Version 7bdca06d0edf of the github.com/PromonLogicalis/asn1 module contains malicious code which downloads a program from a remote web server and executes it.

Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server from v8.0.0-20250721062209-4952acea88ce before v8.0.0-20260316060126-bc1a2b34b1f9.

Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata in github.com/lin-snow/ech0

### Impact

We are not aware of any exploits. This is a pro-active fix.

Impacted: 

* You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless).
* The attacker is within your network. If you expose Argo Server to the Internet then "your network" is "the Internet". 

The Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.

### Patches

https://github.com/argoproj/argo-workflows/pull/6540

### Workarounds

* Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.

This was identified by engineers at Jetstack.io

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus

**Component:** wasmd
**Criticality:** Medium ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Moderate; L:Likely)
**Patched versions:** wasmd 0.53.0

See [CWA-2024-006](https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-006.md) for more details.


Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea

Gogs allows deletion of internal files in github.com/gogs/gogs

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox

Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow in github.com/NethermindEth/juno

# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-p9v8-q5m4-pf46. This link is maintained to preserve external references.

# Original Description
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.

Portainer has a bind-mount restriction bypass via HostConfig.Mounts in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer from v2.33.0 before v2.33.8, from v2.39.0 before v2.39.2, from v2.40.0 before v2.41.0.

Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault

Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning in github.com/Tencent/WeKnora

emp3r0r Affected by Concurrent Map Access DoS (panic/crash) in github.com/jm33-m0/emp3r0r/core

Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm

Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino

Improper Validation of Array Index in github.com/greenpau/caddy-security

(This report has been withdrawn with reason: "Duplicate of 4513").

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account in github.com/cloudreve/Cloudreve

Kyverno Cross-Namespace Privilege Escalation via Policy apiCall in github.com/kyverno/kyverno

Docker MCP Gateway: Argument injection via OCI image label YAML in github.com/docker/mcp-gateway

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api

Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.

ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v2.54.10, from v2.55.0 before v2.55.8, from v2.56.0 before v2.56.6, from v2.57.0 before v2.57.5, from v2.58.0 before v2.58.5, from v2.59.0 before v2.59.3, from v2.60.0 before v2.60.2, from v2.61.0 before v2.61.1, from v2.62.0 before v2.62.1.

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli

Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad

Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-plugin-msteams before v2.1.0.

kgateway is missing xDS authorization in github.com/kgateway-dev/kgateway

Improper input validation in umoci in github.com/opencontainers/umoci

Docker Swarm encrypted overlay network traffic may be unencrypted in github.com/docker/docker

Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer in github.com/datacharmer/dbdeployer

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go

CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns

OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks in github.com/OliveTin/OliveTin

MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox

A malicious HTTP server or client can cause the net/http client or server to panic.

ReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.

This also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts.

AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/omec-project/amf before v2.2.0.

Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

An improper validation bug allows users who have create privileges to sync a local manifest during application creation. This allows for bypassing the restriction that the manifests come from some approved git/Helm/OCI source.

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo

Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

DoS in go-jose Parsing in github.com/go-jose/go-jose

## Withdrawn

This advisory has been withdrawn because it is a duplicate of GHSA-j2cr-jc39-wpx5. This link is maintained to preserve external references.

## Original Description

The cosmos-sdk module is affected by the vulnerability codenamed "Barberry".

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf

OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

Large RSA keys can lead to resource exhaustion attacks.

With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits.

HashiCorp go-getter is vulnerable to decompression bombs. This can lead to excessive memory consumption and denial-of-service attacks.

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel

Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/v5 before v5.3.2-0.20250815165020-c8d66301415d; github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20250815165020-c8d66301415d.

Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium

Mattermost doesn't enforce slash command trigger-word uniqueness during command updates in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260306123948-f5fe8ded6b63.

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion.

With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Out-of-Bounds Slice Access in free5GC CHF Leading to DoS in github.com/free5gc/chf

The filepath package does not recognize paths with a \??\ prefix as special.

On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x.

Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b.

Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b.

In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name.

UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.

Gogs has Stored XSS in `.ipynb` Preview in gogs.io/gogs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: gogs.io/gogs before v0.14.3.

Gin-vue-admin has an arbitrary file deletion vulnerability in github.com/flipped-aurora/gin-vue-admin

Casdoor allows users to bypass configured MFA requirements in github.com/casdoor/casdoor

Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast

Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources in goauthentik.io.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: goauthentik.io before v0.0.0-20250722122105-7a4c6b9b50f8.

Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them in github.com/rancher/rancher

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) in github.com/smallstep/certificates

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

### Impact
Contrary to the [OCI runtime specification](https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config-linux.md#device-whitelist), `runc`'s implementation of the `linux.resources.devices` list was a black-list by default. This means that users who created their own `config.json` objects and didn't prefix a deny-all rule (`{"allow": false, "permissions": "rwm"}` or equivalent) were not provided protection by the `devices` cgroup. This would allow malicious containers (with sufficient privileges) to create arbitrary device inodes (assuming they have `CAP_MKNOD`) and operate on any device inodes they may have access to (assuming they have regular Unix DAC permissions).

