Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman

Information Exposure in RunC in github.com/opencontainers/runc

Ella Core has handover failures during concurrent Security Mode Command in github.com/ellanetworks/core

Terraform allows arbitrary file write during the `init` operation in github.com/hashicorp/terraform

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea

KubeEdge Cloud Stream and Edge Stream DoS from large stream message in github.com/kubeedge/kubeedge

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands in github.com/kubev2v/migration-planner

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing in github.com/mattermost/mattermost-server

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin

Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.

Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.

### Impact

- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted

### Patches
Patched in v0.16.4

### Workarounds
No

### References

[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)

* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer dereference when using JWT filter safe_regex match
* [CVE-2021-43825](https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh) (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when response filters increase response data, and increased data exceeds downstream buffer limits.
* [CVE-2021-43826](https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf) (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when tunneling TCP over HTTP, if downstream disconnects during upstream connection establishment
* [CVE-2022-21654](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283) (CVSS Score 7.3, High): Envoy 1.7.0 and later - Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed.
* [CVE-2022-21655](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg) (CVSS Score 7.5, High): Envoy 1.21 and earlier - Incorrect handling of internal redirects to routes with a direct response entry
* [CVE-2022-21657](https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g) (CVSS Score 3.1, Low): Envoy 1.20.1 and earlier - X.509 Extended Key Usage and Trust Purposes bypass

### For more information
If you have any questions or comments about this advisory:

Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
Email us at [security@pomerium.com](mailto:security@pomerium.com)


Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer

Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v8.0.0 before v8.5.15, from v9.0.0 before v9.2.4.

ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel from v2.52.0 before v2.52.3, from v2.53.0 before v2.53.9, from v2.54.0 before v2.54.8, from v2.55.0 before v2.55.5, from v2.56.0 before v2.56.2, from v2.57.0 before v2.57.1, from v2.58.0 before v2.58.1.

kro Confused Deputy vulnerability in github.com/kro-run/kro

Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum

1Panel O&M management panel has a background arbitrary file reading vulnerability in github.com/1Panel-dev/1Panel

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text in github.com/rancher/fleet

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

Gitea vulnerable to Argument Injection in code.gitea.io/gitea

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic in github.com/sigstore/rekor

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet

opentelemetry-go's Schema ParseFile leaks file descriptors on each parse in go.opentelemetry.io/otel/schema

Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux

HashiCorp Nomad vulnerable to Insufficient Session Expiration in github.com/hashicorp/nomad

The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element.

GoBGP has an Improper Resource Shutdown or Release in github.com/osrg/gobgp

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium

Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.

Casdoor vulnerable to Open Redirect in github.com/casdoor/casdoor

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode in github.com/snyk/go-application-framework

Casdoor has an authentication bypass in github.com/casdoor/casdoor

Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase

Access control flaw in Kiali in github.com/kiali/kiali

The getter package can write SSH credentials to its logfile, exposing credentials to local users able to read the logfile.

File Browser has an Authentication Bypass in User Password Update in github.com/filebrowser/filebrowser

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events

Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator

Name: ASA-2025-002: Malicious peer can stall network by disseminating seemingly valid block parts
Component: CometBFT
Criticality: High (Catastrophic Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))
Affected versions: <= v0.38.16, v1.0.0
Affected users: Validators, Full nodes, Users

### Description

A bug was identified in the CometBFT validation of block part indices and the corresponding proof part indices that can lead to incorrect processing and dissemination of invalid parts, which in turn could lead to a network halt. Additional validation was added to prevent this condition from happening.

### Patches

The new CometBFT releases [v1.0.1](https://github.com/cometbft/cometbft/releases/tag/v1.0.1) and [v0.38.17](https://github.com/cometbft/cometbft/releases/tag/v0.38.17) fix this issue.

Unreleased code in the main branch is patched as well.

### Workarounds

There are no known workarounds for this issue. If a node is producing these malicious proofs, the only mitigation is to upgrade CometBFT. After upgrading, the validators then will eventually conclude the correct value.

