CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server in github.com/kubeedge/kubeedge

ExternalSecrets vulnerable to privilege escalation with secret overwriting in github.com/external-secrets/external-secrets/apis.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/external-secrets/external-secrets/apis from v0.1.0 before v2.4.1.

wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl

containerd has an integer overflow in User ID handling in github.com/containerd/containerd

usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos

Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus

Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon

Focalboard doesn't validate file ownership when serving uploaded files in github.com/mattermost/focalboard

Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence

Default Credentials in nginx-defender Configuration Files in github.com/Anipaleja/nginx-defender

Gokapi has CSRF in Login Endpoint in github.com/forceu/gokapi.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/forceu/gokapi before v2.2.3.

free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef

Unmarshalling a Hello Verify request can panic, which could allow a denial of service.

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet

Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.8.

go-libp2p is vulnerable to targeted resource exhaustion attacks.

These attacks target libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory ultimately leading to the process getting killed by the host's operating system.

While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack.

It's recommend to update to v0.21.0 onwards to get some useful functionality that will help in production environments like better metrics around resource usage, Grafana dashboards around resource usage, allow list support, and default autoscaling limits.

CBC Padding Panic — Unauthenticated Process Crash in github.com/russellhaering/gosaml2

Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

The Docker daemon's implementation of the "PUT /containers/{id}/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted, potentially leading to privilege escalation or host compromise.

The affected code is located in the daemon package, specifically in the containerExtractToDir method of the Daemon struct. This package is part of the Moby daemon's core and is not intended for external use as a library.

Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos

Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator

OpenBao's SQL Injection in PostgreSQL database secrets engine in github.com/openbao/openbao

HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk

Client-provided certificates are not correctly validated, and must not be trusted.

DTLS client certificates must be accompanied by proof that the client possesses the private key for the certificate. The Pion DTLS server accepted client certificates unaccompanied by this proof, permitting an attacker to present any certificate and have it accepted as valid.

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVE-2024-5138 in github.com/snapcore/snapd

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel

free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication in github.com/free5gc/udr

Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server

Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260327001745-7a339a6438f5.

usememos/memos vulnerable to Comparison of Object References Instead of Object Contents in github.com/usememos/memos

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover in github.com/fission/fission

Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4

1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/1Panel-dev/1Panel before v1.10.12-tls.

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints in github.com/akuity/kargo

Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Tinyauth's OIDC authorization codes are not bound to client on token exchange in github.com/steveiliop56/tinyauth.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/steveiliop56/tinyauth before v1.0.1-20260311144920-9eb2d33064b7.

Memory exhaustion in github.com/vbatts/tar-split

MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx

OS Command Injection in gogs in gogs.io/gogs

A race condition can cause incorrect HTTP request routing.

Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server

### Impact

We are not aware of any exploits. This is a pro-active fix.

Impacted: 

* You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless).
* The attacker is within your network. If you expose Argo Server to the Internet then "your network" is "the Internet". 

The Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.

### Patches

https://github.com/argoproj/argo-workflows/pull/6540

### Workarounds

* Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.

This was identified by engineers at Jetstack.io

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu

Kyverno ignores subjectRegExp and IssuerRegExp in github.com/kyverno/kyverno

### Context

ICS has the following four messages that enable validators on the provider chain to perform different actions:

- `MsgOptIn` -- adds a validator to the consumer chain’s active set
- `MsgOptOut` -- removes a validator from the consumer chain’s active set 
- `MsgAssignConsumerKey` -- changes the consensus key used for a validator’s operations on a consumer chain
- `MsgSetConsumerCommissionRate` -- sets a validator’s consumer-specific commission rate

Normally, only the respective validators are allowed to perform these actions. 

### Issue

The upgrade to SDK 0.50, introduced a [signer](https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer) field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address.  

As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. 

For more context, check out the code:

- proto files https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52
- message validation https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106
- message handling https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52

### Severity assessment

The severity assessment is based on [this framework](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md). 

**Potential impact:** Catastrophic 

- By changing consumer keys for 1/3+ of a consumer chain's validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.
- By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider's active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.

**Likelihood:** Rare

- The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. 
- The bug has been live for two weeks with no issues. 
- All four message types are ones that only validators use, and rarely use in daily operations.
- In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.
- The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.

OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey

ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v4.0.0-rc.1 before v4.7.1.

gittuf's policy can be rolled back to prior valid versions in github.com/gittuf/gittuf

melange QEMU runner could write files outside workspace directory in chainguard.dev/melange

github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/u-root/u-root

free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions in github.com/free5gc/udr

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay in github.com/altcha-org/altcha-lib-go

Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding in github.com/xddxdd/bird-lg-go

Gogs Missing Authorization in Attachment Download in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

`internal/pki/resolver.go:36-64` constructs a `CAManager` with the plaintext `ed25519.PrivateKey` after unwrapping via the master key; `internal/pki/ca.go:13-16` stores it. Callers at `internal/api/enroll.go:116`, `internal/api/updates.go:297`, and `internal/api/mobile_bundle.go:40` use the manager for one `Sign()` and drop the reference on function return — but the underlying slice contents are not wiped before release.

