Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

go

go

8,338 packages · proxy.golang.org

Security Advisories in go

Moderate
about 7 hours ago

goshs: Share-link ?token=… redemption races past download limit GSA_kwCzR0hTQS1qNDhtLWg3eHEtMnhwas4ABaAC

go goshs.de/goshs/v2
High
about 7 hours ago

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags GSA_kwCzR0hTQS0zd2hjLXF2aHYteHFqcM4ABaAA

go goshs.de/goshs/v2
Moderate
about 7 hours ago

ORAS Go forwards registry credentials across registry redirects GSA_kwCzR0hTQS12aDR2LTJ4cTItZzVjZ84ABZ__

go oras.land/oras-go/v2
High
about 7 hours ago

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution GSA_kwCzR0hTQS1meGhwLW12M3YtNjdxcM4ABZ_9

go oras.land/oras-go/v2
Moderate
about 8 hours ago

oras-go has file store write outside workingDir via symlink traversal GSA_kwCzR0hTQS04eHdmLXJqbTQteHZods4ABZ_8

go oras.land/oras-go/v2
High
about 8 hours ago

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header GSA_kwCzR0hTQS1qeHBtLTc1bWgtOWZwN84ABZ_u

go oras.land/oras-go/v2
Low
about 8 hours ago

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens GSA_kwCzR0hTQS14Zjg1LTM2M3AtODY4d84ABZ_s

go oras.land/oras-go, oras.land/oras-go/v2
Critical
about 8 hours ago

Rancher has Privilege Escalation from Project Owner to Host GSA_kwCzR0hTQS12eDhoLTRwcnYtZzc0NM4ABZ_r

go github.com/rancher/rancher
Moderate
about 8 hours ago

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) GSA_kwCzR0hTQS0yOHBxLTZxeGctd2c1cs4ABZ_q

go github.com/axllent/mailpit
High
about 8 hours ago

Rancher has over-inclusive team membership expansion in GitHub App authentication provider GSA_kwCzR0hTQS00ajZ4LTI3NjQtbThnaM4ABZ_o

go github.com/rancher/rancher
Critical
about 8 hours ago

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer GSA_kwCzR0hTQS14cjY1LTVjcG0tZzM2eM4ABZ_n

go github.com/rancher/fleet
Moderate
about 8 hours ago

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml GSA_kwCzR0hTQS1oeDR2LWN4cGYtdmg4bc4ABZ_m

go github.com/rancher/fleet
Critical
about 9 hours ago

Rancher vulnerable to command injection through unsanitized YAML parameter GSA_kwCzR0hTQS1taGM2LTJnZnEteHg2Ms4ABZ_l

go github.com/rancher/rancher
High
about 9 hours ago

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components GSA_kwCzR0hTQS1qbWY0LW03ajktZzcycs4ABZ_k

go github.com/rancher/fleet
High
about 9 hours ago

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent GSA_kwCzR0hTQS04NjRnLTg2M20tdmN2cc4ABZ_j

go github.com/rancher/fleet
High
about 9 hours ago

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass GSA_kwCzR0hTQS1nNnZnLXdqOGYtNDhjas4ABZ_g

go github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3, github.com/centrifugal/centrifugo/v4, github.com/centrifugal/centrifugo/v5, github.com/centrifugal/centrifugo/v6
Low
about 10 hours ago

Concourse login flow has an open redirect issue GSA_kwCzR0hTQS04dzI3LWM0dmMtODhxOc4ABZ_F

go github.com/concourse/concourse
Moderate
about 10 hours ago

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts GSA_kwCzR0hTQS0zY2NtLTRxcTItNXdycM4ABZ_B

go github.com/edgelesssys/contrast
Low
about 11 hours ago

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries GSA_kwCzR0hTQS02Yzg3LWc5cHctNzhmeM4ABZ_A

go github.com/edgelesssys/contrast
Moderate
1 day ago

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality GSA_kwCzR0hTQS05YzU0LXgyZzQtdjkyas4ABZy_

go github.com/sigstore/timestamp-authority, github.com/sigstore/timestamp-authority/v2
High
1 day ago

