When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

An attacker may prevent TCP connections to a Server by opening a connection and leaving it idle, until the connection is closed by the server no other connections will be accepted.

kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko

## ASA-2024-004: Default configuration param for Evidence may limit window of validity

**Component**: CometBFT
**Criticality**: Low
**Affected versions**: All
**Affected users**: Validators, Chain Builders + Maintainers

## Summary

A default configuration in CometBFT has been found to be small for common use cases, and may prevent the slashing mechanism from working in specific cases.  The default values for `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` consensus parameters may not be sufficient for common use cases to provide coverage for the entire unbonding period for a chain (`Staking.UnbondingTime`). If the conditions of both of these parameters are exceeded, evidence may be prematurely expired and considered no longer valid, potentially allowing for unpunished Byzantine behavior if evidence is discovered outside of that window.

## Next Steps for Chains and Validators

It is recommended that chain ecosystems and their maintainers set the consensus parameters `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` to values appropriate for their use case:  
- `EvidenceParams.MaxAgeDuration` (set in nanoseconds) should exceed the duration of the chain’s unbonding period
- `EvidenceParams.MaxAgeNumBlocks` should exceed the number of estimated blocks that will be produced by your chain throughout the unbonding period

For more information about evidence in CometBFT, please see: https://docs.cometbft.com/v0.37/spec/consensus/evidence.

For more information about the cosmos-sdk  `x/staking` and `x/slashing` modules, and `UnbondingTime` parameter, please see: https://docs.cosmos.network/v0.50/build/modules/staking and https://docs.cosmos.network/v0.50/build/modules/slashing.

CometBFT is designed to be configurable by chains, and implements many different configuration variables and parameters to allow chain developers, validators, node operators, and chain participants to customize it best to their use case. 

As more chains adopt the Interchain Stack for new and cutting-edge use cases, the CometBFT team recommends that all chains regularly evaluate their consensus parameters and configurations to ensure they meet the needs of their ecosystem as their networks mature. 

A Github Security Advisory for this issue is available in the [CometBFT repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-555p-m4v6-cqxv). For more information about CometBFT, see https://docs.cometbft.com/. 

This issue was reported to the Cosmos Bug Bounty Program on HackerOne on February 15, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.


In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.

If a JWT contains an audience claim with an array of strings, rather than a single string, and MapClaims.VerifyAudience is called with req set to false, then audience verification will be bypassed, allowing an invalid set of audiences to be provided.

github.com/bincyber/go-sqlcrypter vulnerable to IV collision

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp

An information disclosure vulnerability exists in the getHostByName template function.

The function getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with "helm install|upgrade|template" or when the Helm SDK is used to render a chart.

Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.

Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer

usememos/memos Incorrect Use of Privileged APIs vulnerability in github.com/usememos/memos

Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers in github.com/free5gc/smf

Loop Variable Capture Signature Bypass in goxmldsig in github.com/russellhaering/goxmldsig

SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel

go-libp2p is vulnerable to targeted resource exhaustion attacks.

These attacks target libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory ultimately leading to the process getting killed by the host's operating system.

While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack.

It's recommend to update to v0.21.0 onwards to get some useful functionality that will help in production environments like better metrics around resource usage, Grafana dashboards around resource usage, allow list support, and default autoscaling limits.

### Impact

Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.

Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.

An attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.

### Patches

The vulnerability has been fixed in version 2.2.3.

### References

https://github.com/gotify/server/pull/541

ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.70.10, from v2.71.0 before v2.71.9, from v3.0.0-rc.1 before v3.0.0.

Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve

WeKnora Vulnerable to Broken Access Control in Tenant Management in github.com/Tencent/WeKnora

usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges in github.com/usememos/memos

containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd

Unbounded recursion in JSON parsing allows malicious JSON input to cause excessive memory consumption or panics.

MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio

In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient

Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/julien040/anyquery before v0.4.5.

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not.

A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

OpenFGA Authorization Bypass in github.com/openfga/openfga

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve

PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman

A malicious server can trick a client into treating it as a different server by changing the reported UUID.

immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. The SDK does not validate this UUID and accepts any value reported by the server. A malicious server can therefore change the reported UUID and trick the client into treating it as a different server.

Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server

### Impact
On Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.

On Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.

### Patches
Users should update to git-sizer v1.4.0

### Workarounds
If you are on Windows, then either
* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…
* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…
* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.

If you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.

### References
* [Command PATH security in Go](https://blog.golang.org/path-security)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).
* Email us at [GitHub support](mailto:support@github.com).