The keystore package's contract (`internal/keystore/keystore.go` doc: *"Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed"*) is not met by the `CAManager` consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers.

## Affected
All released versions up to v0.3.6.

## Threat model
Memory-read access: core dump, ptrace, kernel swap to disk, container/VM snapshot, OOM-debug bundle, side-channel via shared cache lines. Not a remote-network vulnerability, but defeats the master-key + envelope-encryption design's promise of "private key never lingers".

## Suggested fix
Add a `Wipe()` method on `CAManager`:

```go
// internal/pki/ca.go
func (m *CAManager) Wipe() {
    if m == nil {
        return
    }
    keystore.Zeroize(m.caKey)
}
```

At each call site (`enroll.go:116`, `updates.go:297`, `mobile_bundle.go:40`, and any new caller), `defer caMgr.Wipe()` immediately after the `Resolve()` call. Pattern mirrors the existing `defer keystore.Zeroize(dek)` discipline in the keystore package.

Optional follow-up: wrap `m.Sign()` to zeroize after each call, removing the contract on callers — but the `defer` pattern is sufficient as a minimum.

Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Ella Core panics on invalid PDU Session IDs in NGAP messages in github.com/ellanetworks/core

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule

An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.

k8sGPT has Prompt Injection through its k8sGPT-Operator in github.com/k8sgpt-ai/k8sgpt

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

GoPhish sends cleartext passwords in github.com/gophish/gophish

Path Traversal in file editor on Windows in Gogs in gogs.io/gogs

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution in github.com/mattermost/mattermost-server

Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul

Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman

Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.0.

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus

Parsing a range with a mask larger than 32 bits causes a panic.

Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) in github.com/gotenberg/gotenberg

LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI

Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates

gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey

Arbitrary Code Execution in github.com/docker/docker

Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed.

Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.2.1.

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI in go.opentelemetry.io/obi

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.

OpenFGA Authorization Bypass in github.com/openfga/openfga

Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad

KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing in kubevirt.io/kubevirt

OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex in github.com/oauth2-proxy/oauth2-proxy

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/0xJacky/nginx-ui before v2.3.8.

### Impact
In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header.  Versions of Moby (Docker Engine) prior to 20.10.11 treat the Content-Type header as trusted and deserialize the document according to that header.  If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.

### Patches
This issue has been fixed in Moby (Docker Engine) 20.10.11.  Image pulls for manifests that contain a “manifests” field or indices which contain a “layers” field are rejected.

### Workarounds
Ensure you only pull images from trusted sources.

### References
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

### For more information
If you have any questions or comments about this advisory:
* [Open an issue in](https://github.com/moby/moby/issues/new)
* Email us at [security@docker.com](mailto:security@docker.com)


### Impact
Windows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`

This attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.

**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** 

**As well, if you have `.` within your default $PATH, please upgrade immediately.**

More information can be found on the official Go blog: https://blog.golang.org/path-security

### Patches
The problem has been resolved in v3.7.1

Now, if Windows users using cmd.exe run into this issue, a warning message will be printed:
`vim resolves to executable in current directory (.\vim.exe)`

### References
* https://blog.golang.org/path-security

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)

Ollama is vulnerable to a heap out-of-bounds read in its GGUF model loader. A specially crafted GGUF file can cause the loader to read beyond the allocated heap buffer, potentially leading to a denial of service (crash).

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.

