Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-259r-337f-4rfw
  • Go/github.com/klauspost/compress
 Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress 8 hours ago
  • Fix available
  • Severity - 7.5 (High)
GO-2026-6671
  • Go/github.com/sipcapture/homer-app
 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on... 22 hours ago
  • No fix available
GO-2026-6672
  • Go/github.com/sipcapture/homer-app
 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in... 22 hours ago
  • No fix available
GO-2026-6673
  • Go/github.com/sipcapture/homer-app
 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty... 22 hours ago
  • No fix available
GO-2026-6667
  • Go/github.com/external-secrets/external-secrets
 External Secrets Operator: label enforcement bypass in webhook generator... 22 hours ago
  • Fix available
GO-2026-6668
  • Go/github.com/corazawaf/coraza
  • Go/github.com/corazawaf/coraza/v2
  • Go/github.com/corazawaf/coraza/v3
 Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted... 22 hours ago
  • Fix available
GO-2026-6669
  • Go/github.com/corazawaf/coraza
  • Go/github.com/corazawaf/coraza/v2
  • Go/github.com/corazawaf/coraza/v3
 Coraza: Native audit-log format allows CRLF injection and log forgery via... 22 hours ago
  • Fix available
GO-2026-6670
  • Go/github.com/corazawaf/coraza
  • Go/github.com/corazawaf/coraza/v2
  • Go/github.com/corazawaf/coraza/v3
 Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003)... 22 hours ago
  • Fix available
GO-2026-6651
  • Go/github.com/xtls/xray-core
 Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of... 22 hours ago
  • Fix available
GO-2026-6773
  • Go/github.com/0xJacky/Nginx-UI
 Casdoor SSO callback uses a constant state parameter (login CSRF) in... yesterday
  • No fix available
GO-2026-6786
  • Go/github.com/0xJacky/Nginx-UI
 TOTP / passkey enrolment requires no re-authentication, enabling persistent... yesterday
  • No fix available
GO-2026-6765
  • Go/github.com/cli/cli
  • Go/github.com/cli/cli/v2
 GitHub CLI allows path traversal through unescaped request URL components in... yesterday
  • Fix available
GO-2026-6766
  • Go/github.com/cli/cli
  • Go/github.com/cli/cli/v2
 GitHub CLI partially discloses authentication tokens in `gh auth status` output... yesterday
  • Fix available
GO-2026-6767
  • Go/github.com/cli/cli
  • Go/github.com/cli/cli/v2
 GitHub CLI allows attestation verification bypass through unescaped regex... yesterday
  • Fix available
GO-2026-6768
  • Go/github.com/gruntwork-io/terragrunt
 Terragrunt catalog predictable temp symlink clobber in... yesterday
  • Fix available
GO-2026-6770
  • Go/github.com/containers/podman
  • Go/github.com/containers/podman/v2
  • Go/github.com/containers/podman/v3
  • Go/github.com/containers/podman/v4
  • Go/github.com/containers/podman/v5
  • ... 1 more
 Podman: The `podman run` command can be instructed to disable almost all... yesterday
  • Fix available
Load more...