Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260323180334-daffe750de85.

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-20250822083415-01b95392a450.

Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service in github.com/bishopfox/sliver.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/bishopfox/sliver before v1.6.12.

An issue in the RunHTTPServer function in Gorush allows attackers to intercept and manipulate data due to the use of a deprecated TLS version.

klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes in github.com/drakkan/sftpgo

PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems in github.com/pinchtab/pinchtab

OpenFGA is vulnerable to a denial of service attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.

WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation in github.com/Tencent/WeKnora

Vikunja has a 2FA Bypass via Caldav Basic Auth in code.vikunja.io/api

Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul

HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault

Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada

Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/fleetdm/fleet/v4 before v4.43.5-0.20260113202849-bbc1aef2987d.

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev

Gogs user can update repository content with read-only permission in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

kro Confused Deputy vulnerability in github.com/kro-run/kro

Packetbeat does not properly validate an array index in multiple protocol parser components in github.com/elastic/beats

Traefik has a possible vulnerability with the path matchers in github.com/traefik/traefik

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio

Hysteria vulnerable to server crash when max_datagram_frame_size very small in github.com/apernet/hysteria.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/apernet/hysteria before v2.9.2.

Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources in goauthentik.io.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: goauthentik.io before v0.0.0-20250722122105-7a4c6b9b50f8.

Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence in github.com/juju/juju

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots in istio.io/istio

Dpanel's hard-coded JWT secret leads to remote code execution in github.com/donknap/dpanel

usememos/memos Improper Access Control vulnerability in github.com/usememos/memos

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

### Impact

A vulnerability CVE-2023-39325 exists in [Go managing HTTP/2 requests](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ?pli=1), which impacts Traefik. This vulnerability could be exploited to cause a denial of service.

### References

- [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487)
- [CVE-2023-39325](https://www.cve.org/CVERecord?id=CVE-2023-39325)

### Patches

- https://github.com/traefik/traefik/releases/tag/v2.10.5
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta4

# CWA-2024-009

**Severity**

Low (Marginal + Likely)[^1]

**Affected versions:**

- wasmd < 0.53.1

**Patched versions:**

- wasmd 0.53.2 (please note that wasmd 0.53.1 is broken and must not be used)

## Description of the bug

(Blank for now. We'll add more detail once chains had a chance to upgrade.)

## Mitigations

Apart from upgrading, it is recommended to **not** open the gRPC and REST APIs of _validator_ nodes to the public internet. Use isolated and resource-constrained environments for running separate public RPC nodes instead.
These can then easily be thrown away and replaced with new instances in case of problems.

## Applying the patch

### Official Wasmd patch

The patch will be shipped in a wasmd release. You will also have to update `libwasmvm` if you build statically.
If you already use the latest / close to latest wasmd, you can update more or less as follows:

1. Check the current wasmd version: `go list -m github.com/CosmWasm/wasmd`
2. Bump the `github.com/CosmWasm/wasmd` dependency in your go.mod to 0.53.2 (Cosmos SDK 0.50 compatible); `go mod tidy`; commit.
3. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
4. Check the updated wasmd version: `go list -m github.com/CosmWasm/wasmd` and ensure you see 0.53.2.
5. Follow your regular practices to deploy chain upgrades.

To double check if the correct library version is loaded at runtime, use this query:
`<appd> query wasm libwasmvm-version`. It must show 2.1.4.

The patch is not consensus breaking _if you are already using wasmvm 2.1.3_.
If you are instead using wasmvm 2.1.2, then upgrading to 2.1.4 includes the consensus breaking changes of 2.1.3.