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage GSA_kwCzR0hTQS1mNW1yLXE4NXAtNmhoNs4ABZy-

go github.com/sigstore/fulcio
Moderate
1 day ago

Probo has an open redirect bypass via path normalization GSA_kwCzR0hTQS14N3FxLW03NDgtOHAyY84ABZy5

go go.probo.inc/probo
Critical
1 day ago

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation GSA_kwCzR0hTQS1tNjN2LTJnOXctMnc2ds4ABZyY

go github.com/fission/fission
Moderate
1 day ago

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container GSA_kwCzR0hTQS04d2NqLW1mcmMtang1cc4ABZyX

go github.com/fission/fission
Critical
1 day ago

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape GSA_kwCzR0hTQS1neDU1LWY4NHItdjNyN84ABZyW

go github.com/fission/fission
Critical
1 day ago

Fission Container Executor Function PodSpec Injection Leading to Node Escape GSA_kwCzR0hTQS12NDU1LW12MnYtNWc5Ms4ABZyV

go github.com/fission/fission
Critical
1 day ago

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover GSA_kwCzR0hTQS13bWdnLTNwNGgtNDh4N84ABZyU

go github.com/fission/fission
High
1 day ago

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook GSA_kwCzR0hTQS1jdnc2LWdmdnYtOTUzcc4ABZyT

go github.com/fission/fission
High
1 day ago

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook GSA_kwCzR0hTQS0zcjh2LTJ4bWotNWMzOc4ABZyS

go github.com/fission/fission
High
1 day ago

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance GSA_kwCzR0hTQS1nYzNqLTc5ZjItN3Z2d84ABZyR

go github.com/fission/fission
High
1 day ago

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration GSA_kwCzR0hTQS12amhjLWNmNHAtNzJxNM4ABZyQ

go github.com/fission/fission
High
1 day ago

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec GSA_kwCzR0hTQS03bTh4LXFnMmotNG0zds4ABZyP

go github.com/fission/fission
High
1 day ago

Kahi has privilege-drop and socket/log permission issues GSA_kwCzR0hTQS01NWY2LTRwcjUtYzdtNc4ABZyM

go github.com/kahiteam/kahi
High
2 days ago

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query GSA_kwCzR0hTQS1xMm05LTZqcDktYzZtY84ABZwK

go github.com/dgraph-io/dgraph/v25
Moderate
5 days ago

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API GSA_kwCzR0hTQS13dzVwLWo2Y2otNm1xcc4ABZpc

go github.com/nezhahq/nezha
High
5 days ago

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) GSA_kwCzR0hTQS1obWdwLXc5am0tdnA5Nc4ABZpY

go go.senan.xyz/gonic
High
5 days ago

gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists GSA_kwCzR0hTQS0yZnA0LTV2NWMtNDQ0OM4ABZpX

go go.senan.xyz/gonic
High
5 days ago

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host GSA_kwCzR0hTQS00Z3h2LXA1ZzUtajd3N84ABZpW

go go.senan.xyz/gonic
Moderate
5 days ago

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection GSA_kwCzR0hTQS05cmM2LThjanYtcmN2eM4ABZpP

go github.com/nezhahq/nezha
Moderate
5 days ago

Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS GSA_kwCzR0hTQS1qZzYyLWo1aDYtOG1wcc4ABZpO

go github.com/nezhahq/nezha
Critical
5 days ago

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key GSA_kwCzR0hTQS01YzI1LTd2cGotOW1xaM4ABZpL

go github.com/nezhahq/nezha
Moderate
5 days ago

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context GSA_kwCzR0hTQS0zOWcyLTh4NjgtcG14OM4ABZpK

go github.com/nezhahq/nezha
Moderate
5 days ago

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing GSA_kwCzR0hTQS14NmZnLTUydnItaGo0d84ABZpJ

go github.com/nezhahq/nezha
Moderate
5 days ago

regclient may leak authentication credentials to external blob stores GSA_kwCzR0hTQS1xdnFjLTRjNTIteDZxcM4ABZpA

go github.com/regclient/regclient
Low
5 days ago

Authelia has an Edge Case Access Control Rule Mismatch GSA_kwCzR0hTQS1qNzQ4LWgzNjMtd3FqOM4ABZo_

go github.com/authelia/authelia/v4
Critical
5 days ago

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check GSA_kwCzR0hTQS1xNnh4LTV2cjgtcDg5OM4ABZo-

go github.com/nezhahq/nezha
High
5 days ago

Blnk has an API key authorization bypass in owner and scope enforcement GSA_kwCzR0hTQS13Y3IzLTl4NGMtZjVnas4ABZo9

go github.com/blnkfinance/blnk
High
5 days ago

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) GSA_kwCzR0hTQS1jNnYyLTNmZm0tdmNtY84ABZnt

go github.com/juev/nebula-mesh
Low
5 days ago

nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction GSA_kwCzR0hTQS12MmpmLTQ0MnItNm1qaM4ABZnj

go github.com/juev/nebula-mesh
Moderate
5 days ago

Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container GSA_kwCzR0hTQS1yaHE2LTlyZ2gtdjQ1Y84ABZnb