CVE ID↕	Published↕	CVSS↑
GO-2022-0501	Aug 21, 2024	N/A
GO-2026-5377	Jun 25, 2026	N/A
GO-2024-2863	Jun 4, 2024	N/A
GO-2025-3528	Mar 18, 2025	N/A
GO-2023-1465	Aug 20, 2024	N/A
GO-2025-3803	Jul 28, 2025	N/A
GO-2026-5917	Jul 7, 2026	N/A
GO-2026-6029	Jul 22, 2026	N/A
GO-2026-4882	Apr 7, 2026	N/A
GO-2026-5385	Jun 25, 2026	N/A
GO-2026-5670	Jun 25, 2026	N/A
GO-2025-3863	Aug 18, 2025	N/A
GO-2025-3896	Aug 29, 2025	N/A
GO-2026-4624	Mar 10, 2026	N/A
GO-2026-5447	Jun 25, 2026	N/A
GO-2023-1534	Feb 13, 2023	N/A
GO-2025-3927	Sep 8, 2025	N/A
GO-2024-2541	Jun 28, 2024	N/A
GO-2022-1148	Dec 14, 2022	N/A
GO-2026-4760	Mar 27, 2026	N/A
GO-2023-1864	Aug 20, 2024	N/A
GO-2025-4015	Oct 29, 2025	N/A
GO-2026-5746	Jun 25, 2026	N/A
GO-2025-3831	Aug 11, 2025	N/A
GO-2025-4125	Nov 17, 2025	N/A
GO-2026-5192	Jun 25, 2026	N/A
GO-2026-5445	Jun 25, 2026	N/A
GO-2026-6061	Jul 27, 2026	N/A
GO-2024-3339	Dec 18, 2024	N/A
GO-2022-0462	Jul 1, 2022	N/A
GO-2026-5024	May 22, 2026	N/A
GO-2024-2906	Jun 14, 2024	N/A
GO-2026-5958	Jul 17, 2026	N/A
GO-2026-5722	Jun 25, 2026	N/A
GO-2023-1971	Aug 20, 2024	N/A
GO-2025-3756	Jun 11, 2025	N/A
GO-2026-5769	Jun 25, 2026	N/A
GO-2022-1260	Aug 21, 2024	N/A
GO-2026-5860	Jul 7, 2026	N/A
GO-2024-2456	Jan 23, 2024	N/A
GO-2024-2990	Jul 22, 2024	N/A
GO-2026-4516	Feb 23, 2026	N/A
GO-2025-3643	Apr 24, 2025	N/A
GO-2026-4689	Mar 12, 2026	N/A
GO-2025-3640	Apr 24, 2025	N/A
GO-2026-4989	May 20, 2026	N/A
GO-2022-0749	Aug 21, 2024	N/A
GO-2022-0400	Jul 1, 2022	N/A
GO-2024-3334	Dec 18, 2024	N/A
GHSA-6c73-2v8x-qpvm	Aug 23, 2021	N/A
GO-2026-5558	Jun 25, 2026	N/A
GO-2025-3562	Mar 25, 2025	N/A
GHSA-7q74-g774-7x3g	Sep 5, 2024	N/A
GO-2025-3679	May 15, 2025	N/A
GO-2025-4212	Dec 15, 2025	N/A
GO-2026-5683	Jun 25, 2026	N/A
GO-2026-4407	Feb 5, 2026	N/A
GO-2022-0805	Aug 21, 2024	N/A
GO-2026-5741	Jun 25, 2026	N/A
GO-2025-4239	Dec 16, 2025	N/A
GO-2026-5077	Jun 25, 2026	N/A
GO-2026-5536	Jun 25, 2026	N/A
GHSA-8h84-fhqq-q58v	Jun 10, 2026	N/A
GO-2024-3277	Nov 19, 2024	N/A
GO-2026-4981	May 7, 2026	N/A
GO-2026-4783	Mar 23, 2026	N/A
GO-2025-3893	Aug 29, 2025	N/A
GHSA-q27h-hw2v-x5jm	Nov 17, 2023	N/A
GO-2026-5631	Jun 25, 2026	N/A
GO-2022-1225	Aug 21, 2024	N/A
GO-2024-3106	Sep 6, 2024	N/A
GO-2025-3361	Jan 7, 2025	N/A
GO-2022-0570	Aug 21, 2024	N/A
GO-2025-4065	Oct 30, 2025	N/A
GO-2024-2505	Jun 28, 2024	N/A
GO-2026-5568	Jun 25, 2026	N/A
GO-2026-5545	Jun 25, 2026	N/A
GO-2024-2883	Jul 2, 2024	N/A
GO-2026-5800	Jul 7, 2026	N/A
GHSA-f99h-w337-mv56	Jul 12, 2023	N/A
GO-2026-4356	Feb 2, 2026	N/A
GO-2026-5572	Jun 25, 2026	N/A
GO-2024-3253	Nov 6, 2024	N/A
GO-2026-5297	Jun 25, 2026	N/A
GO-2025-4174	Dec 2, 2025	N/A
GO-2022-0640	Aug 21, 2024	N/A
GO-2021-0110	Jul 28, 2021	N/A
GO-2026-4852	Mar 26, 2026	N/A
GO-2026-5107	Jun 25, 2026	N/A
GO-2025-3421	Jan 28, 2025	N/A
GO-2024-3272	Nov 19, 2024	N/A
GO-2025-3384	Jan 14, 2025	N/A
GO-2023-1581	Aug 20, 2024	N/A
GO-2025-4107	Nov 17, 2025	N/A
GO-2026-5559	Jun 25, 2026	N/A
GO-2026-5129	Jun 25, 2026	N/A
GHSA-xmmx-7jpf-fx42	Jun 10, 2024	N/A
GHSA-x5c7-x7m2-rhmf	May 20, 2021	N/A
GO-2026-5748	Jul 27, 2026	N/A
GO-2021-0058	Apr 14, 2021	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.