### Technical Deep-Dive

When the next proposer creates a block, it is split into many block parts (64kB each). Each block part is then disseminated via p2p layer in a gossip fashion. The block part contains the following fields:

```go
type Part struct {
	Index uint32            `json:"index"`
	Bytes cmtbytes.HexBytes `json:"bytes"`
	Proof merkle.Proof      `json:"proof"`
}
```

- `Index` - represents the index of a block part
- `Bytes` - the actual content
- `Proof` - Merkle proof, which allows the receiving node to quickly verify that a `Part` is indeed a piece of the proposed block.

The `Proof` contains the following fields:

```go
type Proof struct {
	Total    int64    `json:"total"`           // Total number of items.
	Index    int64    `json:"index"`           // Index of item to prove.
	LeafHash []byte   `json:"leaf_hash"`       // Hash of item value.
	Aunts    [][]byte `json:"aunts,omitempty"` // Hashes from leaf's sibling to a root's child.
}
```

Note that the total number of leaves in the Merkle tree equals the number of parts in the proposed block. Previously, CometBFT did not validate the `Index` field and specifically that `Part.Index` must be equal to `Part.Proof.Index`. This leads to a condition where, it is possible to use the proof from a different part and CometBFT accept it, even though the proof proves the different part is a piece of the proposed block and not the part that the peer actually sent to us.

This condition is problematic because: 

1. it would disseminate the invalid block part to its neighboring nodes (because it deemed it as correct)
2. it would mark the block part as received and ask the neighboring nodes not to relay it in the future, making it impossible to receive the correct block part.

To address this, CometBFT was patched to verify that `Part.Index` is equal to `Part.Proof.Index`, preventing the above condition.

### Timeline

* January 15, 2025, 12:12pm PST: Issue reported to the Cosmos Bug Bounty program
* January 15, 2025, 12:31pm PST: Issue triaged by Amulet on-call, and distributed to Core team
* January 27, 2025, 11:28pm PST: Core team completes validation of issue
* January 31, 2024, 2:15pm PST: Pre-notification delivered
* February 3rd, 2024, 9:00am UTC+4: Patch made available

This issue was reported by [unknown_feature](https://github.com/unknownfeature) to the Cosmos Bug Bounty Program on HackerOne on January 15, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

If you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.  

A Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-r3r4-g7hq-pq4f). For more information about CometBFT, see https://docs.cometbft.com/.

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server before v9.11.16.

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal in github.com/siyuan-note/siyuan/kernel

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload in github.com/prometheus/prometheus

ExternalName Services can be used to gain access to Envoy's admin interface in github.com/projectcontour/contour

Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2

Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm

The net/url package does not set a limit on the number of query parameters in a query.

While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement in github.com/cheqd/cheqd-node.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/cheqd/cheqd-node before v3.1.7.

Code Injection in CRI-O in github.com/cri-o/cri-o

ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/zitadel/zitadel before v4.15.3.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.

This affects programs which validate arbitrary certificate chains.

Applications that use the strvals package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes an error that cannot be recovered from.

The strvals package contains a parser that turns strings into Go structures. For example, the Helm client has command line flags like --set, --set-string, and others that enable the user to pass in strings that are merged into the values. The strvals package converts these strings into structures Go can work with. Some string inputs can cause can cause a stack overflow to be created causing a stack overflow error. Stack overflow errors cannot be recovered from.

The Helm Client will panic with input to --set, --set-string, and other value setting flags that causes a stack overflow. Helm is not a long running service so the error will not affect future uses of the Helm client.

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

goshs route not protected, allows command execution in github.com/patrickhener/goshs

Kubernetes arbitrary file overwrite in k8s.io/kubernetes

Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei

Invalid session token expiration in github.com/hashicorp/vault

## Patches
Patched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade.

## Workarounds
No workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended.

## Testing
Tests are introduced in every affected version.

## Credits
Special thanks to @yihuang for the help on this issue.

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck in github.com/oxia-db/oxia

Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server

netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil

osctrl is Vulnerable to OS Command Injection via Environment Configuration in github.com/jmpsec/osctrl

File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser

Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250.

