SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel

matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

EVE Doesn't Measure Config Partition From 2 Fronts in github.com/lf-edge/eve

Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.

This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

The fix sets a limit on the amount of excess header frames we will process before closing a connection.

File Browser has a DoS Vulnerability via Public Login API in github.com/filebrowser/filebrowser

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Ollama allows deletion of arbitrary files in github.com/ollama/ollama

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 in gitea.dev

Portainer missing authorization on Docker plugin endpoints, which allows host RCE in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer from v2.33.0 before v2.33.8, from v2.39.0 before v2.39.2, from v2.40.0 before v2.41.0.

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth in github.com/traefik/traefik

Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher

OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex in github.com/oauth2-proxy/oauth2-proxy

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery

usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos

melange has Path Traversal via .PKGINFO in --persist-lint-results in chainguard.dev/melange

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in github.com/siyuan-note/siyuan/kernel

Denial of service via deflate compression bomb in github.com/crewjam/saml

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality in github.com/sigstore/timestamp-authority

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes

HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service.

filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser

Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks in github.com/MANTRA-Chain/mantrachain

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability in github.com/apache/answer

File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser

Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) in github.com/juev/nebula-mesh

CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd

Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz

Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd

New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api

HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault

CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server in github.com/kubeedge/kubeedge

Infinite loop in github.com/gomarkdown/markdown

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu

Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server

### Description

Moby is the open source Linux container runtime and set of components used to build a variety of downstream container runtimes, including Docker CE, Mirantis Container Runtime (formerly Docker EE), and Docker Desktop. Moby allows for building container images using a set of build instructions (usually named and referred to as a "Dockerfile"), and a build context, which is not unlike the CWD in which the Dockerfile instructions are executed.

Containers may be built using a variety of tools and build backends available in the Moby ecosystem; in all cases, builds may not include files outside of the build context (such as using absolute or relative-parent paths). This is enforced through both checks in the build backends, and the containerization of the build process itself.

Versions of Git where CVE-2022-39253 is present and exploited by a malicious repository, when used in combination with Moby, are subject to an unexpected inclusion of arbitrary filesystem paths in the build context, without any visible warning to the user.

This issue was originally reported by Wenxiang Qian of Tencent Blade Team, and the root-cause analysis was performed by Cory Snider of Mirantis, with assistance from Bjorn Neergaard of the same. The issue was then reported to the Git project, and Taylor Blau led the process resolving the root issue in Git.

### Impact

This vulnerability originates in Git, but can be used to violate assumptions that may have security implications for users of Moby and related components. Users may rely on the fact that a build context ensures that outside files cannot be referenced or incorporated using multiple enforcement mechanisms, or expect a warning if this does not hold true. A maliciously crafted Git repository exploiting CVE-2022-39253 can violate this assumption, and potentially include sensitive files that are subsequently uploaded to a container image repository, or disclosed by code inside the resulting container image.

As this issue cannot be triggered remotely, except by users who already have full control over the daemon through the API, and it requires exploiting a vulnerability in Git by convincing a user to build a maliciously crafted repository, the impact in Moby is considered low.

### Patches

Moby 20.10.20, and Mirantis Container Runtime (formerly Docker Enterprise Edition) 20.10.14 will contain mitigations for CVE-2022-39253 when a Git clone is performed by Moby components (on either the daemon or API client side). However, as these mitigations only apply to certain scenarios (build of `git+<protocol>://...` URL contexts) and cannot protect against a malicious repository already on disk, users should update to a version of Git containing patches for CVE-2022-39253 on all their systems running both API clients and daemons.

Specifically, patches in Moby (including patches incorporated from BuildKit) protect against the following:

* `docker build` with the legacy builder (e.g. `DOCKER_BUILDKIT` unset or set to 0) of a Git URL context. Note that depending on available API versions and the CLI version, the Git clone operation can take place on either the client or the daemon side. Both must be updated (or have Git updated) to fully protect this build method.
* `docker build` with the BuildKit builder (e.g. `DOCKER_BUILDKIT=1`) of a Git URL context.
* `docker buildx build` with `BUILDKIT_CONTEXT_KEEP_GIT_DIR=1` of a Git URL context.

Patches in BuildKit incorporated into Docker Compose protect against CVE-2022-39253 during Compose-driven builds of Git URL contexts.

Patches in Moby and related projects such as BuildKit, the Docker CLI, and Docker Compose **cannot** fully protect against CVE-2022-39253, as it may be triggered by a malicious repository already on disk that a unpatched Git client has interacted with (specifically, commands that check out submodules such as `git clone --recursive`, `git submodule update`, etc.  may have already triggered the Git vulnerability).

