Hugo: XSS via text/html content files in github.com/gohugoio/hugo

Path Traversal in file update API in gogs in gogs.io/gogs

Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama

1Panel O&M management panel has a background arbitrary file reading vulnerability in github.com/1Panel-dev/1Panel

Rancher affected by unauthenticated Denial of Service in github.com/rancher/rancher.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/rancher/rancher from v2.9.0 before v2.9.11, from v2.10.0 before v2.10.9, from v2.11.0 before v2.11.5, from v2.12.0 before v2.12.1.

OliveTin OS Command Injection vulnerability in github.com/OliveTin/OliveTin

Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio

Rancher Access Control Vulnerability in github.com/rancher/rancher

sememos/memos vulnerable to Improper Handling of Values in github.com/usememos/memos

Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource in go.temporal.io/server

Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry

Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd

Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass in github.com/gotenberg/gotenberg

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel

Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering in github.com/mattermost/mattermost-plugin-confluence

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission

### Impact
On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.

Does not apply to ephemeral usage, such as when used in the regular way in TLS.

### Patches
Patched in 1.3.7.

### References
- [kyberslash.cr.yp.to](https://kyberslash.cr.yp.to/)

Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server

### Impact
This issue represents a potential PII concern.  If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.

### Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0

### Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.


AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql

## Withdrawn Advisory
This advisory has been withdrawn because the vulnerability affects a binary, not a library in a [supported ecosystem](https://github.com/github/advisory-database#supported-ecosystems). Therefore, users of the library should not receive alerts. This link is maintained to preserve external references.

## Original Description

### Impact
Access Lists are a new feature introduced in Teleport 14 and currently under preview. An issue was discovered that allows an Access List Owner to assign arbitrary permissions, including permissions to themselves which could result in privilege escalation.

### Patches
Fixed in version 14.2.4 and 13.4.13

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu

TLS certificate verification is skipped when connecting to a MQTT server. This allows an attacker who can MITM the connection to read, or forge, messages passed between the client and server.

### Vulnerability type
Cryptography

### Detail
The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty.

### Workarounds
By default, no action is required. If users want to specify cipher suites using the '--cipher-suites' flag, they should try not to specify insecure cipher suites. Please refer to the [security documentation](https://etcd.io/docs/v3.4/op-guide/security/).

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/main/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/main/security/security-release-process.md#product-security-committee-psc)

Cross-site Scripting in Gitea in github.com/go-gitea/gitea

IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library in github.com/google/brotli

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.

Containous Traefik Exposes Password Hashes in github.com/traefik/traefik

DoS in cert-manager-controller via Specially Crafted DNS Response in github.com/cert-manager/cert-manager

Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/gravitational/teleport before v12.4.31, from v13.0.0 before v13.4.13, from v14.0.0 before v14.2.4.

Encryption bypass in github.com/edgelesssys/marblerun

Answer Insufficient Session Expiration vulnerability in github.com/answerdev/answer

PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman

IncusOS has a LUKS encryption bypass due to insufficient TPM policy in github.com/lxc/incus-os/incus-osd

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection in github.com/DatanoiseTV/tinyice.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/DatanoiseTV/tinyice before v2.5.0.

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial `../` substring.

Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.11.

Inspektor Gadget: Command Injection via malicious buildOptions manipulation in github.com/inspektor-gadget/inspektor-gadget

Instance config inline secret exposure in Grafana in github.com/grafana/agent

Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server

Helm Improper Certificate Validation in helm.sh/helm

Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker

Arbitrary file deletion in gitea in code.gitea.io/gitea

Privilege escalation in rbac in github.com/google/exposure-notifications-verification-server

A custom credentials object that does not implement the fmt.Stringer interface may leak sensitive information (e.g., credentials) via logs.

kyverno seccomp control can be circumvented in github.com/kyverno/kyverno

Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-20250815100400-2d5cdc6e217e.

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.

This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

ingress-nginx has Improper Check for Unusual or Exceptional Conditions in k8s.io/ingress-nginx.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: k8s.io/ingress-nginx before v1.13.7, from v1.14.0 before v1.14.3.

Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea

Name: ISA-2025-001: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt
Component: IBC-Go
Criticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))
Affected versions: IBC-Go >= v7; Earlier IBC-Go versions MAY also be affected.
Affected users: Validators, Full nodes, IBC Middleware authors

### Description

An issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain. The following patch is in addition to the previous patch which now extends the same protection to all applications beyond transfer.

### Patches

The new IBC-Go releases below address this issue:

* [v7.10.0](https://github.com/cosmos/ibc-go/releases/tag/v7.10.0)
* [v8.7.0](https://github.com/cosmos/ibc-go/releases/tag/v8.7.0)

### Workarounds

To prevent this state from being introduced to a chain, it is possible to permission Channel Opening as a workaround.

