Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nuclio/nuclio before v1.16.5.

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.3.2.

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt

Answer vulnerable to Business Logic Errors in github.com/answerdev/answer

OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza

NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server

Argo CD repo-server Denial of Service vulnerability in github.com/argoproj/argo-cd

Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened.

The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall

Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve

User Registration Bypass in Zitadel in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.58.7, from v2.59.0 before v2.59.5, from v2.60.0 before v2.60.4, from v2.61.0 before v2.61.4, from v2.62.0 before v2.62.7, from v2.63.0 before v2.63.5.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

GoBGP does not verify that the input length in github.com/osrg/gobgp

traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) in github.com/traefik/traefik

Alist has Insecure TLS Config in github.com/alist-org/alist

usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos

nhost has Session Persistence After Password Change in github.com/nhost/nhost

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.5.4.

NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server

A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.

Mattermost Server allows XSS via redirect URL in github.com/mattermost/mattermost-server

ZITADEL has LDAP Filter Injection in Login Flow in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v3.1.0 before v3.4.10; github.com/zitadel/zitadel from v4.0.0 before v4.15.0.

Mattermost Server is vulnerable to XSS via a Legal or Support setting in github.com/mattermost/mattermost-server

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key in github.com/nezhahq/nezha.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nezhahq/nezha before v2.0.13.

Hysteria: http large header with sniff cause server DoS in github.com/apernet/hysteria.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/apernet/hysteria before v2.9.2.

Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio

projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei

EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve

Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange in github.com/pocket-id/pocket-id/backend

Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260127062706-c6b205f0d770.

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events

snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/snapcore/snapd before v2.62.0.

Reflected XSS in go-httpbin due to unrestricted client control over Content-Type in github.com/mccutchen/go-httpbin

fabedge has insecure permissions in github.com/fabedge/fabedge

HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault

Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server

Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git

Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names in github.com/mattermost/mattermost-server

Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea

The Ctx.IsFromLocal function can incorrectly report a request as being sent from localhost when the request contains an X-Forwarded-For header containing a localhost IP address.

WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora

Dapr API Token Exposure in github.com/dapr/dapr

Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/rancher/rancher from v2.9.0 before v2.9.4.

Mismatched bit-length validation in can lead to panic in cosmossdk.io/math

Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/dunglas/frankenphp before v1.1.11.

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

Rancher Login Parameter Can Be Edited in github.com/rancher/rancher

Docker Swarm encrypted overlay network traffic may be unencrypted in github.com/docker/docker

Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd

Mattermost Server allows users with a session ID to revoke another users' session in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server before v4.1.2-0.20171004201910-6be8113eb60c, before v4.2.1-0.20171004192657-8fbbd688ea24.

ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v2.50.0 before v2.71.19, from v3.0.0-rc.1 before v3.4.4, from v4.0.0-rc.1 before v4.6.6.

Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host in github.com/nezhahq/nezha in github.com/naiba/nezha.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/naiba/nezha before v2.0.10.

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fr2g-9hjm-wr23. This link is maintained to preserve external references.

## Original Description
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.

Mattermost fails to limit the size of responses from integration action endpoints in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260127165411-fe3052073dc6.

Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder in github.com/gofiber/fiber

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

kOps privilege escalation vulnerability in k8s.io/kops

Harbor: LDAP password and OIDC secret are not redacted in the audit log in github.com/goharbor/harbor

secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller

Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw in github.com/mattermost/mattermost-server

Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information in github.com/grafana/synthetic-monitoring-agent

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nuclio/nuclio before v1.16.5.

step-ca Has Improper Authorization Check for SSH Certificate Revocation in github.com/smallstep/certificates

Cross-site Scripting in github.com/schollz/rwtxt

Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/rancher/rancher from v2.9.0 before v2.9.12, from v2.10.0 before v2.10.10, from v2.11.0 before v2.11.6, from v2.12.0 before v2.12.2.

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser

Stored XSS using two files in usememos/memos in github.com/usememos/memos

Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20251210191531-cd17b61de41b.

Potential creation of an invalid signature from correct inputs.

Some inputs to the blst_fp_eucl_inverse function can produce incorrect outputs. This could theoretically permit the creation of an invalid signature from correct inputs.

Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea

Gitea Improper Input Validation in github.com/go-gitea/gitea

Mattermost Server is vulnerable to XSS through crafted links in github.com/mattermost/mattermost-server

The "go get" command allows remote command execution.

Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get".

usememos/memos Improper Authorization vulnerability in github.com/usememos/memos

Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric

URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file.

ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.42.17, from v2.43.0 before v2.43.11, from v2.44.0 before v2.44.7, from v2.45.0 before v2.45.5, from v2.46.0 before v2.46.5, from v2.47.0 before v2.47.8, from v2.48.0 before v2.48.3.

HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File in github.com/hashicorp/vault

Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor

A malicious actor can introduce links starting with a "javascript:" scheme due to insufficient checks on external resources. This can be used as a part of Cross-site Scripting (XSS) attack.

SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled.

Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/projectcalico/calico/v3 before v3.31.6.

Filestash skips TLS certificate verification process when sending out email verification codes in github.com/mickael-kerjean/filestash

Exposure of server configuration in github.com/go-vela/server in github.com/go-vela/compiler

OliveTin's RestartAction always runs actions as guest in github.com/OliveTin/OliveTin

Mattermost fails to verify run_create permission for empty playbookId in github.com/mattermost/mattermost-plugin-playbooks

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.0.0-20251121122154-b57c297c6d7.