### Workarounds

While this behavior is unexpected and undesirable, and has resulted in this security advisory, users should keep in mind that building a container entails arbitrary code execution. Users should not build a repository/build context they do not trust, as containerization cannot protect against all possible attacks.

When building with BuildKit (e.g. `docker buildx build` or `docker build` with `DOCKER_BUILDKIT=1`), this issue cannot be exploited unless `--build-arg BUILDKIT_CONTEXT_KEEP_GIT_DIR=1` was also passed, as by default BuildKit will discard the `.git` directory of a Git URL context immediately after cloning and checking out the repository.

### For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/moby/moby/issues/new)
* Email us at [security@docker.com](mailto:security@docker.com)

Potential creation of an invalid signature from correct inputs.

Some inputs to the blst_fp_eucl_inverse function can produce incorrect outputs. This could theoretically permit the creation of an invalid signature from correct inputs.

Yapscan Denial of Service vulnerability in report server in github.com/fkie-cad/yapscan

Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall

Groth16 commitment extension unsound for more than one commitment in github.com/consensys/gnark

Random data used to create UUIDs can contain zeros, resulting in predictable UUIDs and possible collisions.

Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts in github.com/mattermost/mattermost-server

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.

We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

Gokapi vulnerable to Privilege Escalation in File Replace in github.com/forceu/gokapi.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/forceu/gokapi before v2.2.4.

NATS allows MQTT clients to bypass ACL checks in github.com/nats-io/nats-server

Vikunja Missing Authorization on CalDAV Task Read in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.3.0.

Incorrect exponentiation results in github.com/consensys/gnark-crypto

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon

Mattermost Server does not enforce rate limits on password change attempts in github.com/mattermost/mattermost-server

Ollama Divide By Zero vulnerability in github.com/ollama/ollama

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

NietThijmen ShoppingCart: Command injection in the connect function in github.com/NietThijmen/ShoppingCart

OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs in github.com/axllent/mailpit

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.

For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.

Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.

Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core

Ollama Divide by Zero Vulnerability in github.com/ollama/ollama

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE in github.com/cloudnative-pg/cloudnative-pg

Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer from v2.33.0 before v2.33.8, from v2.39.0 before v2.39.2, from v2.40.0 before v2.41.0.

Under-validated ComSpec and cmd.exe resolution in Mutagen projects in github.com/mutagen-io/mutagen

goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy in github.com/ryanbekhen/nanoproxy

gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify

Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing in github.com/traefik/traefik

Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server

Open Redirect in github.com/greenpau/caddy-security

HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug

Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego

snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/snapcore/snapd before v2.62.0.

Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor

RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows

The Context.UploadFormFiles function is vulnerable to directory traversal attacks, and can be made to write to arbitrary locations outside the destination directory.

This vulnerability only occurs when built with Go versions prior to 1.17. Go 1.17 and later strip directory paths from filenames returned by "mime/multipart".Part.FileName, which avoids this issue.

Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes

DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint in github.com/digitalocean/droplet-agent

Kyverno Controller Denial of Service via forEach Mutation Panic in github.com/kyverno/kyverno

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) in github.com/axllent/mailpit

Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v3.4.6, from v4.0.0 before v4.9.1.

source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller

Improper input validation in CNCF Cortex in github.com/cortexproject/cortex

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server in github.com/argoproj/argo-cd

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

CoreDNS ACL Bypass in github.com/coredns/coredns

go-zserio has Unbounded Memory Allocation for All Platforms in github.com/woven-planet/go-zserio

Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd

Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner

A race between chown and chmod operations during a container filesystem shift may allow a user who can modify the filesystem to chmod an arbitrary path of their choice, rather than the expected path.

CloudCore UDS Server: Malicious Message can crash CloudCore in github.com/kubeedge/kubeedge

