Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server

### Impact
Blst versions v0.3.0 to v0.3.2 can produce the incorrect outputs for some inputs to the blst_fp_eucl_inverse function. This could theoretically result in the creation of an invalid signature from correct inputs. However, fuzzing of higher level functions such as sign and verify were unable to produce incorrect results and there has been no reported occurrences of this issue being encountered in production use.

### Description
During the course of differential fuzzing of the blst library by @guidovranken it was discovered that blst would produce the incorrect result for some input values in the inverse function. This was the result of the introduction of a new inversion formula in version v0.3.0. This source of these incorrect outputs was due to two issues:

1. The amount of inner loop iterations was not sufficient for the algorithm to converge.
2. It was erroneously assumed that the absolute value of the intermediate result would be capped at 767-bits. As a result, some output values were truncated by one bit or the most significant bit was misinterpreted as the sign.

### Patches
This issue has been resolved in the v0.3.3 release and users are recommended to upgrade immediately.

### References
The software used to uncover this issue can be found [here](https://github.com/guidovranken/cryptofuzz).

### Credits
A special thanks to Guido Vranken (@guidovranken) for his discovery and disclosure of this vulnerability.

### For more information
If you have any questions or comments about this advisory please email us at [hello@supranational.net](mailto:hello@supranational.net)

Unencrypted transmission in Temporal api-go library in go.temporal.io/api

nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction in github.com/juev/nebula-mesh

usememos/memos Improper Access Control vulnerability in github.com/usememos/memos

The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature.

When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support a plugin mechanism in which a shared-library plugin is loaded into the compiler, as directed by compiler flags. This means that a Go package repository can contain an attack.so file along with a Go source file that says (for example) "// #cgo CFLAGS: -fplugin=attack.so" causing the attack plugin to be loaded into the host C compiler during the build. Gcc and clang plugins are completely unrestricted in their access to the host system.

RobotsAndPencils go-saml authentication bypass vulnerability in github.com/RobotsAndPencils/go-saml

Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server

Path traversal in serve s3 in github.com/rclone/rclone

Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/juju/juju before v0.0.0-20240829052008-43f0fc59790d.

If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is not charged.

No patch will be released, as the package is planned to be deprecated and replaced.

CVE-2017-18901 in github.com/mattermost/mattermost-server

A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Vikunja has Algorithmic Complexity DoS in Repeating Task Handler in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.3.0.

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend

Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing

Argo Exposure of Sensitive Information in github.com/argoproj/argo-cd

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

Gogs has an Open Redirect via redirect_to in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Denial of service from malicious manifest in kyverno in github.com/kyverno/kyverno

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel

OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.4.1.

usememos/memos vulnerable to Improper Authorization in github.com/usememos/memos

OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console

Path Traversal in file editor on Windows in Gogs in gogs.io/gogs

Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server

There is insufficient entropy in the implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt functions are less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.

Users are encouraged to migrate to the new crypto package introduced in v7.2.0.

OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.4.4.

Mellium allows Authentication Bypass by Spoofing in mellium.im/xmpp

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage in github.com/siyuan-note/siyuan/kernel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.5.10.

Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego

### Impact

Allows admin API access to the IPFS node.

### Who ?

This affects people running the  [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml) service in an environment where the docker host is directly attached to a public or untrusted IP.  In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as `0.0.0.0:5001` on the host machine.  

If the host machine is hidden behind a firewall or NAT (and the LAN is trusted for NAT), this is not an immediate issue because of the protection from the firewall or NAT.  That said, we still recommend users update to follow security best practices of not putting unnecessary dependency on a working firewall.

### Patches
This issue is in [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml).  Users need to replace their current `docker-compose.yaml` file with a version `0.12.1` or later.

There is no need to update any of the binaries. Users running previous versions like `0.12.0` or earlier can download the `0.12.1` `docker-compose.yaml` file.  You can replace a vulnerable `docker-compose.yaml` file with a the new one with:

```
curl https://raw.githubusercontent.com/ipfs/go-ipfs/v0.12.1/docker-compose.yaml > docker-compose.yaml
```

### How to test if you are vulnerable
#### Binding check on the host
On the host machine, while IPFS is running, run as root:

```bash
netstat -lnp | grep ":5001"
```

The output will be a list of listeners bound to `:5001`.
You then need to check that those listeners are private and preferably even localhost IPs.
⚠️ If this listener is on `0.0.0.0` or a public IP you are very likely vulnerable.

#### Remote hailing
While IPFS is running, you can try to contact the API from a remote machine. (Replace `1.2.3.4` with your node public IP.  Or if you want to test in an untrusted NAT, then substitute the LAN IP instead.)

```bash
curl -X POST http://1.2.3.4:5001/api/v0/version
```

⚠️ If you see any json outputted (e.g.,  `{"Commit": "<string>","Golang": "<string>","Repo": "<string>","System": "<string>","Version": "<string>"}`), then you are vulnerable.

If it **fails**, then you are safe.

