Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend

The Parse function can panic on some invalid inputs.

For example, the Parse function panics on the input "<svg><template><desc><t><svg></template>".

### Impact

If your installation is using the `export-importer` service, there is potential impact.
If your installation is not importing keys via the `export-importer` services, your installation is not impacted.

In versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.

This could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.

### Patches

This is patched in `v0.18.3` and all versions `0.19.2` and later.

### Workarounds

Ensure that the servers you are importing export zip files from are not publishing keys too early. 

### References

n/a

### For more information

If you have any questions or comments about this advisory
* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)
* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)

Mattermost Fails to Verify User's Permissions When Accessing Groups in github.com/mattermost/mattermost-server

Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git

Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values in github.com/traefik/traefik

Client DoS via malformed server response in github.com/theupdateframework/go-tuf

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding in github.com/getkin/kin-openapi

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation in github.com/hashicorp/vault

Invalid block proposal in github.com/cosmos/cosmos-sdk

Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus

kraken contains an arbitrary file read vulnerability via component testfs.

Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium

ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs.

Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs.

Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/bishopfox/sliver before v1.6.0.

Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector.

HashiCorp Nomad vulnerable to symlink attack in github.com/hashicorp/nomad

LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd

Resource exhaustion in Mattermost in github.com/mattermost/mattermost-server

karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nezhahq/nezha from v2.0.0 before v2.0.10.

Mattermost Server has X.509 Improper Certificate Validation in github.com/mattermost/mattermost-server

NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.

Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation

Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v11.1.0 before v11.1.1, from v11.1.2 before v11.1.3.

Possible filesystem space exhaustion by local users in github.com/google/fscrypt

Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor

Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron

easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt

SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs in github.com/siyuan-note/siyuan/kernel

Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20251210191531-cd17b61de41b.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

elrond-go MultiESDTNFTTransfer call on a SC address with missing function name in github.com/ElrondNetwork/elrond-go

usememos/memos Improper Authorization vulnerability in github.com/usememos/memos

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain

GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp

Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server

Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access in github.com/akuity/kargo

Gogs has arbitrary file read/write via Path Traversal in Git hook editing in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.13.4.

Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker

Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/cubefs/cubefs before v3.3.1.

Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that
1) the Signer passed to AddHostKey does not implement AlgorithmSigner, and
2) the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey method.

Servers that only use Signer implementations provided by the ssh package are unaffected.

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.

A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request.

Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

Account compromise in Evmos in github.com/tharsis/evmos

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests.

With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

HashiCorp Nomad vulnerable to non-sensitive metadata exposure in github.com/hashicorp/nomad

Jellysweep uses uncontrolled data in image cache API endpoint in github.com/jon4hz/jellysweep

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

Artifact Hub allows unsafe rego built-in in github.com/artifacthub/hub

The ibc-go module is affected by the Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability. The vulnerability allowed an attacker to send arbitrary transactions onto target chains and trigger arbitrary state transitions, including but not limited to, theft of funds. It was possible to exploit this vulnerability in specific situations involving relaying packets in which the source chain is also the final destination chain. Affected networks are those that allow for fee grant capabilities and use a native Relayer (e.g., Osmosis and Juno).

Curio exposes database credentials to users with network access through verbose HTTP error responses in github.com/filecoin-project/curio

Cosmos EVM Vulnerability in github.com/cosmos/evm

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go

Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus

Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea

Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260323180334-daffe750de85.

## Amulet Security Advisory for CometBFT: ASA-2023-002

**Component**: CometBFT
**Criticality:** Low
**Affected versions:** All
**Affected users:** Validators, Chain Builders + Maintainers

# Summary

A default configuration in CometBFT has been found to be large for common use cases, and may affect block times and consensus participation when fully utilized by chain participants. It is advised that chains consider their specific needs for their use case when setting the `BlockParams.MaxBytes` consensus parameter. Chains are encouraged to evaluate the impact of having proposed blocks with the maximum allowed block size, especially on bandwidth usage and block latency. Additionally, the `timeout_propose` parameter should be computed using the maximum allowed block size as a reference. This issue does not represent an actively exploitable vulnerability that would result in a direct loss of funds, however it may have a slight impact on block latency depending on a network’s topography.