### DIY Patch

If you are unable to upgrade to the latest version, you can backport the wasmd patch to your version. The patch is available at [Wasmd 0.53.2](https://github.com/CosmWasm/wasmd/compare/v0.53.0...v0.53.2).
However, if you are on an older version of wasmd, you will also be using a different version of wasmvm. We provide the required patches for wasmvm in versions 2.1.4, 2.0.5, 1.5.6.
To upgrade using this method:

1. Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and upgrade
   to the closest patched version.
2. Bump the github.com/CosmWasm/wasmvm dependency in your go.mod to the closest compatible patched version (either 2.1.4, 2.0.5 or 1.5.6); go mod tidy; commit.
3. Apply the patch linked above to your version of wasmd.
4. If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, make sure that you use the same version as your wasmvm version.
5. Follow your regular practices to deploy chain upgrades.

To double check if the correct library version is loaded at runtime, use this query:
`<appd> query wasm libwasmvm-version`. It must show 2.1.4, 2.0.5 or 1.5.6 and must be the same as the wasmvm version in your go.sum.

The patch is not consensus breaking as long as you were using the previous patch version of wasmvm before.

## Acknowledgement

This issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.

If you believe you have found a bug in the Interchain Stack or would like to contribute to the
program by reporting a bug, please see <https://hackerone.com/cosmos>.

## Timeline

- 2024-09-25: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.
- 2024-09-30: Confio security contributors confirm the report.
- 2024-11-21: Confio developed the patch internally.
- 2024-12-06: Patch release is pre-announced through notification lists.
- 2024-12-10: Patch released.

[^1]: following Amulet's Severity Classification Framework ACMv1: https://github.com/interchainio/security/blob/e0227a1fb4059144aab4f6003eeee7f09912db3a/resources/CLASSIFICATION_MATRIX.md

SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

Path Traversal in github.com/go-sonic/sonic

Gogs has authorization bypass in repository deletion API in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Evmos vulnerable to DOS and transaction fee expropriation through Authz exploit in github.com/evmos/evmos

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false in github.com/traefik/traefik

authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd

Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates

Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt in github.com/cosmos/ibc-go

The leafInfo.match() function uses path.join() to deal with wildcard values which can lead to cross directory risk.

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` in github.com/hahwul/dalfox

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle

A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution in github.com/pinchtab/pinchtab

Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents in github.com/nezhahq/nezha.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nezhahq/nezha before v2.0.14.

Listing of upload directory contents possible in github.com/ThomasLeister/prosody-filer

Answer vulnerable to Business Logic Errors in github.com/answerdev/answer

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko

Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server

OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev

CVE-2024-46455 in github.com/Unstructured-IO/unstructured

SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy in github.com/drakkan/sftpgo

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu

Gokapi has Data Leak in Upload Status Stream in github.com/forceu/gokapi.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/forceu/gokapi before v2.2.3.

Cross-site Scripting in github.com/greenpau/caddy-security

Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju

Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker

Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260129133647-5d787969c2d5.

Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor

Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline

Memory Exhaustion in Expr Parser with Unrestricted Input in github.com/expr-lang/expr

A malicious registry can cause Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR) if the registry is scanned from directly using Trivy. These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. This vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the --image-src flag to select which sources you trust.

Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum

Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2

Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260513165311-fb7336fc36c1.

Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream in github.com/tilt-dev/tilt

Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v8.5.13, from v9.0.0 before v9.0.9, from v9.1.0 before v9.1.6.

Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor

Mattermost allows authenticated users to gain access to private repositories in github.com/mattermost/mattermost-plugin-github

MarbleRun unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/marblerun

Authentication Bypass by Spoofing in github.com/greenpau/caddy-security

Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

OpenBao's Namespace Deletion May Not Delete Data Properly in github.com/openbao/openbao

Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul

## Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

NATS users exist within accounts, and once using accounts, the old authorization block is not applicable.


## Problem Description

Without any authorization rules in the nats-server, users can connect without authentication.

Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an "authorization" block, defining users.  With nats-server 2.2.0 all users live inside accounts.  When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, "$G".  Users inside accounts go into the newer "accounts" block.

If an "accounts" block is defined, in simple deployment scenarios this is often used only to enable client access to the system account.  When the only account added is the system account "$SYS", the nats-server would create an implicit user in "$G" and set it as the `no_auth_user` account, enabling the same "without authentication" logic as without any rules.