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

User object created with invalid provider data in GoTrue in github.com/netlify/gotrue

Hydra has Reflected XSS via error_hint parameter in github.com/ory/hydra.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/ory/hydra before v1.4.8.

usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos

Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik

Protections against directory traversal during archive extraction can be bypassed by chaining multiple symbolic links within the archive. This allows a malicious attacker to cause files to be created outside of the target directory. Additionally if the attacker is able to read extracted files they may create symbolic links to arbitrary files on the system which the unpacker has permissions to read.

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode in github.com/siyuan-note/siyuan/kernel

KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge

Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli

(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose length is zero through three produces a negative payload length. recvMessage then slices the connection scratch buffer with that negative bound, causing an unrecovered runtime panic that terminates the calling goroutine and process.

Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint in github.com/lin-snow/ech0

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

A user can use a valid client certificate that contains a CommonName that matches a valid RBAC username to authenticate themselves as that user, despite lacking the required credentials. This may allow authentication bypass, but requires a certificate that is issued by a CA trusted by the server.

Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod

traQ Allows Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/traPtitech/traQ before v3.25.0.

### Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.

### Specific Go Packages Affected
github.com/cloudflare/cfrpki/cmd/octorpki

### Patches
The issue was fixed in version 1.4.3

### References
[CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)



Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).

Modifying pod status allows host directory traversal.

Kubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Mattermost fails to limit the size of a request path in github.com/mattermost/mattermost-server

Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() in github.com/siyuan-note/siyuan/kernel

Path Normalization Bypass in Traefik Router + Middleware Rules in github.com/traefik/traefik

Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server before v4.1.2-0.20171004201910-6be8113eb60c, before v4.2.1-0.20171004192657-8fbbd688ea24.

RBAC Roles for `etcd` created by Kamaji are not disjunct in github.com/clastix/kamaji

Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server

Kopia: RCE via SSH ProxyCommand Injection in github.com/kopia/kopia

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.4.0.

CVE-2024-5138 in github.com/snapcore/snapd

Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server

Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). When a connection specifies hostaddr without host, github.com/lib/pq dials the numeric hostaddr but performs .pgpass lookup using the default Config.Host value, localhost. If the passfile contains different credentials for localhost and the remote address, the driver selects the secret intended for the local database and sends it to the remote endpoint when that endpoint requests password authentication.

Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution in github.com/traefik/traefik

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent in github.com/rancher/fleet

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution in github.com/kubev2v/assisted-migration-agent

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api from v2.3.0 before v2.4.0.

Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node

Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault

SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo

DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff

Fingerprint vulnerability in uTLS from GREASE ECH mismatch for Chrome parrots in github.com/refraction-networking/utls

DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly

ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik

Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly

Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.

Portainer missing authorization on Docker plugin endpoints, which allows host RCE in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer from v2.33.0 before v2.33.8, from v2.39.0 before v2.39.2, from v2.40.0 before v2.41.0.

External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets

Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells

Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server

OpenBao has a Timing Side-Channel in the Userpass Auth Method in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.3.2.

grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai

GoBGP has an out-of-bounds read in the ParseIP6Extended function in github.com/osrg/gobgp

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function in github.com/chaos-mesh/chaos-mesh.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/chaos-mesh/chaos-mesh before v2.7.3.

Tarslip in go-unarr in github.com/gen2brain/go-unarr

Version 7bdca06d0edf of the github.com/PromonLogicalis/asn1 module contains malicious code which downloads a program from a remote web server and executes it.