HashiCorp Nomad vulnerable to a path traversal in github.com/hashicorp/nomad

Mattermost Server does not properly restrict use of slash commands in github.com/mattermost/mattermost-server

Improper Restriction of Excessive Authentication Attempts in Argo API in github.com/argoproj/argo-cd

Kubernetes mountable secrets policy bypass in k8s.io/kubernetes

MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS in github.com/minio/minio

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve

CVE-2024-21583 in github.com/gitpod-io/gitpod.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/gitpod-io/gitpod before v0.1.5-main-gha.27122; github.com/gitpod-io/gitpod/components/server/go before main-gha.27122; github.com/gitpod-io/gitpod/components/ws-proxy before main-gha.27122; github.com/gitpod-io/gitpod/install/installer before main-gha.27122.

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

A race condition in go-resty can result in HTTP request body disclosure across requests.

This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.

The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.

This stems from several causes:

1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended.
2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts.
3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector.

The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue.

With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations.

In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms:

1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=.
2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.

Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer

NATS has pre-auth server panic via leafnode handling in github.com/nats-io/nats-server

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges in github.com/usememos/memos

usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos

A malicious server can trick a client into treating it as a different server by changing the reported UUID.

immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. The SDK does not validate this UUID and accepts any value reported by the server. A malicious server can therefore change the reported UUID and trick the client into treating it as a different server.

ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx in k8s.io/ingress-nginx.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: k8s.io/ingress-nginx before v1.13.7, from v1.14.0 before v1.14.3.

Modifying pod status allows host directory traversal.

Kubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

cnlh nps vulnerable to file overwrite by local user in github.com/cnlh/nps

Mattermost race condition in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context in github.com/nezhahq/nezha.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/nezhahq/nezha from v2.0.14 before v2.1.0.

Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk

CometBFT allows a malicious peer to stall network by disseminating valid-looking block parts in github.com/cometbft/cometbft

A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.

The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.

SQL injection in github.com/stashapp/stash

Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus

Predictable SIF UUID Identifiers in github.com/sylabs/sif

Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/aws/aws-advanced-go-wrapper/xray before 1.07.

Answer vulnerable to Business Logic Errors in github.com/answerdev/answer

Subdomain Takeover in Interactsh server in github.com/projectdiscovery/interactsh

Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20260216150504-8738f8c4b3d4.