However, most (if not all) programs that make use of `runc` include this deny-all rule. This was most likely added before the specification mandated a white-list of devices, and the fact that all programs wrote their own deny-all rule obscured the existence of this bug for several years. In fact, even the specification's examples include a default deny-all rule! We therefore believe that while this is a security bug (and has been fixed as such), it was almost certainly not exploitable in the wild due to the inclusion of default deny-all rules by all known users of `runc` -- hence why this advisory has low severity.

### Patches
This issue has been fixed in [a patch that was part of a larger rework of the devices cgroup code in runc](https://github.com/opencontainers/runc/pull/2391) -- which lead to the discovery of this security bug. Users should upgrade to 1.0.0-rc91 as soon as it is released, or wait for your distribution to backport the relevant fixes.

### Workarounds
If you are using `runc` directly, ensure that there is a deny-all entry at the beginning of `linux.resources.devices` -- such an entry would look like `{"allow": false, "permissions": "rwm"}` (all other fields are ignored, though `type` must be set to `"a"` or `null` if it is present).

Users which consume `runc` through another program should check whether their containers are operating under a white-list -- this can be done by reading `/sys/fs/cgroup/devices/devices.list` inside the container. If the file contains only the entry `a *:* rwm` (meaning the cgroup is in black-list mode, which likely means "allow all device access") then your containers are vulnerable to this issue.

As always, we recommend **in the strongest possible terms** that all of our users enable user namespaces on all of their workloads (or pressure their vendors to do so). User namespaces are one of the most significant defense-in-depth protections you can enable for containers, and have prevented many container-related vulnerabilities (both kernel 0days as well as bugs in container runtimes, such as this one).

### References
* https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html
* [opencontainers/runtime-spec/config-linux.md#device-whitelist](https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config-linux.md#device-whitelist)
* https://github.com/opencontainers/runc/pull/2391

### For more information
If you have any questions or comments about this advisory:
* [Open an issue in this repo](https://github.com/opencontainers/runc/issues/new).
* Email us at <security@opencontainers.org>.

Excessively large requests can be processed, consuming a large amount of resources. This could potentially lead to a denial of service.

The Docker daemon's implementation of the "PUT /containers/{id}/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted, potentially leading to privilege escalation or host compromise.

The affected code is located in the daemon package, specifically in the containerExtractToDir method of the Daemon struct. This package is part of the Moby daemon's core and is not intended for external use as a library.

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors.

If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.

Worktree operations may follow symlinks in github.com/go-git/go-git

NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda

Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git

In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies: traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes, and traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS proxy and pods on other nodes.

Ollama Denial of Service (DoS) via Null Pointer Dereference in github.com/ollama/ollama

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive.

The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.

Authentication bypass by capture-replay in github.com/cosmos/ethermint

Kiali Authentication Bypass vulnerability in github.com/kiali/kiali

containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation in github.com/gardener/external-dns-management

Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver

Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: go.temporal.io/server from v1.29.0-0 before v1.29.0-135.0.0.20251218190115-b292a32bacdf.

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

netfoil vulnerable to improper handling of untrusted DoH response data in github.com/tinfoil-factory/netfoil

Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama

Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno

Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari

Initial debug-host handler implementation could leak information and facilitate denial of service in fortio.org/proxy