go github.com/pterodactyl/wings
Moderate
5 days ago

turso-cli persists Turso platform JWT with world-readable (0o644) file permissions GSA_kwCzR0hTQS01N2Y2LXB2eDgtaHdqNs4ABZnU

go github.com/tursodatabase/turso-cli
Moderate
5 days ago

Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint GSA_kwCzR0hTQS1nbTdmLXY5NTktZnIyZ84ABZnP

go github.com/fleetdm/fleet/v4
High
5 days ago

Hysteria: http large header with sniff cause server DoS GSA_kwCzR0hTQS1qcWM1LTJwN3EtZnFmY84ABZnO

go github.com/apernet/hysteria
High
5 days ago

Hysteria vulnerable to server crash when max_datagram_frame_size very small GSA_kwCzR0hTQS1xaDV4LXJmd2YtcnZmds4ABZnN

go github.com/apernet/hysteria
High
5 days ago

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF GSA_kwCzR0hTQS12Z3JjLWhxMjgtcDN4cM4ABZnM

go github.com/apernet/hysteria/core/v2
High
5 days ago

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing GSA_kwCzR0hTQS00YzhqLW1nbTQtcXF2cM4ABZnK

go github.com/umputun/remark42
Moderate
5 days ago

Apptainer has incorrect path matching for 'limit container paths' directive GSA_kwCzR0hTQS1jcjJqLTUzNGYtbWYzZ84ABZnJ

go github.com/apptainer/apptainer
Critical
5 days ago

Incus has an arbitrary file write on its client due to trusted image hash GSA_kwCzR0hTQS1mNm01LXh3MmcteGM0eM4ABZnH

go github.com/lxc/incus/v7/cmd/incusd
Low
5 days ago

Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) GSA_kwCzR0hTQS14aHF4LW1naDMtM2g3cc4ABZnF

go github.com/lxc/incus/v7/cmd/incusd
Critical
5 days ago

Incus has an argument injection in backup compression algorithm leading to AFW and ACE GSA_kwCzR0hTQS12Nm1qLThwZjQtaGh3NM4ABZnE

go github.com/lxc/incus/v7/cmd/incusd
Low
5 days ago

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} GSA_kwCzR0hTQS00eGc2LTUybWgtZnB3OM4ABZnD

go github.com/lxc/incus/v7/cmd/incusd
Critical
5 days ago

Incus has an arbitrary file write via path traversal in S3 multipart upload GSA_kwCzR0hTQS1jY2pjLTRxYzMtanhxY84ABZnC

go github.com/lxc/incus/v7/cmd/incusd
Critical
5 days ago

Incus has arbitrary file read+write on host via templates/ symlink in malicious image GSA_kwCzR0hTQS12eHA1LTU4NHEtYzQ3Oc4ABZnB

go github.com/lxc/incus/v7/cmd/incusd
Critical
5 days ago

Incus has a restricted project bypass leading to arbitrary command execution GSA_kwCzR0hTQS00OHE1LXc4ODctMzN3ds4ABZm0

go github.com/lxc/incus/v7/cmd/incusd
Critical
5 days ago

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image GSA_kwCzR0hTQS03M2hyLW04NWYtNjR2Oc4ABZmz

go github.com/lxc/incus/v7/cmd/incusd
Critical
5 days ago

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image GSA_kwCzR0hTQS0ycTNmLXE1cHEtZzh3ds4ABZmy

go github.com/lxc/incus/v7/cmd/incusd
Critical
6 days ago

golang.org/x/crypto/ssh: Invoking VerifiedPublicKeyCallback permissions skip enforcement GSA_kwCzR0hTQS14NTI3LXg2NDctcTdnZ84ABZik

go golang.org/x/crypto/ssh
Critical
6 days ago

golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @revoked status GSA_kwCzR0hTQS01Y2dxLTNyZzgtbTZjds4ABZij

go golang.org/x/crypto/ssh/knownhosts
Critical
6 days ago

golang.org/x/crypto/ssh vulnerable to infinite loop on large channel writes GSA_kwCzR0hTQS1ybTNqLWY2OXctd3Ftcc4ABZii

go golang.org/x/crypto/ssh
Critical
6 days ago

golang.org/x/crypto/ssh: FIDO/U2F security key physical presence check can be bypassed GSA_kwCzR0hTQS04OWdyLXI1MmgtZjhyeM4ABZih

go golang.org/x/crypto/ssh
High
6 days ago

golang.org/x/crypto/ssh: Invoking pathological RSA/DSA parameters may cause DoS GSA_kwCzR0hTQS13ODc5LTIzN3Etd2M3cs4ABZig

go golang.org/x/crypto/ssh
Critical
6 days ago

golang.org/x/crypto/ssh: Invoking client can cause server deadlock on unexpected responses GSA_kwCzR0hTQS12Z3dmLWg3MzctZmYzN84ABZif

