Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer

Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates

ingress-nginx comment-based nginx configuration injection in k8s.io/ingress-nginx

Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid

SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb

Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function in github.com/free5gc/amf

OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources in github.com/redhat-developer/gitops-operator

Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in github.com/elastic/beats

OpenBao's Inline Auth Incorrectly Redacted Headers in github.com/openbao/openbao.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/openbao/openbao before v2.5.4.

Capture-replay in Gitea in code.gitea.io/gitea

Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an archive they control.

Int.Exp Montgomery mishandled carry propagation and produced an incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.

This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA private key due to this issue. Other protocol implementations that create many RSA signatures could also be impacted in the same way.

Specifically, incorrect results in one part of the RSA Chinese Remainder computation can cause the result to be incorrect in such a way that it leaks one of the primes. While RSA blinding should prevent an attacker from crafting specific inputs that trigger the bug, on 32-bit systems the bug can be expected to occur at random around one in 2^26 times. Thus collecting around 64 million signatures (of known data) from an affected server should be enough to extract the private key used.

Note that on 64-bit systems, the frequency of the bug is so low (less than one in 2^50) that it would be very difficult to exploit.

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data in github.com/jandedobbeleer/oh-my-posh

Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus

## Summary

A user who has only read permission on a project can call the single link-share read endpoint and receive the share's `hash` field — the secret credential that the anonymous `POST /shares/{share}/auth` endpoint exchanges for a link-share JWT carrying the share's permission (read / read-write / admin). A read-only member can therefore mint a write- or admin-level token for the project and perform writes they are not entitled to, while their own user token is correctly refused. This is the remaining variant of the link-share hash disclosure class: GHSA-8hp8-9fhr-pfm9 fixed the list endpoint (ReadAll now requires project admin) but the single-read endpoint's gate was never aligned. Verified on Vikunja 2.5.0; the weak gate has existed since the endpoint, so earlier versions are likely affected too.

## Details

Affected endpoints (both verified with a complete chain):

- v1: `GET /api/v1/projects/{project}/shares/{share}`
- v2: `GET /api/v2/projects/{project}/shares/{share}`

Permission gate: `LinkSharing.CanRead` (`pkg/models/link_sharing_permissions.go`) delegates to `project.CanRead(s, a)` — i.e. any user with read access to the project passes. The response serializes the `hash` field (`pkg/models/link_sharing.go`, field tag `json:"hash"`), which is the share's bearer credential. The share `password` field is correctly cleared before returning, but the hash is not restricted.

Inconsistent with the sibling list endpoint `GET /projects/{project}/shares` (`LinkSharing.ReadAll`, `pkg/models/link_sharing.go:243-256`), which requires `project.IsAdmin` — the protection level the project chose when the class was fixed for the list endpoint in 2.3.0 (GHSA-8hp8). The v1 and v2 APIs share the same model-level gate (the v2 `handler.DoReadOne` wrappers call the same `CanRead`), so both surfaces are affected.

Impact chain: hash -> `POST /api/v1/shares/{hash}/auth` (unauthenticated by design) -> link-share JWT at the share's permission level -> full API access at that level for that project.

Mitigating factors: the attacker must already be a member of the project at read level; password-protected shares (sharing_type=2) still require the password at the auth step; share IDs are small sequential integers and enumerable by members.

## PoC

Steps below use two accounts: the owner (token `$OWNER`) and an attacker who has been granted read-only access to the project (token `$READER`). All requests were executed against a local Vikunja 2.5.0 instance.

1. Owner creates a private project and a read-write link share (permission=1):

```
curl -X PUT "$BASE/api/v1/projects" -H "Authorization: Bearer $OWNER" \
  -H 'Content-Type: application/json' -d '{"title":"poc"}'
# -> {"id":123,...}

curl -X PUT "$BASE/api/v1/projects/123/shares" -H "Authorization: Bearer $OWNER" \
  -H 'Content-Type: application/json' -d '{"name":"poc","permission":1}'
# -> {"id":7,"hash":"<SECRET_HASH>",...}
```