OpenFGA Authorization Bypass in github.com/openfga/openfga

Improper Access Control in github.com/treeverse/lakefs

Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul

CVE ID↕	Published↕	CVSS↓
GO-2024-3012	Jul 31, 2024	N/A
GO-2026-5522	Jun 25, 2026	N/A
GO-2026-5331	Jun 25, 2026	N/A
GHSA-6c73-2v8x-qpvm	Aug 23, 2021	N/A
GO-2022-0171	May 24, 2022	N/A
GO-2026-5384	Jun 25, 2026	N/A
GHSA-fpgj-cr28-fvpx	Aug 21, 2024	N/A
GO-2026-5365	Jun 25, 2026	N/A
GO-2024-2970	Jul 9, 2024	N/A
GO-2026-6411	Sep 10, 2026	N/A
GO-2025-3583	Apr 1, 2025	N/A
GHSA-jrr7-64m9-x984	May 31, 2024	N/A
GO-2026-5217	Jun 25, 2026	N/A
GO-2024-2508	Jun 28, 2024	N/A
GO-2026-6541	Sep 28, 2026	N/A
GO-2026-4640	Mar 10, 2026	N/A
GO-2026-4504	Feb 23, 2026	N/A
GO-2024-3343	Dec 20, 2024	N/A
GO-2025-3747	Jun 10, 2025	N/A
GO-2024-2564	Jun 28, 2024	N/A
GO-2026-4740	Mar 23, 2026	N/A
GO-2026-6097	Aug 18, 2026	N/A
GO-2026-4381	Feb 2, 2026	N/A
GO-2026-5604	Jun 25, 2026	N/A
GO-2026-6057	Jul 22, 2026	N/A
GO-2026-6245	Aug 18, 2026	N/A
GO-2021-0057	Apr 14, 2021	N/A
GO-2024-3139	Sep 26, 2024	N/A
GO-2026-5271	Jun 25, 2026	N/A
GO-2025-3492	Mar 3, 2025	N/A
GO-2023-1581	Aug 20, 2024	N/A
GO-2025-3618	Apr 22, 2025	N/A
GO-2025-4094	Nov 17, 2025	N/A
GO-2022-0815	Aug 21, 2024	N/A
GO-2023-1700	Aug 20, 2024	N/A
GO-2022-0787	Aug 21, 2024	N/A
GO-2022-0536	Aug 1, 2022	N/A
GO-2026-6310	Sep 2, 2026	N/A
GO-2026-4635	Mar 10, 2026	N/A
GO-2026-4547	Feb 25, 2026	N/A
GO-2026-6288	Aug 25, 2026	N/A
GO-2022-0236	Jul 15, 2022	N/A
GO-2026-5190	Jun 25, 2026	N/A
GO-2025-4127	Nov 17, 2025	N/A
GO-2024-2643	Mar 22, 2024	N/A
GO-2026-6560	Oct 1, 2026	N/A
GO-2026-6360	Sep 10, 2026	N/A
GO-2024-3191	Oct 11, 2024	N/A
GO-2025-4151	Nov 25, 2025	N/A
GO-2025-3485	Mar 3, 2025	N/A
GHSA-w44m-8mv2-v78h	Jun 22, 2023	N/A
GO-2026-5673	Jun 25, 2026	N/A
GO-2025-3767	Jul 28, 2025	N/A
GO-2023-2000	Aug 8, 2023	N/A
GO-2023-1578	Feb 17, 2023	N/A
GO-2026-5702	Jun 25, 2026	N/A
GO-2025-4126	Nov 17, 2025	N/A
GO-2022-0457	Aug 21, 2024	N/A
GO-2026-5726	Jun 25, 2026	N/A
GO-2026-6155	Aug 18, 2026	N/A
GO-2024-2599	Mar 5, 2024	N/A
GO-2026-4750	Mar 23, 2026	N/A
GO-2023-2185	Nov 8, 2023	N/A
GO-2026-5477	Jun 25, 2026	N/A
GO-2025-4171	Dec 2, 2025	N/A
GO-2026-5896	Jul 7, 2026	N/A
GO-2026-5624	Jun 25, 2026	N/A
GO-2025-3822	Aug 11, 2025	N/A
GO-2024-2764	Jun 5, 2024	N/A
GO-2026-4775	Mar 23, 2026	N/A
GO-2026-4961	Apr 21, 2026	N/A
GO-2026-6596	Oct 1, 2026	N/A
GHSA-g54h-m393-cpwq	Dec 20, 2021	N/A
GO-2024-2833	May 13, 2024	N/A
GO-2026-5746	Jun 25, 2026	N/A
GO-2023-1840	Jun 8, 2023	N/A
GO-2026-6213	Aug 18, 2026	N/A
GO-2024-2850	Jun 5, 2024	N/A
GO-2025-4257	Dec 30, 2025	N/A
GO-2025-3367	Jan 7, 2025	N/A
GO-2024-2657	Mar 22, 2024	N/A
GO-2025-3582	Apr 1, 2025	N/A
GO-2023-1841	Jun 8, 2023	N/A
GO-2022-0889	Aug 21, 2024	N/A
GO-2022-0700	Aug 21, 2024	N/A
GO-2022-0803	Aug 21, 2024	N/A
GO-2026-5407	Jun 25, 2026	N/A
GO-2025-3697	May 23, 2025	N/A
GO-2025-3605	Aug 5, 2025	N/A
GO-2026-4273	Jan 14, 2026	N/A
GO-2026-4559	Feb 26, 2026	N/A
GO-2025-4262	Dec 30, 2025	N/A
GO-2026-6277	Aug 25, 2026	N/A
GO-2024-2699	Jun 10, 2024	N/A
GO-2023-2338	Aug 21, 2024	N/A
GO-2025-3874	Aug 18, 2025	N/A
GO-2023-1524	Aug 20, 2024	N/A
GO-2025-3894	Aug 29, 2025	N/A
GO-2022-0375	Aug 21, 2024	N/A
GO-2024-2704	Jun 4, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.