go golang.org/x/crypto/ssh
Moderate
6 days ago

golang.org/x/crypto/ssh: Invoking memory leak when rejecting channels can lead to DoS GSA_kwCzR0hTQS1xcHc0LTV4OTktNnZqcM4ABZie

go golang.org/x/crypto/ssh
Moderate
6 days ago

golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow GSA_kwCzR0hTQS03OG1xLXhjcjMteG0zM84ABZid

go golang.org/x/crypto/ssh
Moderate
6 days ago

golang.org/x/crypto/ssh vulnerable to invoking bypass of certificate restrictions GSA_kwCzR0hTQS00NWdnLXZoNTQtaDVtOc4ABZic

go golang.org/x/crypto/ssh
High
6 days ago

golang.org/x/crypto/ssh: Invoking byte arithmetic causes underflow and panic GSA_kwCzR0hTQS1xNGg0LWdtajItcXZ3Ms4ABZib

go golang.org/x/crypto/ssh
Critical
6 days ago

golang.org/x/crypto/ssh/agent doesn't drop invoking agent constraints when forwarding keys GSA_kwCzR0hTQS1mNXdjLWMzYzctMzZtY84ABZia

go golang.org/x/crypto/ssh/agent
Critical
6 days ago

golang.org/x/crypto/ssh/agent doesn't enforce invoking key constraints GSA_kwCzR0hTQS1qcHB4LXJ4Zzktam1yeM4ABZiZ

go golang.org/x/crypto/ssh/agent
Moderate
6 days ago

golang.org/x/crypto/ssh/agent: Invoking pathological inputs can lead to client panic GSA_kwCzR0hTQS05bTU3LTI1djMtNzl4Oc4ABZiY

go golang.org/x/crypto/ssh/agent
High
6 days ago

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic GSA_kwCzR0hTQS00N3E5LW00d3ctOTI0bc4ABZiJ

go github.com/sigstore/rekor
Moderate
6 days ago

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion GSA_kwCzR0hTQS1wanA1LWZwbXItMzM0Oc4ABZiI

go github.com/github/github-mcp-server
Moderate
6 days ago

chi Has an IP Spoofing Vulnerability in `middleware.RealIP` GSA_kwCzR0hTQS0zZnhqLTZqaDgtaHZoeM4ABZgo

go github.com/go-chi/chi/v5/middleware
High
6 days ago

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header GSA_kwCzR0hTQS1yanI3LWpnZ2gtcGdjcM4ABZgn

go github.com/go-chi/chi/v5/middleware, github.com/go-chi/chi/v4/middleware, github.com/go-chi/chi/v3/middleware, github.com/go-chi/chi/v2/middleware, github.com/go-chi/chi/middleware
High
6 days ago

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution GSA_kwCzR0hTQS05ZzVxLTJ3NXgtaG14Zs4ABZgm

go github.com/go-chi/chi/v5/middleware, github.com/go-chi/chi/v4/middleware, github.com/go-chi/chi/v3/middleware, github.com/go-chi/chi/v2/middleware, github.com/go-chi/chi/middleware
Moderate
6 days ago

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks GSA_kwCzR0hTQS1yNHY3LTZ3Y2ctZ2hqNc4ABZgl

go github.com/gtsteffaniak/filebrowser
Moderate
7 days ago

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering GSA_kwCzR0hTQS1wcmo5LTk3bXAtbXdoMs4ABZXl

go github.com/OliveTin/OliveTin
Low
7 days ago

OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration GSA_kwCzR0hTQS1mNjM3LXc3cDItbTdmeM4ABZXk

go github.com/OliveTin/OliveTin
High
7 days ago

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination GSA_kwCzR0hTQS03ZnE1LTd3cjgtcmp3as4ABZXj

go github.com/OliveTin/OliveTin
Moderate
8 days ago

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree GSA_kwCzR0hTQS13Y21qLXg0NjYtNTZtbc4ABZU0

go github.com/opentofu/opentofu
Moderate
8 days ago

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent GSA_kwCzR0hTQS1mMnI1LTVtN3ctcDVjeM4ABZUy

go go.opentelemetry.io/ebpf-profiler
High
8 days ago

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir GSA_kwCzR0hTQS1qYzNqLXg2cGctNGhtds4ABZUq

go github.com/xyproto/algernon
Moderate
8 days ago

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS GSA_kwCzR0hTQS0zdzI4LTM2cDktdzkyOc4ABZTZ

go gogs.io/gogs
Moderate
9 days ago

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API GSA_kwCzR0hTQS03NDR4LTM4MzgtNXI1Ns4ABZTV