### For more information
If you have any questions or comments about this advisory:
* Please first read https://docs.ipfs.io/reference/http/api/ about best practices
* Ask in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)
* Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)


Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

OliveTin OS Command Injection vulnerability in github.com/OliveTin/OliveTin

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission

An attacker can effectively bypass the rate limit and brute force protections in Argo CD by exploiting the application's weak cache-based mechanism. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account.

The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard ("*") while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices.

Blocky DNSSEC validation bypass and validation-cache scope pollution in github.com/0xERR0R/blocky

SM9 Infinity-Point Ciphertext Forgery Vulnerability in github.com/emmansun/gmsm

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes in github.com/eclipse/paho.mqtt.golang

Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno

DoS in cert-manager-controller via Specially Crafted DNS Response in github.com/cert-manager/cert-manager

EVE Seals Vault Key With SHA1 PCRs in github.com/lf-edge/eve

In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments due to a buffer overflow error.

If using wasm_exec.js to execute WASM modules, users will need to replace their copy (as described in https://golang.org/wiki/WebAssembly#getting-started) after rebuilding any modules.

mrpack-install vulnerable to path traversal with dependency in github.com/nothub/mrpack-install

one-api Cross-site Scripting vulnerability in github.com/songquanpeng/one-api

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos

Kgateway transformation policy template can emit files from the container in github.com/kgateway-dev/kgateway

Zitadel allows brute-forcing authentication factors in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.71.18.

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests in gitea.dev

lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs

OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits.

Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.

LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper

Caddy MatchPath %xx branch skips case normalization in github.com/caddyserver/caddy/v2

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf

Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall

SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd

### Vulnerability type
Data Exposure

### Workarounds
The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The [etcd doesn't encrypt key/value data stored on disk drives](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md#does-etcd-encrypt-data-stored-on-disk-drives).

### Detail
User credentials (login and password) are stored in WAL entries on each user authentication. If the WAL log files are not secure, it can potentially expose sensitive information.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)

Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats

Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault

Grafana stored XSS in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v6.7.2.

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd

Ollama is vulnerable to a heap out-of-bounds read in its GGUF model loader. A specially crafted GGUF file can cause the loader to read beyond the allocated heap buffer, potentially leading to a denial of service (crash).

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft

Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault

### Impact
Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP.

Users that configure Fleet with SSO login may be vulnerable to this issue.

### Patches
This issue is patched in 3.5.1 using https://github.com/mattermost/xml-roundtrip-validator.

### Workarounds
If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

### References
See https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ for more information about the underlying vulnerabilities.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
* Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron in github.com/nezhahq/nezha

Grafana Alerting VictorOps integration could be exposed to users with Viewer permission in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v10.4.15, from v11.0.0 before v11.0.11, from v11.1.0 before v11.1.11, from v11.2.0 before v11.2.6, from v11.3.0 before v11.3.3, from v11.4.0 before v11.4.1.

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents in gitea.dev

The OTLP HTTP exporters (traces, metrics, and logs) do not limit the size of the HTTP response body read from the collector. A malicious or misconfigured collector can send a large response body, leading to excessive memory consumption and potential process termination (OOM).

(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A malicious PostgreSQL endpoint or active network attacker on an unauthenticated transport can send malformed row responses, causing unrecovered runtime panics while reading query results.

Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents.

IncusOS has a LUKS encryption bypass due to insufficient TPM policy in github.com/lxc/incus-os/incus-osd

qui CORS Misconfiguration: Arbitrary Origins Trusted in github.com/autobrr/qui

Insecure cookies in Openshift Origin in github.com/openshift/origin

CoreDNS' DoQ worker pool does not bound stream backlog in github.com/coredns/coredns

Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain.

Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

Prometheus has Stored XSS via metric names and label values in Prometheus web UI in github.com/prometheus/prometheus

goshs has a Path Traversal issue in github.com/patrickhener/goshs

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

In github.com/xuri/excelize/v2, the streaming worksheet reader used by Rows and GetRows does not enforce the maximum row limit (TotalRows) on row "r" attributes. A crafted spreadsheet with an out-of-bounds row index causes GetRows to allocate empty row slices up to the specified row number, leading to excessive memory consumption and denial of service.