This preserved the ability to connect simply, and then add one authenticated login for system access.

But with an "authorization" block, this is wrong.  Users exist in the global account, with login rules.  And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.

The blind-spot on our part came from encouraging and documenting a switch to using only "accounts", instead of "authorization".

In the fixed versions, using an "authorization" block will inhibit the implicit creation of a "$G" user and setting it as the `no_auth_user` target.  In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.


## Affected versions

NATS Server:
 * 2.2.0 up to and including 2.9.22 and 2.10.1
 * Fixed with nats-io/nats-server: 2.10.2 and backported to 2.9.23


## Workarounds

In the "accounts" block, define a second non-system account, leave it empty.

    accounts {
        SYS: {
            users: [
                { user: sysuser, password: makemeasandwich }
            ]
        }
        DUMMY: {}  # for security, before 2.10.2
    }
    system_account: SYS


## Solution

Any one of these:

 1. Upgrade the NATS server to at least 2.10.2 (or 2.9.23)
 2. Or define a dummy account
 3. Or complete the migration of authorization entries to be inside a named account in the "accounts" block


## Credits

Problem reported by Alex Herrington.  
Addressed publicly in a GitHub Discussion prior to this advisory.

Ory Keto has a SQL injection via forged pagination tokens in github.com/ory/keto

AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input in github.com/beego/beego

SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel

Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon

Podman Symlink Vulnerability in github.com/containers/libpod

Timing side channel in github.com/cloudflare/circl

CVE-2024-53348 in github.com/loxilb-io/loxilb

Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server

Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc

An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.

Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm

Gitea has insecure default SSH settings in code.gitea.io/gitea

OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint in github.com/OliveTin/OliveTin

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly

Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/romeo/environment/deploy.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/ctfer-io/romeo/environment/deploy before v0.2.1.

Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0

OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.5.4.

