Tagged “go”

▾ Twilightgolang · goEPSS 0.66%via NVD

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the l…

CVE-2026-25679High· 7.5

▾ Twilightgolang · goEPSS 0.80%via NVD

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVE-2021-25320Critical· 9.9

▾ Midnightrancher · github.com/rancher/rancherEPSS 0.85%via OSV

Rancher cloud credentials can be used through proxy API by users without access

CVE-2022-21951Medium· 6.8

▾ Sunlitrancher · github.com/rancher/rancherEPSS 0.39%via OSV

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

CVE-2023-22648High· 8.0

▾ Twilightrancher · github.com/rancher/rancherEPSS 0.45%via OSV

Rancher's Azure AD permission changes are not reflected on active sessions

CVE-2021-36783Critical· 9.9

▾ Midnightrancher · github.com/rancher/rancherEPSS 0.78%via OSV

Rancher doesn't properly sanitize credentials in cluster template answers

CVE-2022-31247Critical· 9.1

▾ Midnightrancher · github.com/rancher/rancherEPSS 0.98%via OSV

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

CVE-2026-22728Medium· 4.9

▾ Sunlitbitnami-labs · github.com/bitnami-labs/sealed-secretsEPSS 0.36%via OSV

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotat…

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

CVE-2026-24834High· 8.8

▾ Twilightkata-containers · github.com/kata-containers/kata-containers/src/runtimeEPSS 0.22%via OSV

Kata Container to Guest micro VM privilege escalation

CVE-2026-27017Low

▾ Sunlitrefraction-networking · github.com/refraction-networking/utlsEPSS 0.19%via OSV

uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots

CVE-2025-67860Low· 3.8

▾ Sunlitneuvector · github.com/neuvector/scannerEPSS 0.09%via OSV

NeuVector scanner insecurely handles passwords as command arguments

CVE-2026-21438Medium· 5.3

▾ Sunlitquic-go · github.com/quic-go/webtransport-goEPSS 0.38%via OSV

webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map

CVE-2026-26190Critical· 9.8PoC

▾ Abyssalmilvus-io · github.com/milvus-io/milvusEPSS 4.0%via OSV

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

CVE-2026-25890High· 8.1PoC

▾ Midnightfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.55%via OSV

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

CVE-2026-2303Medium· 6.5

▾ Sunlitmongo-driver · go.mongodb.org/mongo-driverEPSS 0.23%via OSV

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

CVE-2025-66630Critical

▾ Midnightgofiber · github.com/gofiber/fiber/v2EPSS 0.49%via OSV

Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

CVE-2026-25934Medium· 4.3

▾ SunlitRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.15%via CSAF

go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files (CVE-2026-25934)

A flaw was found in go-git, a library for Git implementation in Go. This vulnerability allows a remote attacker to provide specially crafted Git pack or index files that are not properly verified for data integrity. Successful exploitation…

CVE-2026-25793High

▾ Sunlitmelange · chainguard.dev/melangeEPSS 0.18%via OSV

melange has a path traversal in license-path which allows reading files outside workspace

CVE-2026-24514Medium· 6.5PoC

▾ Twilightingress-nginx · k8s.io/ingress-nginxEPSS 0.49%via OSV

ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling

CVE-2026-25122Medium· 5.5

▾ Sunlitapko · chainguard.dev/apkoEPSS 0.11%via OSV

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

CVE-2026-25121High· 7.5

▾ Twilightapko · chainguard.dev/apkoEPSS 0.39%via OSV

apko has a path traversal in apko dirFS which allows filesystem writes outside base

CVE-2025-61730Medium· 5.3

▾ SunlitRed Hat · Red Hat Ceph Storage 6EPSS 0.33%via CSAF

crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVE-2025-61730)

A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted E…

CVE-2025-61728None

▾ Sunlitstdlib · stdlibEPSS 0.75%via OSV

Excessive CPU consumption when building archive index in archive/zip

CVE-2025-11065Medium· 5.3

▾ Sunlitgo-viper · github.com/go-viper/mapstructure/v2EPSS 0.41%via NVD

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input valu…

CVE-2025-66719Critical· 9.1

▾ Midnightfree5gc · github.com/free5gc/nrfEPSS 0.35%via OSV

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

CVE-2026-24117Medium· 5.3