go gogs.io/gogs
Moderate
9 days ago

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) GSA_kwCzR0hTQS14cDc5LTVteDMtang1Ms4ABZTU

go gogs.io/gogs
Critical
9 days ago

Gogs has Path Traversal in organization name that results in RCE through Git hooks GSA_kwCzR0hTQS1jMzl3LTQzZ20tMzRoNc4ABZTT

go gogs.io/gogs
High
9 days ago

Gogs: LFS dedupe path leaks private repo content across tenants GSA_kwCzR0hTQS02cDltLXEzanAtNDdoNM4ABZTS

go gogs.io/gogs
Critical
9 days ago

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym GSA_kwCzR0hTQS04OW1yLXhxZnYtNzU4bc4ABZTR

go gogs.io/gogs
High
9 days ago

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion GSA_kwCzR0hTQS13bWZnLTVwNGgtNWZ3M84ABZTQ

go gogs.io/gogs
Moderate
9 days ago

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES GSA_kwCzR0hTQS01YzNmLTY0ODYtM2c3Z84ABZTP

go gogs.io/gogs
High
9 days ago

Gogs's write-level collaborators can mutate admin-only repository settings via API GSA_kwCzR0hTQS0yNjhqLTM3eGYtcHA1Ms4ABZTO

go gogs.io/gogs

Filter by Severity

Moderate 1,826 High 1,530 Critical 453 Low 325

Filter by Package

github.com/mattermost/mattermost/server/v8 198 github.com/mattermost/mattermost-server 176 gogs.io/gogs 75 github.com/usememos/memos 75 github.com/grafana/grafana 62 github.com/rancher/rancher 61 github.com/hashicorp/vault 55 github.com/siyuan-note/siyuan/kernel 51 github.com/traefik/traefik/v2 45 code.gitea.io/gitea 42 github.com/traefik/traefik/v3 41 k8s.io/kubernetes 41 github.com/mattermost/mattermost-server/v6 37 github.com/zitadel/zitadel 37 github.com/argoproj/argo-cd/v2 36 github.com/cilium/cilium 35 github.com/filebrowser/filebrowser/v2 34 github.com/answerdev/answer 34 github.com/hashicorp/nomad 34 code.vikunja.io/api 33 github.com/hashicorp/consul 32 github.com/docker/docker 32 github.com/argoproj/argo-cd 31 github.com/nats-io/nats-server/v2 27 github.com/fleetdm/fleet/v4 27 github.com/ethereum/go-ethereum 26 github.com/openfga/openfga 26 github.com/openbao/openbao 26 github.com/traefik/traefik 24 github.com/goharbor/harbor 23 helm.sh/helm/v3 21 github.com/kyverno/kyverno 21 github.com/containerd/containerd 20 github.com/gotenberg/gotenberg/v8 20 github.com/go-gitea/gitea 20 github.com/juju/juju 19 golang.org/x/net 19 k8s.io/ingress-nginx 17 github.com/1Panel-dev/1Panel 17 kubevirt.io/kubevirt 17 github.com/opencontainers/runc 17 github.com/OliveTin/OliveTin 16 github.com/authzed/spicedb 16 github.com/coredns/coredns 16 github.com/ollama/ollama 16 github.com/0xJacky/Nginx-UI 16 github.com/nezhahq/nezha 15 github.com/zitadel/zitadel/v2 15 github.com/minio/minio 15 github.com/caddyserver/caddy/v2 15 github.com/fission/fission 14 github.com/canonical/lxd 14 github.com/filebrowser/filebrowser 14 github.com/argoproj/argo-workflows/v3 14 github.com/mattermost/mattermost-plugin-confluence 14 github.com/ellanetworks/core 14 github.com/pterodactyl/wings 13 github.com/cosmos/cosmos-sdk 13 github.com/cri-o/cri-o 13 github.com/containers/podman/v4 12 github.com/go-git/go-git/v5 12 github.com/lin-snow/ech0 12 github.com/casdoor/casdoor 12 golang.org/x/crypto 12 github.com/moby/moby 12 github.com/juev/nebula-mesh 12 github.com/pomerium/pomerium 11 github.com/patrickhener/goshs 11 go.opentelemetry.io/obi 11 github.com/containerd/containerd/v2 11 github.com/bishopfox/sliver 11 github.com/cloudflare/cfrpki 11 github.com/navidrome/navidrome 11 github.com/treeverse/lakefs 11 go.etcd.io/etcd/v3 11 github.com/envoyproxy/envoy 11 github.com/dragonflyoss/dragonfly 11 github.com/gravitl/netmaker 11 github.com/axllent/mailpit 11 github.com/gohugoio/hugo 11 github.com/cometbft/cometbft 11 github.com/sylabs/singularity 