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber

Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel

SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb

CVE ID↕	Published↕	CVSS↑
GO-2026-5219	Jun 25, 2026	N/A
GO-2025-4029	Oct 30, 2025	N/A
GO-2026-4466	Feb 17, 2026	N/A
GO-2024-3058	Aug 19, 2024	N/A
GO-2026-5424	Jun 25, 2026	N/A
GO-2026-4697	Mar 16, 2026	N/A
GO-2026-4822	Mar 26, 2026	N/A
GO-2023-1872	Jul 5, 2023	N/A
GO-2026-4645	Mar 10, 2026	N/A
GO-2026-4794	Mar 23, 2026	N/A
GO-2024-3243	Nov 4, 2024	N/A
GO-2024-2486	Jun 28, 2024	N/A
GO-2025-3363	Jan 7, 2025	N/A
GO-2026-4889	Apr 2, 2026	N/A
GO-2026-6036	Jul 22, 2026	N/A
GO-2026-4450	Feb 17, 2026	N/A
GO-2025-3741	Jun 9, 2025	N/A
GO-2026-4789	Apr 7, 2026	N/A
GO-2025-3634	Apr 22, 2025	N/A
GO-2026-5909	Jul 7, 2026	N/A
GO-2024-2499	Jun 28, 2024	N/A
GO-2026-5807	Jul 7, 2026	N/A
GO-2025-3822	Aug 11, 2025	N/A
GO-2026-5228	Jun 25, 2026	N/A
GO-2026-5289	Jun 25, 2026	N/A
GO-2025-3612	Apr 22, 2025	N/A
GO-2022-1252	Aug 21, 2024	N/A
GO-2024-2825	May 8, 2024	N/A
GHSA-7v4p-328v-8v5g	Oct 17, 2023	N/A
GHSA-vmg2-r3xv-r3xf	Dec 10, 2024	N/A
GO-2026-5514	Jun 25, 2026	N/A
GO-2023-1509	Aug 20, 2024	N/A
GO-2026-4457	Feb 17, 2026	N/A
GO-2024-2732	Jun 5, 2024	N/A
GO-2026-5277	Jun 25, 2026	N/A
GO-2026-5361	Jun 25, 2026	N/A
GO-2025-3609	Apr 22, 2025	N/A
GO-2025-3488	Feb 26, 2025	N/A
GO-2026-4775	Mar 23, 2026	N/A
GO-2025-3517	Mar 18, 2025	N/A
GO-2022-0569	Aug 23, 2022	N/A
GO-2026-5649	Jun 25, 2026	N/A
GO-2025-4269	Jan 12, 2026	N/A
GO-2026-4824	Mar 26, 2026	N/A
GO-2026-5261	Jun 25, 2026	N/A
GO-2022-0407	Aug 21, 2024	N/A
GO-2023-1658	Aug 20, 2024	N/A
GO-2026-5589	Jun 25, 2026	N/A
GO-2024-3091	Aug 30, 2024	N/A
GO-2026-4857	Mar 26, 2026	N/A
GO-2026-6033	Jul 22, 2026	N/A
GO-2024-3315	Dec 10, 2024	N/A
GO-2026-4699	Mar 16, 2026	N/A
GO-2026-5705	Jun 25, 2026	N/A
GO-2026-4613	Mar 10, 2026	N/A
GO-2024-2559	Jun 28, 2024	N/A
GO-2024-3174	Oct 9, 2024	N/A
GO-2024-2913	Jun 14, 2024	N/A
GO-2026-4746	Mar 23, 2026	N/A
GO-2022-0876	Aug 21, 2024	N/A
GO-2026-5486	Jun 25, 2026	N/A
GO-2025-3525	Mar 18, 2025	N/A
GO-2024-2870	May 22, 2024	N/A
GO-2026-4507	Feb 24, 2026	N/A
GO-2022-0448	Aug 21, 2024	N/A
GO-2026-5409	Jun 25, 2026	N/A
GO-2026-5181	Jun 25, 2026	N/A
GO-2024-2847	Jun 5, 2024	N/A
GO-2026-5535	Jun 25, 2026	N/A
GO-2026-5839	Jul 7, 2026	N/A
GO-2025-3450	Feb 5, 2025	N/A
GO-2024-2558	Jun 28, 2024	N/A
GO-2026-4539	Feb 26, 2026	N/A
GO-2026-5674	Jun 25, 2026	N/A
GO-2025-3684	May 15, 2025	N/A
GO-2023-1827	Aug 20, 2024	N/A
GHSA-fr2g-9hjm-wr23	Oct 19, 2023	N/A
GO-2026-4800	Mar 23, 2026	N/A
GO-2022-1181	Aug 21, 2024	N/A
GO-2025-3585	Apr 1, 2025	N/A
GO-2026-4743	Mar 23, 2026	N/A
GO-2025-4157	Nov 25, 2025	N/A
GO-2023-1942	Aug 20, 2024	N/A
GO-2024-2453	Jan 18, 2024	N/A
GO-2025-3545	Mar 25, 2025	N/A
GO-2025-3549	Mar 25, 2025	N/A
GO-2025-4097	Nov 18, 2025	N/A
GO-2023-2409	Dec 20, 2023	N/A
GO-2026-5138	Jun 25, 2026	N/A
GO-2026-5091	Jun 25, 2026	N/A
GO-2026-4584	Mar 10, 2026	N/A
GO-2026-5975	Jul 17, 2026	N/A
GO-2026-4714	Mar 26, 2026	N/A
GO-2026-4368	Feb 2, 2026	N/A
GO-2026-5110	Jun 25, 2026	N/A
GO-2026-5375	Jun 25, 2026	N/A
GO-2026-5574	Jun 25, 2026	N/A
GO-2026-5887	Jul 24, 2026	N/A
GO-2025-3909	Aug 29, 2025	N/A
GO-2023-2166	Aug 21, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.