### Notes on Re-Release

This is an extension of the previous patch, please update to the latest patch to get full coverage against the reported issue.

#### Is this state breaking?

This patch is not state breaking unless an exploit is submitted before the patch is applied across the network in which case the chain will halt just as if it was unpatched. Thus, you can safely apply this patch in a rolling manner and encourage validators to patch as soon as possible in order to prevent any chain halts (and we've already cut new versions of these for you).

#### Testing we have done to gain more confidence in this release
* In addition to testing ibc-go, we also did the following:
* Tested PFM v7 and v8 after bumping dependencies
* Tested ibc-hooks v7 and v8 after bumping dependencies
* Ran a patched node on Cosmos Hub Mainnet and triggered failing and successful transactions that used PFM
* Ran a patched node on Osmosis mainnet and triggered failing and successful transactions that used ibc-hooks
This is a more thorough process than before, so we have higher confidence.

This issue was reported to the Cosmos Bug Bounty Program by swelf19 on HackerOne on February 18, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

If you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.  

A Github Security Advisory for this issue is available in the IBC-Go [repository](https://github.com/cosmos/ibc-go/security/advisories/GHSA-4wf3-5qj9-368v).

Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

OliveTin has crash on NPE by calling APIs with invalid bindings or log references in github.com/OliveTin/OliveTin

usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos

Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser

Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker

Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano

Ory Oathkeeper has a path traversal authorization bypass in github.com/ory/oathkeeper

Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus

fsutil.Unzip is vulnerable to path traversal attacks due to improper validation of paths.

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface in github.com/siyuan-note/siyuan/kernel

AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data.

May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure

Answer vulnerable to Authentication Bypass by Capture-replay in github.com/answerdev/answer

Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus

**Commit:** [86fbb0f7a8](https://github.com/gohugoio/hugo/commit/86fbb0f7a8) — _security: Validate redirects against security.http.urls_
**Affected versions:** v0.91.0 (when `security.http.urls` was introduced) through v0.161.1.
**Fixed in:** v0.162.0.
**Severity:** Only relevant for sites that rely on `security.http.urls` as a trust boundary — e.g. CI builds that fetch remote resources but want to constrain which hosts can be reached. Not an issue if you fully trust every URL passed to `resources.GetRemote`.

**Description.** `resources.GetRemote` enforces `security.http.urls` on the URL it is called with, but until v0.162.0 it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid — for example, `http://localhost/` or an internal IP — and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place.

**Mitigation.** v0.162.0 installs a `CheckRedirect` on the HTTP client used by `resources.GetRemote` that re-runs `security.http.urls` on every redirect target and caps the redirect chain at 10 hops. No configuration change is required.

Gogs: Release tag option injection in release deletion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.

Excessive memory allocation during header parsing in github.com/golang-jwt/jwt

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server

Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd

SSRF in sliver teamserver in github.com/bishopfox/sliver

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Ollama Divide by Zero Vulnerability in github.com/ollama/ollama

Gin-vue-admin has an arbitrary file deletion vulnerability in github.com/flipped-aurora/gin-vue-admin

kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router

Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server

mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance in github.com/fission/fission

Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server

Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego

Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v11.6.2.

UUIDs generated using NewV1 and NewV4 may not read the expected
number of random bytes. These UUIDs may contain a significantly smaller
amount of entropy than expected, possibly leading to collisions.


GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.

Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api from v0.8.0 before v2.2.0.

Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd

Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

A malicious HTTP server or client can cause the net/http client or server to panic.

ReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.

This also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts.

OpenFGA DoS vulnerability in github.com/openfga/openfga

Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) in github.com/docker/model-runner