10 github.com/greenpau/caddy-security 10 github.com/hashicorp/go-getter 10 github.com/Tencent/WeKnora 10 github.com/charmbracelet/soft-serve 10 github.com/forceu/gokapi 10 github.com/gofiber/fiber/v2 10 github.com/beego/beego/v2 10 istio.io/istio 10 github.com/lxc/incus/v6/cmd/incusd 10 github.com/oauth2-proxy/oauth2-proxy/v7 9 github.com/edgelesssys/contrast 9 github.com/apache/incubator-answer 9 github.com/containers/buildah 9 github.com/argoproj/argo-cd/v3 9 golang.org/x/crypto/ssh 9 github.com/kubernetes/kubernetes 9 github.com/omec-project/amf 9 github.com/portainer/portainer 9 github.com/free5gc/udr 9 github.com/lxc/incus/v7/cmd/incusd 9 github.com/esm-dev/esm.sh 9 github.com/containers/podman/v5 8 github.com/consensys/gnark 8 github.com/getarcaneapp/arcane/backend 8 github.com/argoproj/argo-workflows/v4 8 github.com/xyproto/algernon 8 github.com/lxc/incus/v6 8 github.com/opentofu/opentofu 8 github.com/klever-io/klever-go 8 github.com/kubeedge/kubeedge 8 chainguard.dev/melange 8 github.com/neuvector/neuvector 8 github.com/stacklok/minder 8 github.com/tektoncd/pipeline 8 github.com/beego/beego 8 go.etcd.io/etcd 8 github.com/quic-go/quic-go 8 github.com/rancher/fleet 7 github.com/free5gc/udm 7 github.com/lf-edge/eve 7 github.com/gophish/gophish 7 github.com/hyperledger/fabric 7 github.com/drakkan/sftpgo/v2 7 github.com/authelia/authelia/v4 7 github.com/alist-org/alist/v3 7 github.com/coder/coder/v2 7 www.velocidex.com/golang/velociraptor 7 chainguard.dev/apko 7 github.com/mattermost/mattermost-server/v5 7 github.com/sigstore/cosign 7 github.com/google/fscrypt 7 github.com/mattermost/mattermost 7 github.com/enchant97/note-mark/backend 7 github.com/moby/buildkit 7 github.com/osrg/gobgp/v4 7 github.com/free5gc/nef 7 github.com/QuantumNous/new-api 7 github.com/russellhaering/goxmldsig 6 github.com/projectcapsule/capsule 6 vitess.io/vitess 6 github.com/fluxcd/flux2 6 github.com/mattermost/mattermost-plugin-playbooks 6 github.com/dgraph-io/dgraph/v25 6 go.temporal.io/server 6 github.com/caddyserver/caddy 6 github.com/russellhaering/gosaml2 6 github.com/cli/cli/v2 6 goauthentik.io 6 github.com/foxcpp/maddy 6 github.com/lf-edge/ekuiper/v2 6 github.com/prometheus/prometheus 6 helm.sh/helm 6 github.com/patrickhener/goshs/v2 6 github.com/cubefs/cubefs 6 github.com/apache/trafficcontrol 6 github.com/ory/oathkeeper 6 github.com/open-policy-agent/opa 6 github.com/pion/dtls/v2 6 github.com/containers/podman/v3 6 github.com/siderolabs/omni 6 miniflux.app/v2 6 github.com/projectdiscovery/nuclei/v3 5 github.com/snapcore/snapd 5 github.com/hashicorp/boundary 5 github.com/free5gc/amf 5 github.com/CosmWasm/wasmvm 5 github.com/sigstore/rekor 5 github.com/openziti/zrok 5 github.com/gtsteffaniak/filebrowser 5 github.com/cheqd/cheqd-node 5 github.com/crossplane/crossplane 5 github.com/tendermint/tendermint 5 github.com/kiali/kiali 5 github.com/concourse/concourse 5 oras.land/oras-go/v2 5 github.com/openziti/zrok/v2 5 github.com/schollz/croc/v9 5 github.com/lin-snow/Ech0 5 github.com/AdguardTeam/AdGuardHome 5 github.com/osrg/gobgp/v3 5 github.com/bnb-chain/tss-lib 5 github.com/dexidp/dex 5 github.com/external-secrets/external-secrets 5 github.com/modelcontextprotocol/registry 5 github.com/go-git/go-git/v6 5 github.com/fluxcd/kustomize-controller 5 github.com/pion/dtls 5 github.com/owncast/owncast 5 github.com/oauth2-proxy/oauth2-proxy 5 github.com/rclone/rclone 5 github.com/CosmWasm/wasmd 5 github.com/IBAX-io/go-ibax 5 cosmwasm-vm 5 github.com/elastic/beats/v7 5 github.com/nhost/nhost 5 github.com/t2bot/matrix-media-repo 5 github.com/CosmWasm/wasmvm/v2 5 github.com/lf-edge/ekuiper 5