2. Owner adds the attacker as a read-only member (permission=0):

```
curl -X PUT "$BASE/api/v1/projects/123/users" -H "Authorization: Bearer $OWNER" \
  -H 'Content-Type: application/json' -d '{"username":"attacker","permission":0}'
```

3. Attacker reads the single share — the weak gate — and receives the hash (this is the disclosure; the list endpoint would correctly return 403 here):

```
curl "$BASE/api/v1/projects/123/shares/7" -H "Authorization: Bearer $READER"
# -> 200 {"id":7,"hash":"<SECRET_HASH>","permission":1,...}
# v2 twin behaves identically:
curl "$BASE/api/v2/projects/123/shares/7" -H "Authorization: Bearer $READER"
# -> 200 {"hash":"<SECRET_HASH>",...}
```

4. Attacker exchanges the hash for a link-share JWT (no authentication required):

```
curl -X POST "$BASE/api/v1/shares/<SECRET_HASH>/auth" \
  -H 'Content-Type: application/json' -d '{}'
# -> 200 {"token":"<LINK_JWT>",...}
```

5. Negative control — the attacker's own user token cannot write to the project:

```
curl -X PUT "$BASE/api/v1/projects/123/tasks" -H "Authorization: Bearer $READER" \
  -H 'Content-Type: application/json' -d '{"title":"direct"}'
# -> 403 Forbidden
```

6. Escalation proof — the link-share JWT writes successfully:

```
curl -X PUT "$BASE/api/v1/projects/123/tasks" -H "Authorization: Bearer <LINK_JWT>" \
  -H 'Content-Type: application/json' -d '{"title":"escalated"}'
# -> 201 Created
```

Observed result: steps 3, 4 and 6 all succeed (200 / 200 / 201) while step 5 is refused with 403 — the read-only member has escalated to write access. If the project has an admin-level share (permission=2), the same chain yields project-admin capabilities (member management is still refused for link principals, but project settings, shares of the project, and all write operations become available).

## Impact

Broken access control / privilege escalation within shared projects (CWE-862, CWE-639: the link-share hash is a bearer capability disclosed to a lesser-privileged member; CWE-200 for the information exposure). Any read-level member of a project that has a link share can escalate to that share's permission level: write members' tasks/comments can be created and modified; an admin-level share additionally grants project settings and share management for the project. Confidentiality is also affected insofar as the hash itself is the project's shared secret. Suggested fix: require `project.IsAdmin` in `LinkSharing.CanRead` (aligning with `ReadAll`), or omit the `hash` field from responses to non-admin members.

Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client in github.com/rabbitmq/amqp091-go

MediaMTX affected by CVE-2026-27143 due to vulnerable dependency in github.com/bluenviron/mediamtx

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format in github.com/opentofu/opentofu

free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference in github.com/free5gc/udm

Go Ethereum Improper Input Validation in github.com/ethereum/go-ethereum

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go

Navidrome has XSS via comment from song metadata in github.com/navidrome/navidrome

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff

Parsing malformed JSON which contain opening brackets, but not closing brackets, leads to an infinite loop. If operating on untrusted user input this can be used as a denial of service vector.

Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/lin-snow/ech0 before v4.4.3.

Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline

SiYuan vulnerable to remote code execution via marketplace XSS in github.com/siyuan-note/siyuan/kernel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/siyuan-note/siyuan/kernel before v3.6.1.

CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl

DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly

Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/rancher/rancher from v2.7.0 before v2.8.9, from v2.9.0 before v2.9.3.

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nuclio/nuclio before v1.16.5.

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go

Mattermost fails to bound memory allocation when processing DOC files in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260123215601-86797c508c44.

ParseVector can panic when provided with invalid input.

Grafana long dashboard title or panel name causes unresponsives in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v11.6.2.

Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding in github.com/xddxdd/bird-lg-go

Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority

CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o

netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset in github.com/basekick-labs/arc

1Panel command injection vulnerability in Firewall ip functionality in github.com/1Panel-dev/1Panel

Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server

Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go

memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution in github.com/platform-mesh/kubernetes-graphql-gateway

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Mattermost allows team admins to promote guests to team admins in github.com/mattermost/mattermost-server

Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes in github.com/gotenberg/gotenberg

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook in github.com/gotenberg/gotenberg

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset

Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh

Gotenberg: SSRF via LibreOffice document processing in github.com/gotenberg/gotenberg

1Panel Arbitrary File Download vulnerability in github.com/1Panel-dev/1Panel

Gin-vue-admin has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go' function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter.

CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/cubefs/cubefs before v3.3.1.

Cilium eBPF filters may be temporarily removed during agent restart in github.com/cilium/cilium

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel

Mattermost Server exposes team invite IDs through API endpoints in github.com/mattermost/mattermost-server

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei

Grafana-Zabbix ReDoS vulnerability in github.com/alexanderzobnin/grafana-zabbix.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/alexanderzobnin/grafana-zabbix before v6.0.0.

Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk

ZITADEL Users Can Self-Verify Email/Phone via API in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

An attacker who controls or compromises a registry can lead a user to verify the wrong artifact.

File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser

ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v2.53.0 before v2.53.9, from v2.54.0 before v2.54.8, from v2.55.0 before v2.55.5, from v2.56.0 before v2.56.2, from v2.57.0 before v2.57.1, from v2.58.0 before v2.58.1.

matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo

XSS vulnerability via personal website in github.com/apache/incubator-answer

The Singularity Image Format (SIF) reference implementation does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures.

Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel

Improper Access Control in wazuh-agent in github.com/wazuh/wazuh

Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki

SQL injection vulnerability via the component /types/append_value.go in github.com/go-pg/pg

KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino

containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd

Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd

Use of Insufficiently Random Values in github.com/greenpau/caddy-security

Chaos Controller Manager is vulnerable to OS command injection in github.com/chaos-mesh/chaos-mesh.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/chaos-mesh/chaos-mesh before v2.7.3.

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

Vulnerable to policy bypass in kube-apiserver in k8s.io/kubernetes

esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh

goshs: Share-link ?token=… redemption races past download limit in goshs.de/goshs

DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum

Moby (Docker Engine) Insufficiently restricted permissions on data directory in github.com/docker/docker

Reject unauthorized access with GitHub PATs in github.com/go-vela/server

kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token in github.com/kyverno/kyverno

Libredesk has a SSRF Vulnerability in Webhooks in github.com/abhinavxd/libredesk

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input in github.com/beego/beego

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) in gitea.dev

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource in github.com/aiven/aiven-operator

Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo

CVE ID↕	Published↕	CVSS↓
GO-2023-1617	Aug 20, 2024	N/A
GO-2026-5297	Jun 25, 2026	N/A
GO-2026-4796	Mar 23, 2026	N/A
GO-2024-2644	Jun 4, 2024	N/A
GO-2023-1723	Aug 20, 2024	N/A
GO-2026-5767	Jun 25, 2026	N/A
GO-2025-4242	Dec 22, 2025	N/A
GO-2025-4252	Jan 23, 2026	N/A
GO-2026-5574	Jun 25, 2026	N/A
GO-2022-0310	Aug 21, 2024	N/A
GO-2021-0100	Jul 28, 2021	N/A
GO-2021-0160	Jan 5, 2022	N/A
GO-2026-6111	Aug 18, 2026	N/A
GO-2026-6318	Sep 2, 2026	N/A
GHSA-qfwc-vx6f-3g6g	Oct 9, 2026	N/A
GO-2026-6000	Jul 27, 2026	N/A
GO-2026-6494	Oct 1, 2026	N/A
GO-2026-4989	May 20, 2026	N/A
GO-2026-4352	Feb 2, 2026	N/A
GO-2026-4757	Mar 23, 2026	N/A
GO-2022-0871	Aug 21, 2024	N/A
GO-2026-5204	Jun 25, 2026	N/A
GO-2026-4413	Feb 5, 2026	N/A
GO-2024-3300	Dec 2, 2024	N/A
GO-2026-5937	Jul 17, 2026	N/A
GO-2021-0089	Apr 14, 2021	N/A
GO-2026-5701	Jun 25, 2026	N/A
GO-2026-5486	Jun 25, 2026	N/A
GO-2026-4720	Aug 19, 2026	N/A
GO-2026-4550	Feb 27, 2026	N/A
GO-2025-3969	Sep 24, 2025	N/A
GO-2024-3223	Oct 28, 2024	N/A
GO-2026-6004	Jul 17, 2026	N/A
GO-2026-6491	Oct 1, 2026	N/A
GO-2026-4733	Mar 23, 2026	N/A
GO-2022-1002	Sep 21, 2022	N/A
GO-2025-3766	Jul 28, 2025	N/A
GO-2026-5077	Jun 25, 2026	N/A
GO-2026-5763	Jun 25, 2026	N/A
GO-2025-3426	Jan 29, 2025	N/A
GO-2026-5933	Jul 17, 2026	N/A
GO-2026-6322	Sep 2, 2026	N/A
GO-2023-1940	Aug 20, 2024	N/A
GO-2026-5311	Jun 25, 2026	N/A
GO-2024-2469	Jan 17, 2024	N/A
GO-2024-3046	Aug 6, 2024	N/A
GO-2026-5133	Jun 25, 2026	N/A
GO-2026-5420	Jun 25, 2026	N/A
GO-2026-5028	May 22, 2026	N/A
GO-2024-2793	Jun 5, 2024	N/A
GO-2026-5080	Jun 25, 2026	N/A
GO-2026-5132	Jun 25, 2026	N/A
GO-2025-3376	Jan 9, 2025	N/A
GO-2026-6108	Aug 18, 2026	N/A
GO-2026-5060	Jun 22, 2026	N/A
GO-2023-2005	Aug 21, 2024	N/A
GO-2024-2702	May 20, 2024	N/A
GO-2024-2432	Jun 28, 2024	N/A
GO-2023-1644	Aug 20, 2024	N/A
GO-2026-6497	Oct 1, 2026	N/A
GO-2024-3324	Dec 12, 2024	N/A
GO-2025-4185	Dec 8, 2025	N/A
GO-2026-5005	May 22, 2026	N/A
GO-2026-6575	Oct 1, 2026	N/A
GO-2025-3976	Sep 24, 2025	N/A
GO-2024-2572	May 28, 2024	N/A
GO-2026-6141	Aug 18, 2026	N/A
GO-2023-1832	Jun 26, 2023	N/A
GO-2025-4118	Nov 17, 2025	N/A
GO-2024-3014	Aug 6, 2024	N/A
GO-2025-3401	Jan 16, 2025	N/A
GO-2024-2743	Apr 26, 2024	N/A
GO-2022-1045	Oct 21, 2022	N/A
GO-2025-3702	May 23, 2025	N/A
GO-2024-3241	Nov 4, 2024	N/A
GO-2026-6506	Sep 28, 2026	N/A
GO-2026-6663	Oct 7, 2026	N/A
GO-2025-3444	Feb 4, 2025	N/A
GO-2026-5115	Jun 25, 2026	N/A
GO-2025-3764	Jul 21, 2025	N/A
GO-2026-4920	Apr 6, 2026	N/A
GO-2026-6617	Oct 8, 2026	N/A
GO-2025-3746	Jun 10, 2025	N/A
GO-2022-0344	Aug 21, 2024	N/A
GO-2026-5622	Jun 25, 2026	N/A
GO-2024-2565	Jun 28, 2024	N/A
GO-2025-3952	Sep 17, 2025	N/A
GO-2026-6265	Aug 25, 2026	N/A
GO-2023-1891	Aug 20, 2024	N/A
GO-2026-4554	Feb 27, 2026	N/A
GO-2026-5881	Jul 7, 2026	N/A
GO-2026-4315	Jan 23, 2026	N/A
GO-2024-2500	Jun 28, 2024	N/A
GO-2022-0812	Aug 21, 2024	N/A
GO-2026-5575	Jun 25, 2026	N/A
GO-2026-4505	Feb 23, 2026	N/A
GO-2025-3585	Apr 1, 2025	N/A
GO-2026-6079	Jul 27, 2026	N/A
GO-2026-5283	Jun 25, 2026	N/A
GO-2024-3314	Dec 10, 2024	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.