CVE ID↕	Published↕	CVSS↑
GO-2026-4981	May 7, 2026	N/A
GO-2020-0006	Apr 14, 2021	N/A
GO-2026-4580	Mar 10, 2026	N/A
GHSA-555p-m4v6-cqxv	Feb 28, 2024	N/A
GO-2026-6107	Aug 18, 2026	N/A
GO-2020-0017	Apr 14, 2021	N/A
GO-2024-2872	Jun 5, 2024	N/A
GO-2026-5955	Jul 24, 2026	N/A
GO-2023-1547	Feb 14, 2023	N/A
GO-2024-3064	Aug 13, 2024	N/A
GO-2023-1292	Aug 20, 2024	N/A
GO-2024-2575	Jun 4, 2024	N/A
GO-2026-4995	May 20, 2026	N/A
GO-2026-4753	Mar 27, 2026	N/A
GO-2024-3326	Dec 12, 2024	N/A
GO-2022-1148	Dec 14, 2022	N/A
GHSA-3244-8mff-w398	Jan 10, 2023	N/A
GO-2025-3671	May 15, 2025	N/A
GO-2026-4353	Feb 2, 2026	N/A
GO-2026-4642	Mar 10, 2026	N/A
GO-2023-1270	Aug 20, 2024	N/A
GO-2022-1147	Aug 21, 2024	N/A
GO-2022-0965	Sep 2, 2022	N/A
GO-2025-3594	Apr 9, 2025	N/A
GO-2024-3038	Aug 6, 2024	N/A
GO-2026-5459	Jun 25, 2026	N/A
GO-2026-6517	Sep 28, 2026	N/A
GO-2026-6344	Sep 10, 2026	N/A
GO-2024-2600	Mar 5, 2024	N/A
GO-2024-2729	Jun 4, 2024	N/A
GO-2026-6578	Oct 1, 2026	N/A
GO-2026-5421	Jun 25, 2026	N/A
GO-2022-1118	Dec 22, 2022	N/A
GO-2025-3731	Jun 3, 2025	N/A
GHSA-57q7-rxqq-7vgp	Feb 15, 2022	N/A
GO-2025-4237	Dec 15, 2025	N/A
GO-2026-5435	Jul 24, 2026	N/A
GO-2026-6662	Oct 7, 2026	N/A
GO-2022-0365	Aug 21, 2024	N/A
GO-2026-4861	Mar 26, 2026	N/A
GO-2022-1257	Aug 21, 2024	N/A
GO-2022-1152	Aug 21, 2024	N/A
GO-2021-0094	Apr 14, 2021	N/A
GO-2026-5370	Jun 25, 2026	N/A
GO-2022-0509	Aug 21, 2024	N/A
GO-2024-2912	Jul 1, 2024	N/A
GO-2026-6170	Aug 18, 2026	N/A
GO-2026-4838	Mar 26, 2026	N/A
GO-2026-5675	Jul 23, 2026	N/A
GO-2021-0077	Apr 14, 2021	N/A
GO-2026-6594	Oct 1, 2026	N/A
GO-2025-3913	Aug 29, 2025	N/A
GHSA-3jhm-87m6-x959	Jun 25, 2022	N/A
GO-2026-6339	Sep 2, 2026	N/A
GHSA-pmcr-2rhp-36hr	Jan 27, 2022	N/A
GO-2022-0629	Feb 15, 2022	N/A
GO-2026-4980	May 7, 2026	N/A
GO-2024-2796	Jun 5, 2024	N/A
GO-2024-2529	Jun 28, 2024	N/A
GO-2026-5957	Jul 17, 2026	N/A
GO-2025-4206	Dec 15, 2025	N/A
GO-2025-4191	Dec 15, 2025	N/A
GO-2024-3063	Aug 13, 2024	N/A
GO-2025-3953	Sep 17, 2025	N/A
GO-2026-5009	May 20, 2026	N/A
GO-2026-6307	Sep 2, 2026	N/A
GO-2024-2906	Jun 14, 2024	N/A
GO-2025-4130	Nov 18, 2025	N/A
GO-2024-3030	Aug 6, 2024	N/A
GO-2026-6169	Aug 18, 2026	N/A
GO-2025-3835	Aug 11, 2025	N/A
GO-2026-6007	Jul 17, 2026	N/A
GO-2026-5871	Jul 7, 2026	N/A
GO-2026-6231	Aug 18, 2026	N/A
GO-2026-6306	Sep 2, 2026	N/A
GO-2022-1066	Aug 21, 2024	N/A
GO-2026-6577	Oct 1, 2026	N/A
GO-2026-5063	Jun 22, 2026	N/A
GO-2022-0620	Aug 21, 2024	N/A
GO-2026-6559	Oct 1, 2026	N/A
GO-2022-0456	Aug 21, 2024	N/A
GO-2026-5937	Jul 17, 2026	N/A
GO-2026-4509	Feb 24, 2026	N/A
GO-2025-3973	Sep 24, 2025	N/A
GO-2024-2941	Jun 28, 2024	N/A
GO-2025-3965	Sep 24, 2025	N/A
GO-2024-2589	Jun 28, 2024	N/A
GO-2026-5639	Jun 25, 2026	N/A
GO-2024-3126	Sep 13, 2024	N/A
GO-2023-2344	Aug 21, 2024	N/A
GO-2022-0599	Aug 21, 2024	N/A
GO-2025-3854	Aug 11, 2025	N/A
GO-2026-6125	Aug 18, 2026	N/A
GO-2026-5713	Jul 7, 2026	N/A
GO-2026-5054	Jun 16, 2026	N/A
GO-2026-5798	Jul 7, 2026	N/A
GO-2026-4406	Feb 5, 2026	N/A
GO-2025-3951	Sep 17, 2025	N/A
GO-2022-0929	Aug 21, 2024	N/A
GO-2024-3012	Jul 31, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.