Filter by Repository

https://github.com/usememos/memos 68 https://github.com/kubernetes/kubernetes 65 https://github.com/mattermost/mattermost 59 https://github.com/argoproj/argo-cd 50 https://github.com/grafana/grafana 46 https://github.com/rancher/rancher 46 https://github.com/answerdev/answer 34 https://github.com/go-gitea/gitea 32 https://github.com/cilium/cilium 31 https://github.com/gogs/gogs 28 https://github.com/zitadel/zitadel 26 https://github.com/traefik/traefik 25 https://github.com/hashicorp/consul 24 https://github.com/moby/moby 23 https://github.com/helm/helm 22 https://github.com/hashicorp/vault 21 https://github.com/goharbor/harbor 21 https://github.com/containerd/containerd 19 https://github.com/ethereum/go-ethereum 17 https://github.com/openfga/openfga 17 https://github.com/etcd-io/etcd 16 https://github.com/hashicorp/nomad 16 https://github.com/opencontainers/runc 15 https://github.com/golang/go 14 https://github.com/containers/podman 14 https://github.com/cosmos/cosmos-sdk 14 https://github.com/openbao/openbao 13 https://github.com/1Panel-dev/1Panel 13 https://github.com/nats-io/nats-server 12 https://github.com/cometbft/cometbft 11 https://github.com/filebrowser/filebrowser 11 https://github.com/kubevirt/kubevirt 11 https://github.com/cloudflare/cfrpki 11 https://github.com/beego/beego 11 https://github.com/pomerium/pomerium 11 https://github.com/dragonflyoss/dragonfly 11 https://github.com/cri-o/cri-o 11 https://github.com/canonical/lxd 10 https://github.com/greenpau/caddy-security 10 https://github.com/authzed/spicedb 10 https://github.com/kyverno/kyverno 10 https://github.com/juju/juju 9 https://github.com/treeverse/lakeFS 9 https://github.com/hashicorp/go-getter 9 https://github.com/argoproj/argo-workflows 9 https://github.com/casdoor/casdoor 9 https://github.com/containers/buildah 8 https://github.com/gofiber/fiber 8 https://github.com/navidrome/navidrome 8 https://github.com/stacklok/minder 8 https://github.com/kubeedge/kubeedge 8 https://github.com/pterodactyl/wings 8 https://github.com/minio/minio 8 https://github.com/Consensys/gnark 8 https://github.com/istio/istio 8 https://github.com/docker/docker 8 https://github.com/kubernetes/ingress-nginx 7 https://github.com/neuvector/neuvector 7 https://github.com/ollama/ollama 7 https://github.com/evmos/evmos 7 https://github.com/google/fscrypt 7 https://github.com/hpcng/singularity 7 https://github.com/hyperledger/fabric 7 https://github.com/gravitl/netmaker 6 https://github.com/charmbracelet/soft-serve 6 https://github.com/cubefs/cubefs 6 https://github.com/moby/buildkit 6 https://github.com/quic-go/quic-go 6 https://github.com/fluxcd/flux2 6 https://github.com/schollz/croc 6 https://github.com/open-policy-agent/opa 6 https://github.com/coredns/coredns 6 https://github.com/sigstore/cosign 6 https://github.com/drakkan/sftpgo 6 https://github.com/lf-edge/ekuiper 6 https://github.com/pion/dtls 6 https://github.com/git-lfs/git-lfs 6 https://github.com/oauth2-proxy/oauth2-proxy 6 https://github.com/0xJacky/nginx-ui 5 https://github.com/tendermint/tendermint 5 https://github.com/crewjam/saml 5 https://github.com/edgelesssys/contrast 5 https://github.com/CosmWasm/wasmvm 5 https://github.com/CosmWasm/wasmd 5 https://github.com/free5gc/free5gc 5 https://github.com/cli/cli 5 https://github.com/t2bot/matrix-media-repo 5 https://github.com/IBAX-io/go-ibax 5 https://github.com/foxcpp/maddy 5 https://github.com/gophish/gophish 5 https://github.com/osrg/gobgp 5 https://github.com/siyuan-note/siyuan 5 https://github.com/cheqd/cheqd-node 5 https://github.com/ipfs/go-ipfs 5 https://github.com/woodpecker-ci/woodpecker 4 https://github.com/IceWhaleTech/CasaOS-UserService 4 https://github.com/lestrrat-go/jwx 4 https://github.com/ory/fosite 4 https://github.com/golang/crypto 4 https://github.com/BishopFox/sliver 4 https://github.com/projectdiscovery/nuclei 4 