CVE ID↕	Published↕	CVSS↓
GO-2026-5568	Jun 25, 2026	N/A
GO-2022-0835	Aug 21, 2024	N/A
GO-2026-5502	Jun 25, 2026	N/A
GO-2023-2055	Aug 21, 2024	N/A
GO-2026-6060	Jul 27, 2026	N/A
GO-2022-0511	Aug 21, 2024	N/A
GO-2026-6233	Aug 18, 2026	N/A
GO-2026-5845	Jul 7, 2026	N/A
GO-2026-5021	May 22, 2026	N/A
GO-2026-6145	Aug 18, 2026	N/A
GHSA-j34v-3552-5r7j	Mar 1, 2022	N/A
GO-2024-3065	Aug 13, 2024	N/A
GO-2024-2843	Jun 5, 2024	N/A
GO-2024-3015	Aug 6, 2024	N/A
GO-2025-3741	Jun 9, 2025	N/A
GO-2025-3436	Feb 4, 2025	N/A
GO-2023-2004	Aug 21, 2024	N/A
GO-2025-3927	Sep 8, 2025	N/A
GO-2025-4014	Oct 29, 2025	N/A
GO-2022-1065	Aug 21, 2024	N/A
GO-2026-5778	Jul 7, 2026	N/A
GO-2026-6309	Sep 2, 2026	N/A
GO-2026-5281	Jun 25, 2026	N/A
GO-2025-3507	Mar 10, 2025	N/A
GO-2022-1106	Aug 21, 2024	N/A
GO-2021-0234	Feb 17, 2022	N/A
GO-2026-5665	Jul 7, 2026	N/A
GO-2024-2887	Jun 4, 2024	N/A
GO-2025-3415	Jan 28, 2025	N/A
GO-2024-2591	Jun 28, 2024	N/A
GO-2026-5509	Jun 25, 2026	N/A
GO-2025-3372	Jan 28, 2025	N/A
GO-2025-3789	Jul 28, 2025	N/A
GO-2026-5895	Jul 7, 2026	N/A
GO-2026-6489	Oct 7, 2026	N/A
GO-2022-0645	Aug 21, 2024	N/A
GO-2022-0438	Jul 1, 2022	N/A
GO-2026-4475	Feb 17, 2026	N/A
GO-2025-3608	Apr 22, 2025	N/A
GO-2025-3427	Jan 29, 2025	N/A
GHSA-r3r4-g7hq-pq4f	Feb 3, 2025	N/A
GO-2025-3377	Jan 9, 2025	N/A
GO-2026-4386	Feb 2, 2026	N/A
GO-2025-3802	Jul 21, 2025	N/A
GO-2026-5264	Jun 25, 2026	N/A
GO-2022-0922	Aug 21, 2024	N/A
GO-2025-3664	May 20, 2025	N/A
GO-2026-5138	Jun 25, 2026	N/A
GO-2026-4341	Jan 28, 2026	N/A
GO-2025-3514	Mar 13, 2025	N/A
GO-2022-0354	Aug 21, 2024	N/A
GO-2026-6470	Sep 16, 2026	N/A
GO-2026-4946	Apr 7, 2026	N/A
GO-2025-4007	Oct 29, 2025	N/A
GO-2022-1167	Dec 14, 2022	N/A
GO-2026-6608	Oct 8, 2026	N/A
GO-2025-3672	May 15, 2025	N/A
GO-2023-1959	Aug 20, 2024	N/A
GO-2024-2645	Jun 4, 2024	N/A
GO-2022-0623	Aug 21, 2024	N/A
GHSA-8pfh-j44r-f654	Oct 21, 2025	N/A
GO-2026-5364	Jun 25, 2026	N/A
GO-2025-3729	Jun 3, 2025	N/A
GO-2026-5934	Jul 17, 2026	N/A
GO-2026-4579	Mar 10, 2026	N/A
GO-2026-6024	Jul 22, 2026	N/A
GO-2021-0064	Apr 14, 2021	N/A
GO-2026-5445	Jun 25, 2026	N/A
GO-2025-4204	Dec 15, 2025	N/A
GO-2022-0892	Aug 21, 2024	N/A
GO-2023-1892	Aug 20, 2024	N/A
GO-2025-4034	Oct 30, 2025	N/A
GO-2023-2097	Aug 21, 2024	N/A
GO-2024-2997	Jul 22, 2024	N/A
GO-2026-6354	Sep 2, 2026	N/A
GO-2023-2328	Nov 27, 2023	N/A
GO-2023-1705	Apr 5, 2023	N/A
GO-2023-1965	Aug 20, 2024	N/A
GO-2026-4837	Mar 26, 2026	N/A
GO-2026-6547	Oct 1, 2026	N/A
GO-2023-1270	Aug 20, 2024	N/A
GO-2023-1465	Aug 20, 2024	N/A
GO-2022-1118	Dec 22, 2022	N/A
GO-2026-4423	Feb 5, 2026	N/A
GO-2022-0629	Feb 15, 2022	N/A
GO-2025-3625	Apr 22, 2025	N/A
GO-2024-2588	Jun 28, 2024	N/A
GO-2026-5826	Jul 7, 2026	N/A
GO-2024-3339	Dec 18, 2024	N/A
GO-2025-3443	Feb 4, 2025	N/A
GO-2026-5749	Jun 25, 2026	N/A
GO-2024-3070	Aug 16, 2024	N/A
GO-2025-4266	Dec 30, 2025	N/A
GO-2026-6319	Sep 2, 2026	N/A
GO-2022-0912	Aug 21, 2024	N/A
GO-2022-0760	Aug 21, 2024	N/A
GO-2026-5601	Jun 25, 2026	N/A
GO-2023-1658	Aug 20, 2024	N/A
GO-2022-0372	Aug 21, 2024	N/A
GO-2026-5256	Jun 25, 2026	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.