CVE ID↕	Published↕	CVSS↓
GO-2026-6424	Sep 10, 2026	N/A
GO-2025-3397	Jan 16, 2025	N/A
GO-2022-1037	Oct 6, 2022	N/A
GO-2026-4430	Feb 5, 2026	N/A
GO-2023-1971	Aug 20, 2024	N/A
GO-2024-2687	Apr 3, 2024	N/A
GO-2026-5691	Jun 25, 2026	N/A
GO-2026-5630	Jun 25, 2026	N/A
GO-2026-4977	May 7, 2026	N/A
GO-2025-3851	Aug 11, 2025	N/A
GO-2026-6068	Jul 27, 2026	N/A
GO-2026-5639	Jun 25, 2026	N/A
GO-2026-6211	Aug 18, 2026	N/A
GO-2023-1991	Aug 20, 2024	N/A
GO-2026-5559	Jun 25, 2026	N/A
GO-2026-5979	Jul 17, 2026	N/A
GO-2022-1240	Aug 21, 2024	N/A
GO-2026-5562	Jun 25, 2026	N/A
GO-2026-5712	Jun 25, 2026	N/A
GO-2026-4387	Feb 2, 2026	N/A
GO-2023-1664	Aug 23, 2023	N/A
GO-2026-6221	Aug 18, 2026	N/A
GO-2026-5851	Jul 7, 2026	N/A
GO-2026-5390	Jun 25, 2026	N/A
GO-2024-2780	Jun 10, 2024	N/A
GO-2022-0969	Sep 12, 2022	N/A
GO-2025-3785	Jul 28, 2025	N/A
GO-2025-3929	Sep 17, 2025	N/A
GO-2020-0049	Apr 14, 2021	N/A
GO-2025-3997	Oct 23, 2025	N/A
GO-2026-6148	Aug 18, 2026	N/A
GO-2026-5966	Jul 17, 2026	N/A
GO-2023-1899	Aug 20, 2024	N/A
GO-2021-0228	Jan 14, 2022	N/A
GO-2026-5816	Jul 7, 2026	N/A
GO-2025-4003	Nov 5, 2025	N/A
GO-2025-3922	Sep 17, 2025	N/A
GO-2022-0454	Aug 21, 2024	N/A
GO-2026-4532	Feb 25, 2026	N/A
GO-2022-1021	Aug 21, 2024	N/A
GO-2022-0501	Aug 21, 2024	N/A
GO-2024-3205	Dec 12, 2024	N/A
GO-2026-6019	Jul 22, 2026	N/A
GO-2026-5909	Jul 7, 2026	N/A
GO-2024-3182	Oct 9, 2024	N/A
GO-2025-3906	Aug 29, 2025	N/A
GHSA-vp35-85q5-9f25	Nov 11, 2022	N/A
GO-2022-1053	Oct 18, 2022	N/A
GO-2023-1607	Aug 20, 2024	N/A
GO-2026-4742	Mar 23, 2026	N/A
GO-2024-3122	Nov 20, 2024	N/A
GO-2022-0244	Jul 15, 2022	N/A
GO-2026-4496	Feb 23, 2026	N/A
GO-2026-6602	Oct 8, 2026	N/A
GO-2026-4696	Mar 16, 2026	N/A
GO-2026-4834	Mar 26, 2026	N/A
GO-2026-5114	Jun 25, 2026	N/A
GO-2023-2101	Oct 9, 2023	N/A
GO-2026-5903	Jul 7, 2026	N/A
GO-2025-4051	Oct 30, 2025	N/A
GO-2025-3559	Mar 31, 2025	N/A
GO-2026-5062	Jun 18, 2026	N/A
GO-2026-5398	Jun 25, 2026	N/A
GO-2024-3360	Jan 7, 2025	N/A
GO-2026-5599	Jun 25, 2026	N/A
GO-2024-3321	Dec 11, 2024	N/A
GO-2025-3457	Feb 7, 2025	N/A
GO-2025-3689	May 15, 2025	N/A
GO-2026-5106	Jun 25, 2026	N/A
GO-2026-5633	Jun 25, 2026	N/A
GO-2023-1758	Aug 20, 2024	N/A
GO-2026-5625	Jun 25, 2026	N/A
GO-2024-3330	Dec 13, 2024	N/A
GO-2026-5416	Jun 25, 2026	N/A
GO-2026-6204	Aug 18, 2026	N/A
GO-2024-3020	Aug 6, 2024	N/A
GO-2024-2560	Jun 28, 2024	N/A
GO-2025-3413	Jan 28, 2025	N/A
GO-2024-3331	Dec 18, 2024	N/A
GO-2024-3007	Aug 6, 2024	N/A
GO-2026-5309	Jul 24, 2026	N/A
GO-2026-5438	Jun 25, 2026	N/A
GO-2025-4223	Dec 15, 2025	N/A
GO-2022-0272	Jul 15, 2022	N/A
GO-2023-1985	Aug 20, 2024	N/A
GO-2026-4854	Mar 26, 2026	N/A
GO-2026-5374	Jun 25, 2026	N/A
GO-2026-5868	Jul 7, 2026	N/A
GO-2026-4319	Jan 23, 2026	N/A
GO-2024-2859	Jun 4, 2024	N/A
GO-2022-0915	Aug 21, 2024	N/A
GO-2022-0453	Aug 21, 2024	N/A
GO-2026-6549	Oct 1, 2026	N/A
GO-2026-4630	Mar 10, 2026	N/A
GO-2026-5759	Jun 25, 2026	N/A
GO-2024-2491	Jun 28, 2024	N/A
GO-2024-2902	Jun 14, 2024	N/A
GO-2026-5218	Jun 25, 2026	N/A
GO-2021-0071	Apr 14, 2021	N/A
GO-2022-0500	Aug 21, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.