https://github.com/authelia/authelia 4 https://github.com/arduino/arduino-create-agent 4 https://github.com/dexidp/dex 4 https://github.com/russellhaering/gosaml2 4 https://github.com/go-vela/server 4 https://github.com/snapcore/snapd 4 https://github.com/notaryproject/notation-go 4 https://github.com/containous/traefik 4 https://github.com/concourse/concourse 4 https://github.com/go-git/go-git 4 https://github.com/owncast/owncast 4 https://github.com/apache/trafficcontrol 4 https://github.com/siderolabs/talos 4 https://github.com/crossplane/crossplane 4 https://github.com/cosmos/ibc-go 4 https://github.com/edgelesssys/constellation 4 https://github.com/dhowden/tag 4 https://github.com/gin-gonic/gin 4 https://github.com/coder/coder 4 https://github.com/tidwall/gjson 4 https://github.com/babylonlabs-io/babylon 4 https://github.com/grafana/bugbounty 4 https://github.com/meshery/meshery 4 https://github.com/alist-org/alist 4 https://github.com/vitessio/vitess 4 https://github.com/chaos-mesh/chaos-mesh 4 https://github.com/envoyproxy/envoy 4 https://github.com/mholt/archiver 3 https://github.com/syncthing/syncthing 3 https://github.com/runatlantis/atlantis 3 https://github.com/artifacthub/hub 3 https://github.com/phachon/mm-wiki 3 https://github.com/mudler/localai 3 https://github.com/tailscale/tailscale 3 https://github.com/square/go-jose 3 https://github.com/kiali/kiali 3 https://github.com/KubeOperator/KubePi 3 https://github.com/apache/incubator-answer 3 https://github.com/moby/libnetwork 3 https://github.com/NVIDIA/gpu-operator 3 https://github.com/project-zot/zot 3 https://github.com/gogits/gogs 3 https://github.com/openshift/origin 3 https://github.com/plentico/plenti 3 https://github.com/tiagorlampert/CHAOS 3 https://github.com/ctfer-io/chall-manager 3 https://github.com/weaveworks/weave-gitops 3 https://github.com/open-telemetry/opentelemetry-go-contrib 3 https://github.com/mattermost/mattermost-plugin-boards 3 https://github.com/dutchcoders/transfer.sh 3 https://github.com/siderolabs/omni 3 https://github.com/heketi/heketi 3 https://github.com/sylabs/singularity 3 https://github.com/temporalio/temporal 3 https://github.com/ory/oathkeeper 3 https://github.com/AlexxIT/go2rtc 3 https://github.com/libp2p/go-libp2p 3 https://github.com/caddyserver/caddy 3 https://github.com/go-yaml/yaml 3 https://github.com/Consensys/gnark-crypto 3 https://github.com/fleetdm/fleet 3 https://github.com/distribution/distribution 3 https://github.com/goauthentik/authentik 3 https://github.com/edgelesssys/marblerun 3 https://github.com/aws/aws-sdk-go 3 https://github.com/flyteorg/flyteadmin 3 https://github.com/argoproj/argo-events 3 https://github.com/lightningnetwork/lnd 3 https://github.com/cloudflare/circl 3 https://github.com/kcp-dev/kcp 3 https://github.com/cortexproject/cortex 3 https://github.com/mattermost/mattermost-plugin-playbooks 3 https://github.com/clidey/whodb 3 https://github.com/ElrondNetwork/elrond-go 3 https://github.com/karmada-io/karmada 3 https://github.com/ubuntu/authd 3 https://github.com/go-jose/go-jose 3 https://github.com/pingcap/tidb 3 https://github.com/u-root/u-root 3 https://github.com/ipfs/boxo 3 https://github.com/kubernetes-sigs/secrets-store-csi-driver 3 https://github.com/IoFinnet/tss-lib 3 https://github.com/SpectoLabs/hoverfly 3 https://github.com/nats-io/jwt 3 https://github.com/gohugoio/hugo 3 https://github.com/theupdateframework/go-tuf 3 https://github.com/miniflux/v2 3 https://github.com/imgproxy/imgproxy 3 https://github.com/flipped-aurora/gin-vue-admin 3 https://github.com/metal3-io/baremetal-operator 3 https://github.com/filecoin-project/go-f3 2 https://github.com/gomarkdown/markdown 2 https://github.com/btcsuite/btcd 2 https://github.com/jackc/pgx 2 https://github.com/goreleaser/goreleaser 2 https://github.com/sajari/docconv 2 https://github.com/containers/image 2 https://github.com/kitabisa/teler 2