FTP command injection via custom encoding in github.com/rclone/rclone

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser

CVE ID↕	Published↕	CVSS↑
GO-2024-3089	Aug 30, 2024	N/A
GHSA-x279-68rr-jp4p	Oct 7, 2022	N/A
GO-2025-3462	Mar 3, 2025	N/A
GO-2026-5815	Jul 7, 2026	N/A
GO-2023-1291	Aug 20, 2024	N/A
GO-2022-0201	Aug 9, 2022	N/A
GO-2024-3048	Aug 6, 2024	N/A
GO-2025-4045	Oct 30, 2025	N/A
GO-2026-6189	Aug 18, 2026	N/A
GO-2024-3175	Oct 9, 2024	N/A
GO-2023-1881	Jul 6, 2023	N/A
GO-2026-4304	Jan 13, 2026	N/A
GO-2024-2785	Jun 4, 2024	N/A
GO-2026-5556	Jun 25, 2026	N/A
GO-2026-5608	Jun 25, 2026	N/A
GO-2026-5938	Jul 17, 2026	N/A
GO-2025-4209	Dec 15, 2025	N/A
GO-2026-5561	Jun 25, 2026	N/A
GO-2026-5808	Jul 7, 2026	N/A
GO-2026-6258	Aug 25, 2026	N/A
GO-2023-1952	Aug 20, 2024	N/A
GO-2025-3555	Mar 25, 2025	N/A
GO-2026-5773	Jun 25, 2026	N/A
GO-2023-2335	Aug 21, 2024	N/A
GO-2026-6434	Sep 10, 2026	N/A
GO-2025-4039	Oct 30, 2025	N/A
GO-2022-1248	Aug 21, 2024	N/A
GO-2024-3289	Nov 27, 2024	N/A
GO-2022-0570	Aug 21, 2024	N/A
GO-2024-3024	Aug 6, 2024	N/A
GO-2023-2385	Jan 2, 2024	N/A
GO-2025-4156	Nov 25, 2025	N/A
GO-2024-3157	Sep 26, 2024	N/A
GO-2026-5072	Jun 25, 2026	N/A
GO-2026-4646	Mar 10, 2026	N/A
GO-2025-3847	Aug 11, 2025	N/A
GHSA-fx5p-f64h-93xc	Apr 4, 2022	N/A
GO-2026-4863	Apr 2, 2026	N/A
GO-2025-3601	Apr 10, 2025	N/A
GO-2025-3886	Aug 18, 2025	N/A
GO-2026-5850	Jul 7, 2026	N/A
GO-2024-2652	Mar 22, 2024	N/A
GO-2024-2574	May 20, 2024	N/A
GO-2026-5745	Jun 25, 2026	N/A
GO-2026-4694	Mar 13, 2026	N/A
GO-2025-4173	Dec 15, 2025	N/A
GO-2024-3230	Oct 30, 2024	N/A
GO-2026-4399	Feb 19, 2026	N/A
GO-2026-4434	Feb 17, 2026	N/A
GO-2024-2521	Jun 28, 2024	N/A
GO-2022-0247	May 24, 2022	N/A
GO-2023-1543	Aug 20, 2024	N/A
GO-2025-3636	Apr 22, 2025	N/A
GO-2026-4620	Mar 10, 2026	N/A
GO-2022-1236	Aug 21, 2024	N/A
GO-2025-4095	Nov 17, 2025	N/A
GO-2025-4085	Nov 5, 2025	N/A
GO-2026-6055	Jul 22, 2026	N/A
GO-2025-4090	Nov 17, 2025	N/A
GO-2022-0252	Jul 15, 2022	N/A
GO-2024-2875	Jun 5, 2024	N/A
GO-2020-0050	Apr 14, 2021	N/A
GO-2025-3508	Mar 13, 2025	N/A
GO-2026-4538	Feb 26, 2026	N/A
GO-2026-5843	Jul 7, 2026	N/A
GO-2026-5097	Jun 25, 2026	N/A
GO-2025-3362	Jan 7, 2025	N/A
GO-2026-6444	Sep 16, 2026	N/A
GHSA-528j-9r78-wffx	Oct 6, 2022	N/A
GO-2025-4253	Jan 23, 2026	N/A
GO-2025-3836	Aug 11, 2025	N/A
GO-2024-2523	Jun 28, 2024	N/A
GO-2026-6579	Oct 1, 2026	N/A
GO-2025-3698	May 23, 2025	N/A
GO-2025-3533	Mar 26, 2025	N/A
GO-2024-3313	Dec 9, 2024	N/A
GO-2026-5748	Jul 27, 2026	N/A
GO-2026-6459	Sep 16, 2026	N/A
GO-2024-3259	Nov 20, 2024	N/A
GO-2022-0632	Aug 21, 2024	N/A
GHSA-w3wf-cfx3-6gcx	Feb 11, 2022	N/A
GO-2026-5436	Jun 25, 2026	N/A
GO-2026-5282	Jun 25, 2026	N/A
GO-2025-3438	Feb 4, 2025	N/A
GO-2026-6050	Jul 22, 2026	N/A
GO-2026-4985	May 26, 2026	N/A
GO-2026-6171	Aug 18, 2026	N/A
GO-2021-0242	Feb 17, 2022	N/A
GO-2026-4704	Mar 26, 2026	N/A
GO-2026-4774	Mar 23, 2026	N/A
GO-2022-0505	Aug 21, 2024	N/A
GO-2026-4969	May 20, 2026	N/A
GO-2024-2905	Jun 28, 2024	N/A
GO-2025-3373	Jan 28, 2025	N/A
GO-2026-5662	Jun 25, 2026	N/A
GO-2026-6137	Aug 18, 2026	N/A
GO-2026-5026	May 22, 2026	N/A
GO-2026-6453	Sep 16, 2026	N/A
GO-2026-6187	Aug 18, 2026	N/A
GO-2026-5383	Jun 25, 2026	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.