When setting a large `BlockParams.MaxBytes`, there are two main implications:
* Increased bandwidth to propagate a block
* Increased latency to propagate a block

When combined, this may result in less round participation, and in some cases additional rounds may be required to meet the consensus threshold, which could lead to timeouts depending on the topography of a network and environmental factors. These factors can include the number of validators on a network, geographic distribution, network connectivity (including latency, bandwidth, and reachability), the functionality of the modules implementing the logic for a transaction in your chain, etc.  The cost to propagate a 21MB block, the default value for `BlockParams.MaxBytes`, will be far higher than the cost of propagating a smaller 1MB block. CometBFT recommends tuning this parameter to a smaller limit if full initial-round participation is an important quality for your chain.

# Considerations
CometBFT is designed to be configurable by chains, and implements many different configuration variables and parameters to allow chain developers, validators, node operators, and chain participants to customize it best to their use case. A high-performing validator may find it necessary to experiment with tuning local configuration, optimizing network and compute resources, and implementing controls to inhibit spam.


# Next Steps for Chains and Validators

To increase awareness of the potential impacts of this default parameter, the CometBFT team has updated the documentation (https://github.com/cometbft/cometbft/pull/1405, [v0.34.x](https://docs.cometbft.com/v0.34/spec/abci/apps#blockparamsmaxbytes), [v0.37.x](https://docs.cometbft.com/v0.37/spec/abci/abci++_app_requirements#blockparamsmaxbytes), [v0.38.x](https://docs.cometbft.com/v0.38/spec/abci/abci++_app_requirements#blockparamsmaxbytes)) for builders and maintainers of chain applications. Additionally, it is recommended that:


* Chain ecosystems and their maintainers set a `BlockParams.MaxBytes` configuration appropriate for their use case at the application level; in some cases, fine-tuning `BlockParams` may require a network upgrade.
* Chain ecosystems and their maintainers evaluate how gas is used and required on their chain, including gas and fee parameters, no-fee or fee-exempt message policies, and ensure that any custom modules integrate with the gas and fee frameworks. This is especially important for chains that may have implemented custom modules or functionality to allow IBC messages to bypass fees.
* Chain ecosystems and their maintainers audit all of their currently-set parameters and configurations to ensure that they are appropriate for their use case.

* All validators develop and implement anti-spam measures on their nodes. Amulet encourages validators to form working groups to collaborate on spam prevention and on tooling that can be implemented by node operators across the Interchain.
* All validators consider developing and implementing tooling that would allow them to sample incoming transactions to enable them to fine-tune the level of service they would like to provide to be resilient in slowdown scenarios. Amulet also encourages validators to collaborate on tooling that can be implemented by node operators across the Interchain.


The CometBFT team has also revisited all the checks performed by the consensus protocol regarding proposed blocks. This investigation has confirmed that proposed blocks with size exceeding the `BlockParams.MaxBytes` limit established by the application are not accepted by nodes. The team notwithstanding has decided to introduce additional sanity checks for the size of proposed blocks (https://github.com/cometbft/cometbft/pull/1408), allowing for an early identification and rejection of invalid or oversized blocks. These code changes will be included in the _next_ release of each branch of CometBFT.

As more chains adopt the Interchain Stack for new and cutting-edge use cases, the CometBFT team recommends that all chains regularly evaluate their parameters and configurations to ensure they meet the needs of their ecosystem as their networks mature. 


For more information about CometBFT, see [https://docs.cometbft.com](https://docs.cometbft.com/). 





This issue was reported via the vulnerability disclosure channel at [security@interchain.io](mailto:security@interchain.io) on Friday, September 23, 2023. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see [https://hackerone.com/cosmos](https://hackerone.com/cosmos). 


*****

 
Note from Amulet on the Security Advisory Process:


In the interest of timely resolution of this issue for validators and node operators, the Amulet team has chosen to use existing processes and resources for distributing security advisories within the Cosmos and Interchain Ecosystems. Stay tuned as we implement an improved, more robust security advisory distribution system that will provide equitable access to information about security issues in the Interchain Stack.

Anytype Heart's gRPC API client challenge verification can be bypassed on localhost in github.com/anyproto/anytype-cli

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) in gitea.dev

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/chaos-mesh/chaos-mesh before v2.7.3.

Manifest path extraction is vulnerable to directory traversal attacks.