CVE ID↕	Published↕	CVSS↑
GO-2026-6004	Jul 17, 2026	N/A
GO-2025-3859	Aug 11, 2025	N/A
GO-2026-5897	Jul 7, 2026	N/A
GO-2024-2816	Jun 5, 2024	N/A
GO-2023-1660	Aug 20, 2024	N/A
GO-2025-3537	Mar 25, 2025	N/A
GO-2026-4826	Mar 26, 2026	N/A
GO-2023-2050	Aug 21, 2024	N/A
GO-2026-5761	Jul 7, 2026	N/A
GO-2026-4602	Mar 6, 2026	N/A
GO-2024-2850	Jun 5, 2024	N/A
GO-2026-5108	Jun 25, 2026	N/A
GO-2026-4290	Jan 12, 2026	N/A
GO-2024-3217	Oct 28, 2024	N/A
GO-2024-2610	Mar 5, 2024	N/A
GO-2025-3633	Apr 22, 2025	N/A
GO-2026-4597	Mar 10, 2026	N/A
GO-2026-4414	Feb 5, 2026	N/A
GO-2022-1264	Aug 21, 2024	N/A
GO-2026-5222	Jun 25, 2026	N/A
GO-2026-5225	Jun 25, 2026	N/A
GO-2023-2066	Aug 21, 2024	N/A
GO-2021-0087	Apr 14, 2021	N/A
GO-2025-4053	Oct 30, 2025	N/A
GO-2026-5648	Jun 25, 2026	N/A
GO-2025-4056	Oct 30, 2025	N/A
GO-2026-5828	Jul 7, 2026	N/A
GO-2026-5813	Jul 7, 2026	N/A
GO-2025-3722	Jun 3, 2025	N/A
GO-2024-2989	Jul 22, 2024	N/A
GO-2026-4432	Feb 5, 2026	N/A
GO-2026-4656	Mar 11, 2026	N/A
GO-2026-4734	Mar 23, 2026	N/A
GO-2025-3608	Apr 22, 2025	N/A
GO-2024-3008	Aug 6, 2024	N/A
GO-2025-3554	Mar 25, 2025	N/A
GO-2024-3027	Aug 6, 2024	N/A
GO-2025-4070	Oct 30, 2025	N/A
GO-2025-3620	Apr 22, 2025	N/A
GO-2026-4910	Apr 7, 2026	N/A
GO-2025-3551	Mar 25, 2025	N/A
GO-2025-4184	Dec 8, 2025	N/A
GO-2026-5321	Jun 25, 2026	N/A
GO-2023-2052	Sep 12, 2023	N/A
GO-2026-4628	Mar 10, 2026	N/A
GO-2024-2879	May 24, 2024	N/A
GO-2025-3391	Jan 15, 2025	N/A
GO-2024-3279	Nov 21, 2024	N/A
GO-2026-4363	Feb 2, 2026	N/A
GO-2026-4353	Feb 2, 2026	N/A
GO-2024-2472	Jun 28, 2024	N/A
GO-2026-4442	Feb 17, 2026	N/A
GO-2026-5602	Jun 25, 2026	N/A
GO-2024-2761	Jun 5, 2024	N/A
GO-2023-1700	Aug 20, 2024	N/A
GO-2024-3188	Oct 11, 2024	N/A
GO-2025-4191	Dec 15, 2025	N/A
GO-2025-4124	Nov 17, 2025	N/A
GO-2026-4556	Feb 27, 2026	N/A
GO-2026-5194	Jun 25, 2026	N/A
GO-2022-0831	Aug 21, 2024	N/A
GHSA-4frv-5fj6-4p25	Oct 30, 2023	N/A
GO-2026-4726	Mar 26, 2026	N/A
GO-2025-3845	Aug 11, 2025	N/A
GO-2026-5019	May 22, 2026	N/A
GO-2025-3749	Jun 11, 2025	N/A
GO-2023-2125	Aug 21, 2024	N/A
GO-2026-4876	Apr 2, 2026	N/A
GO-2025-3939	Sep 17, 2025	N/A
GO-2026-5360	Jun 25, 2026	N/A
GO-2022-1132	Aug 21, 2024	N/A
GO-2026-6012	Jul 17, 2026	N/A
GO-2025-4181	Dec 8, 2025	N/A
GO-2022-0231	Aug 21, 2024	N/A
GO-2025-3984	Oct 23, 2025	N/A
GO-2026-5747	Jun 25, 2026	N/A
GO-2024-3274	Nov 19, 2024	N/A
GO-2026-4524	Feb 23, 2026	N/A
GO-2022-1053	Oct 18, 2022	N/A
GO-2025-4098	Nov 18, 2025	N/A
GO-2026-6031	Jul 22, 2026	N/A
GO-2022-0862	Aug 21, 2024	N/A
GO-2025-4064	Oct 30, 2025	N/A
GO-2022-0177	Aug 9, 2022	N/A
GO-2022-1245	Aug 21, 2024	N/A
GO-2024-3030	Aug 6, 2024	N/A
GO-2024-3099	Aug 30, 2024	N/A
GO-2024-2947	Jun 25, 2024	N/A
GO-2024-2665	Jun 5, 2024	N/A
GO-2023-1685	Aug 20, 2024	N/A
GO-2023-1754	Aug 20, 2024	N/A
GO-2023-1566	Feb 15, 2023	N/A
GO-2024-2605	Mar 11, 2024	N/A
GO-2026-5888	Jul 7, 2026	N/A
GO-2024-3035	Aug 6, 2024	N/A
GO-2022-0838	Aug 21, 2024	N/A
GO-2026-4625	Mar 10, 2026	N/A
GO-2026-4812	Mar 23, 2026	N/A
GO-2023-1702	Apr 5, 2023	N/A
GO-2025-4259	Feb 26, 2026	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.