Directory Traversal in Docker in github.com/docker/docker

CVE ID↕	Published↕	CVSS↑
GO-2026-5313	Jul 7, 2026	N/A
GO-2024-3356	Jan 7, 2025	N/A
GO-2026-5750	Jul 27, 2026	N/A
GO-2023-2004	Aug 21, 2024	N/A
GO-2025-3923	Sep 8, 2025	N/A
GO-2025-3886	Aug 18, 2025	N/A
GO-2026-4311	Jan 23, 2026	N/A
GO-2023-1973	Aug 20, 2024	N/A
GO-2023-1285	Aug 20, 2024	N/A
GO-2023-1879	Aug 20, 2024	N/A
GO-2026-5611	Jun 25, 2026	N/A
GO-2022-0304	Aug 21, 2024	N/A
GO-2026-5324	Jun 25, 2026	N/A
GO-2026-4346	Feb 3, 2026	N/A
GO-2026-4456	Feb 17, 2026	N/A
GO-2026-5849	Jul 7, 2026	N/A
GHSA-9763-4f94-gfch	Jan 8, 2024	N/A
GO-2022-0855	Aug 21, 2024	N/A
GHSA-xr7q-jx4m-x55m	Jul 5, 2024	N/A
GO-2025-4119	Nov 17, 2025	N/A
GHSA-76cc-p55w-63g3	Jan 3, 2024	N/A
GO-2026-5441	Jun 25, 2026	N/A
GO-2021-0083	Apr 14, 2021	N/A
GHSA-5x4g-q5rc-36jp	Feb 3, 2024	N/A
GO-2022-0314	Aug 21, 2024	N/A
GO-2025-3726	Jun 3, 2025	N/A
GHSA-392h-r46j-q24p	Nov 28, 2023	N/A
GO-2023-1919	Aug 20, 2024	N/A
GO-2026-4399	Feb 19, 2026	N/A
GO-2024-2449	Jun 28, 2024	N/A
GO-2024-2583	Mar 4, 2024	N/A
GO-2023-1996	Aug 20, 2024	N/A
GO-2026-5421	Jun 25, 2026	N/A
GO-2026-4704	Mar 26, 2026	N/A
GO-2026-5932	Jul 7, 2026	N/A
GO-2026-5534	Jun 25, 2026	N/A
GHSA-8hqg-whrw-pv92	May 31, 2024	N/A
GO-2024-2707	Jun 5, 2024	N/A
GO-2026-5211	Jun 25, 2026	N/A
GO-2022-0305	Aug 21, 2024	N/A
GO-2025-3769	Jul 28, 2025	N/A
GO-2023-1993	Aug 20, 2024	N/A
GO-2022-0985	Aug 21, 2024	N/A
GO-2022-0442	Aug 21, 2024	N/A
GO-2022-0798	Aug 21, 2024	N/A
GO-2023-2137	Oct 24, 2023	N/A
GO-2023-1801	Aug 20, 2024	N/A
GO-2026-5621	Jun 25, 2026	N/A
GO-2026-5653	Jun 25, 2026	N/A
GO-2025-4035	Oct 30, 2025	N/A
GO-2024-2687	Apr 3, 2024	N/A
GO-2020-0025	Apr 14, 2021	N/A
GO-2026-4419	Feb 5, 2026	N/A
GO-2025-3694	May 23, 2025	N/A
GO-2026-5081	Jun 25, 2026	N/A
GHSA-4wf3-5qj9-368v	Mar 12, 2025	N/A
GO-2026-4325	Feb 26, 2026	N/A
GO-2024-3291	Nov 27, 2024	N/A
GO-2026-4621	Mar 10, 2026	N/A
GO-2023-1461	Aug 20, 2024	N/A
GO-2024-3179	Oct 9, 2024	N/A
GO-2025-4118	Nov 17, 2025	N/A
GO-2025-3393	Jan 16, 2025	N/A
GO-2026-5992	Jul 17, 2026	N/A
GO-2025-3656	May 6, 2025	N/A
GO-2026-4804	Mar 23, 2026	N/A
GO-2026-5254	Jun 25, 2026	N/A
GO-2023-1611	Mar 8, 2023	N/A
GO-2026-4706	Mar 26, 2026	N/A
GO-2023-1859	Jun 22, 2023	N/A
GO-2025-3787	Jul 28, 2025	N/A
GO-2023-1659	Aug 20, 2024	N/A
GO-2025-4188	Dec 15, 2025	N/A
GHSA-vxgm-5rmg-5w8g	Jun 16, 2026	N/A
GO-2026-4617	Mar 10, 2026	N/A
GO-2022-0187	Jul 1, 2022	N/A
GO-2025-3553	Mar 26, 2025	N/A
GO-2022-0433	May 20, 2022	N/A
GO-2026-5454	Jun 25, 2026	N/A
GO-2023-1670	Aug 20, 2024	N/A
GO-2025-3472	Mar 3, 2025	N/A
GO-2026-4980	May 7, 2026	N/A
GO-2025-3689	May 15, 2025	N/A
GO-2025-4171	Dec 2, 2025	N/A
GO-2026-5354	Jun 25, 2026	N/A
GO-2022-0307	Aug 21, 2024	N/A
GO-2026-4765	Mar 23, 2026	N/A
GO-2026-5854	Jul 7, 2026	N/A
GO-2024-3096	Aug 30, 2024	N/A
GO-2024-3331	Dec 18, 2024	N/A
GO-2025-3766	Jul 28, 2025	N/A
GO-2020-0018	Apr 14, 2021	N/A
GO-2021-0070	Apr 14, 2021	N/A
GO-2026-4791	Mar 23, 2026	N/A
GO-2022-0921	Aug 21, 2024	N/A
GO-2024-2562	Jun 28, 2024	N/A
GO-2022-0236	Jul 15, 2022	N/A
GO-2023-2121	Aug 21, 2024	N/A
GO-2026-4911	Apr 2, 2026	N/A
GO-2022-0705	Aug 21, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.