The ExtractPathManifest function permits file paths containing relative directory components (".."), permitting files to reference arbitrary locations on the filesystem.

Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic in github.com/siderolabs/omni

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names in github.com/mattermost/mattermost-server

Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad

Singularity: Incorrect path matching for 'limit container paths' directive in github.com/sylabs/singularity

CVE-2024-47218 in github.com/vesoft-inc/nebula

Ory Hydra has a SQL injection via forged pagination tokens in github.com/ory/hydra

Helm OCI credentials leaked into Argo CD logs in github.com/argoproj/argo-cd

An attacker can craft an input to ParseFragment that causes it to enter an infinite loop and never return.

Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/gravitational/teleport before v12.4.31, from v13.0.0 before v13.4.13, from v14.0.0 before v14.2.4.

Large handshake records may cause panics in crypto/tls.

Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses.

This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected.

Gogs vulnerable to improper PAM authorization handling in gogs.io/gogs

Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes

Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server

Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server

Note Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend

rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone

Apache Camel K: Kubernetes namespace authorized users can create a Build resource in github.com/apache/camel-k

### Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling. 

| CVE ID | Impacted Package | Severity | Description & Impact on flagd |
| -- | -- | -- | -- |
| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition:  Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |
| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAddress.  Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parses email-formatted metadata. |
| CVE-2025-61723 | encoding/pem | 7.5 (High) | DoS: Quadratic complexity when parsing invalid PEM inputs. Relevant if flagd loads TLS certificates or keys via PEM files from untrusted sources. |
| CVE-2025-61729 | crypto/x509 | 7.5 (High) | Resource Exhaustion: HostnameError.Error() lacks string concatenation limits. A malicious TLS certificate with thousands of hostnames could crash flagd during connection handshakes. |
| CVE-2025-58188 | net/http | Medium | Request Smuggling: Improper header handling in HTTP/1.1. Could allow attackers to bypass security filters positioned in front of flagd sync or evaluation APIs. |
| CVE-2025-58187 | archive/zip | Medium | DoS:  Improper validation of malformed ZIP archives.  Impacts flagd if configured to fetch and unpack zipped configuration bundles from remote providers. |

go-f3 Vulnerable to Cached Justification Verification Bypass in github.com/filecoin-project/go-f3

Navidrome has Multiple SQL Injections and ORM Leak in github.com/navidrome/navidrome

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook in github.com/fission/fission

Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd

Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy

Podman's default inheritable capabilities for linux container not empty in github.com/containers/podman

Zarf's symlink targets in archives are not validated against destination directory in github.com/zarf-dev/zarf

Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira

Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI

Grafana Authentication Bypass in github.com/grafana/grafana

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway

CVE ID↕	Published↕	CVSS↓
GO-2025-3392	Jan 16, 2025	N/A
GO-2026-5948	Jul 17, 2026	N/A
GO-2022-0197	Jul 1, 2022	N/A
GHSA-3wxm-m9m4-cprj	May 21, 2021	N/A
GO-2025-3691	May 23, 2025	N/A
GO-2026-5496	Jul 7, 2026	N/A
GO-2026-4679	Mar 12, 2026	N/A
GO-2026-4348	Feb 2, 2026	N/A
GO-2026-6275	Aug 25, 2026	N/A
GHSA-3jgf-r68h-xfqm	May 5, 2024	N/A
GO-2023-1900	Aug 20, 2024	N/A
GO-2024-2571	May 22, 2024	N/A
GO-2026-5254	Jun 25, 2026	N/A
GO-2023-1505	May 17, 2023	N/A
GO-2026-5400	Jun 25, 2026	N/A
GO-2021-0142	Jul 1, 2022	N/A
GO-2024-2993	Jul 22, 2024	N/A
GO-2020-0036	Apr 14, 2021	N/A
GO-2026-5076	Jun 25, 2026	N/A
GO-2026-5576	Aug 11, 2026	N/A
GO-2022-0595	Aug 21, 2024	N/A
GO-2024-2817	Jun 5, 2024	N/A
GO-2026-5821	Jul 7, 2026	N/A
GO-2026-4464	Feb 17, 2026	N/A
GO-2021-0240	Feb 17, 2022	N/A
GO-2023-1622	Aug 20, 2024	N/A
GO-2024-3079	Aug 22, 2024	N/A
GO-2022-0339	Aug 21, 2024	N/A
GO-2023-1754	Aug 20, 2024	N/A
GO-2024-3260	Nov 8, 2024	N/A
GO-2023-1294	Aug 20, 2024	N/A
GO-2026-5402	Jun 25, 2026	N/A
GO-2026-4524	Feb 23, 2026	N/A
GO-2024-3333	Dec 18, 2024	N/A
GO-2022-0970	Aug 21, 2024	N/A
GO-2022-1245	Aug 21, 2024	N/A
GO-2026-4762	Mar 27, 2026	N/A
GO-2026-6595	Oct 1, 2026	N/A
GO-2026-5266	Jul 24, 2026	N/A
GO-2025-3393	Jan 16, 2025	N/A
GO-2026-4385	Feb 2, 2026	N/A
GO-2026-4453	Feb 17, 2026	N/A
GO-2023-1699	Aug 20, 2024	N/A
GO-2024-2430	Jun 28, 2024	N/A
GO-2021-0356	Apr 25, 2022	N/A
GO-2026-4982	May 7, 2026	N/A
GO-2023-2382	Dec 6, 2023	N/A
GO-2022-0348	Aug 21, 2024	N/A
GO-2023-1878	Jul 11, 2023	N/A
GO-2022-1105	Aug 21, 2024	N/A
GO-2025-4091	Nov 17, 2025	N/A
GO-2026-6431	Sep 10, 2026	N/A
GO-2026-4526	Mar 17, 2026	N/A
GO-2023-2134	Aug 21, 2024	N/A
GO-2024-2874	May 23, 2024	N/A
GO-2026-4568	Mar 10, 2026	N/A
GO-2025-4041	Oct 30, 2025	N/A
GO-2026-6498	Oct 1, 2026	N/A
GO-2026-4881	Apr 7, 2026	N/A
GO-2026-6347	Sep 10, 2026	N/A
GO-2026-5219	Jun 25, 2026	N/A
GHSA-hq58-p9mv-338c	Sep 29, 2023	N/A
GO-2026-4680	Mar 12, 2026	N/A
GO-2026-6078	Jul 27, 2026	N/A
GO-2025-3954	Sep 17, 2025	N/A
GO-2022-0248	Jul 15, 2022	N/A
GO-2026-5316	Jun 25, 2026	N/A
GO-2025-4184	Dec 8, 2025	N/A
GO-2025-3396	Jan 16, 2025	N/A
GO-2024-2493	Feb 13, 2024	N/A
GO-2026-4278	Jan 12, 2026	N/A
GO-2026-5715	Jun 25, 2026	N/A
GO-2024-3155	Sep 26, 2024	N/A
GO-2026-4807	Mar 23, 2026	N/A
GO-2022-0387	Aug 21, 2024	N/A
GO-2021-0238	Feb 17, 2022	N/A
GO-2024-2445	Jun 28, 2024	N/A
GO-2023-1570	Feb 16, 2023	N/A
GO-2021-0224	Feb 17, 2022	N/A
GO-2022-0369	Aug 21, 2024	N/A
GO-2025-3475	Mar 3, 2025	N/A
GO-2025-3509	Mar 13, 2025	N/A
GO-2025-3769	Jul 28, 2025	N/A
GO-2026-5557	Jun 25, 2026	N/A
GO-2026-6456	Sep 16, 2026	N/A
GO-2026-5573	Jun 25, 2026	N/A
GHSA-4c5f-9mj4-m247	Jan 5, 2026	N/A
GO-2025-3989	Oct 23, 2025	N/A
GO-2024-3153	Sep 26, 2024	N/A
GO-2026-5852	Jul 7, 2026	N/A
GO-2025-3995	Oct 23, 2025	N/A
GO-2024-3006	Aug 6, 2024	N/A
GO-2026-5137	Jun 25, 2026	N/A
GO-2022-0416	Aug 21, 2024	N/A
GO-2026-4636	Mar 10, 2026	N/A
GO-2024-2539	Mar 18, 2024	N/A
GO-2026-5210	Jun 25, 2026	N/A
GO-2022-0707	Aug 21, 2024	N/A
GO-2026-5191	Jun 25, 2026	N/A
GO-2026-6003	Jul 17, 2026	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.