, and `UnbondingTime` parameter, please see: https://docs.cosmos.network/v0.50/build/modules/staking and https://docs.cosmos.network/v0.50/build/modules/slashing.

CometBFT is designed to be configurable by chains, and implements many different configuration variables and parameters to allow chain developers, validators, node operators, and chain participants to customize it best to their use case. 

As more chains adopt the Interchain Stack for new and cutting-edge use cases, the CometBFT team recommends that all chains regularly evaluate their consensus parameters and configurations to ensure they meet the needs of their ecosystem as their networks mature. 

A Github Security Advisory for this issue is available in the [CometBFT repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-555p-m4v6-cqxv). For more information about CometBFT, see https://docs.cometbft.com/. 

This issue was reported to the Cosmos Bug Bounty Program on HackerOne on February 15, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.


gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf

Unbounded memory consumption in github.com/ethereum/go-ethereum

In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

flagd: Multiple Go Runtime CVEs Impact Security and Availability in github.com/open-feature/flagd/core

SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark in github.com/siyuan-note/siyuan/kernel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.6.2.

usememos/memos Improper Access Control vulnerability in github.com/usememos/memos

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate

OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes in github.com/OliveTin/OliveTin

Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.44.3, from v2.45.0 before v2.45.1.

OpenFGA Authorization Bypass in github.com/openfga/openfga

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Mattermost Server is vulnerable to Uncontrolled Resource Consumption in github.com/mattermost/mattermost-server

Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats

Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server

Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git

OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao-plugins before v0.1.1.

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

Insufficient address encoding when passing mail addresses to the SMTP client in github.com/wneessen/go-mail

Secret values can be printed to the --debug log when using a a custom publisher.

Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

omec-project amf crashes when processing malformed LocationReports in github.com/omec-project/amf

Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer before v2.20.2.

CVE ID↕	Published↕	CVSS↑
GO-2025-4190	Dec 8, 2025	N/A
GO-2026-5357	Jun 25, 2026	N/A
GO-2025-3901	Aug 29, 2025	N/A
GO-2026-4340	Jan 28, 2026	N/A
GO-2026-4641	Mar 10, 2026	N/A
GO-2025-3414	Jan 28, 2025	N/A
GO-2022-0803	Aug 21, 2024	N/A
GHSA-79xg-q4qm-7v9w	Jun 11, 2025	N/A
GO-2025-4156	Nov 25, 2025	N/A
GO-2026-4283	Jan 12, 2026	N/A
GO-2023-1701	Aug 20, 2024	N/A
GO-2026-5103	Jun 25, 2026	N/A
GO-2025-3543	Mar 25, 2025	N/A
GO-2025-3828	Jul 29, 2025	N/A
GO-2026-5768	Jun 25, 2026	N/A
GO-2024-3157	Sep 26, 2024	N/A
GO-2026-5498	Jul 7, 2026	N/A
GO-2025-3435	Feb 4, 2025	N/A
GHSA-jj54-5q2m-q7pj	May 14, 2024	N/A
GO-2024-2999	Aug 6, 2024	N/A
GO-2026-4390	Feb 2, 2026	N/A
GO-2025-3416	Jan 28, 2025	N/A
GO-2026-5142	Jun 25, 2026	N/A
GO-2026-5778	Jul 7, 2026	N/A
GO-2026-5586	Jun 25, 2026	N/A
GO-2026-4598	Mar 10, 2026	N/A
GO-2026-6060	Jul 27, 2026	N/A
GO-2025-3922	Sep 17, 2025	N/A
GO-2026-4379	Feb 2, 2026	N/A
GO-2026-5284	Jun 25, 2026	N/A
GO-2022-0885	Aug 21, 2024	N/A
GO-2026-4647	Mar 10, 2026	N/A
GO-2025-3697	May 23, 2025	N/A
GO-2026-4728	Mar 23, 2026	N/A
GO-2026-4377	Feb 2, 2026	N/A
GO-2026-4317	Jan 23, 2026	N/A
GO-2026-4479	Feb 19, 2026	N/A
GO-2026-5311	Jun 25, 2026	N/A
GO-2023-1716	Aug 20, 2024	N/A
GO-2026-4965	May 20, 2026	N/A
GO-2026-5606	Jul 24, 2026	N/A
GO-2023-1569	Feb 21, 2023	N/A
GO-2025-3362	Jan 7, 2025	N/A
GO-2026-4996	May 20, 2026	N/A
GO-2022-0874	Aug 21, 2024	N/A
GO-2023-2022	Aug 21, 2024	N/A
GO-2025-3581	Apr 1, 2025	N/A
GO-2024-2604	Mar 11, 2024	N/A
GO-2026-4847	Mar 26, 2026	N/A
GO-2022-0970	Aug 21, 2024	N/A
GO-2026-5706	Jun 25, 2026	N/A
GO-2022-0456	Aug 21, 2024	N/A
GO-2025-4177	Dec 8, 2025	N/A
GO-2026-5980	Jul 17, 2026	N/A
GO-2025-3637	Apr 22, 2025	N/A
GO-2025-3503	Mar 12, 2025	N/A
GO-2026-5014	May 22, 2026	N/A
GO-2025-4265	Dec 30, 2025	N/A
GO-2026-5395	Jun 25, 2026	N/A
GO-2022-0476	Jul 28, 2022	N/A
GO-2026-5376	Jun 25, 2026	N/A
GO-2026-5160	Jun 25, 2026	N/A
GO-2026-5224	Jun 25, 2026	N/A
GO-2025-3995	Oct 23, 2025	N/A
GO-2025-4027	Oct 30, 2025	N/A
GO-2025-3973	Sep 24, 2025	N/A
GO-2026-5585	Jul 24, 2026	N/A
GO-2024-2575	Jun 4, 2024	N/A
GO-2024-2564	Jun 28, 2024	N/A
GO-2026-5369	Jun 25, 2026	N/A
GO-2021-0084	Apr 14, 2021	N/A
GO-2024-2940	Jun 28, 2024	N/A
GHSA-555p-m4v6-cqxv	Feb 28, 2024	N/A
GO-2025-3607	Apr 22, 2025	N/A
GO-2023-2046	Oct 25, 2023	N/A
GO-2026-4788	Mar 23, 2026	N/A
GO-2024-2609	Mar 5, 2024	N/A
GO-2026-4279	Jan 12, 2026	N/A
GO-2026-5318	Jun 25, 2026	N/A
GO-2022-1263	Aug 21, 2024	N/A
GO-2026-5918	Jul 7, 2026	N/A
GO-2026-5264	Jun 25, 2026	N/A
GO-2025-4045	Oct 30, 2025	N/A
GO-2025-4237	Dec 15, 2025	N/A
GO-2026-4622	Mar 10, 2026	N/A
GO-2025-3492	Mar 3, 2025	N/A
GO-2024-2637	Jun 5, 2024	N/A
GO-2022-1099	Aug 21, 2024	N/A
GO-2026-5885	Jul 24, 2026	N/A
GO-2025-4046	Oct 30, 2025	N/A
GO-2026-4360	Mar 10, 2026	N/A
GO-2024-2648	Jun 4, 2024	N/A
GO-2026-5496	Jul 7, 2026	N/A
GO-2025-4067	Oct 30, 2025	N/A
GO-2026-5905	Jul 7, 2026	N/A
GO-2025-3988	Nov 5, 2025	N/A
GO-2024-2482	Feb 13, 2024	N/A
GO-2025-4127	Nov 17, 2025	N/A
GO-2026-5087	Jun 25, 2026	N/A
GO-2024-3172	Oct 9, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.