Tagged “go”

▾ SunlitRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.43%via CSAF

github.com/sigstore/rekor: Rekor denial of service (CVE-2026-23831)

Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message. validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Ca…

CVE-2026-23991Medium· 5.9

▾ SunlitRed Hat · OpenShift PipelinesEPSS 0.58%via CSAF

github.com/theupdateframework/go-tuf/v2: go-tuf client DoS via malformed server response (CVE-2026-23991)

A denial of service flaw has been discovered in go-tuf. If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial o…

CVE-2026-23990Medium· 5.3

▾ Sunlitcontrolplaneio-fluxcd · github.com/controlplaneio-fluxcd/flux-operatorEPSS 0.44%via OSV

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

CVE-2026-23849Medium· 5.3

▾ Sunlitfilebrowser · github.com/filebrowser/filebrowserEPSS 0.48%via OSV

File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login

CVE-2026-23644High

▾ Twilightesm-dev · github.com/esm-dev/esm.shEPSS 0.56%via OSV

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

CVE-2025-69725Medium· 4.7

▾ Sunlitgo-chi · github.com/go-chi/chi/v5EPSS 0.26%via OSV

chi has an open redirect vulnerability in the RedirectSlashes middleware

CVE-2026-22772Medium· 5.8

▾ SunlitRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.23%via CSAF

fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation (CVE-2026-22772)

A flaw was found in Fulcio, a certificate authority for issuing code signing certificates. A remote attacker could exploit this by bypassing MetaIssuer URL validation due to unanchored regular expressions (regex) in the `metaRegex()` funct…

CVE-2026-22703Medium· 5.5

▾ SunlitRed Hat · OpenShift PipelinesEPSS 0.11%via CSAF

github.com/sigstore/cosign: Cosign verification accepts any valid Rekor entry under certain conditions (CVE-2026-22703)

A data verification flaw has been discovered in the golang cosign library. A Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key…

CVE-2025-68151High· 7.5

▾ Twilightcoredns.io · corednsEPSS 0.49%via NVD

CoreDNS is a DNS server that chains plugins

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and d…

CVE-2025-66001High· 8.8

▾ Twilightneuvector · github.com/neuvector/neuvectorEPSS 0.36%via NVD

NeuVector supports login authentication through OpenID Connect

NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the …

CVE-2025-68939High· 8.2

▾ Twilightgitea · giteaEPSS 0.33%via NVD

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

CVE-2025-68383Medium· 6.5

▾ Sunlitelastic · github.com/elastic/beats/v7EPSS 0.19%via OSV

Filebeat Beats has Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in Dissect Configuration

CVE-2025-63389Critical· 9.8

▾ Midnightollama · ollamaEPSS 0.71%via NVD

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers …

CVE-2025-66491Medium· 5.9

▾ Sunlittraefik · traefikEPSS 0.22%via NVD

Traefik is an HTTP reverse proxy and load balancer

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable bac…

CVE-2025-66564High· 7.5

▾ Twilightsigstore · github.com/sigstore/timestamp-authorityEPSS 0.47%via OSV

Sigstore Timestamp Authority allocates excessive memory during request parsing

CVE-2025-65637HighPoC

▾ Midnightsirupsen · github.com/sirupsen/logrusEPSS 0.68%via OSV

Logrus is vulnerable to DoS when using Entry.Writer()

CVE-2025-10543Medium

▾ Sunliteclipse · github.com/eclipse/paho.mqtt.golangEPSS 0.24%via OSV

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

CVE-2025-61729None

▾ Sunlitstdlib · stdlibEPSS 0.49%via OSV

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

CVE-2025-64715Medium· 4.0

▾ Sunlitcilium · github.com/cilium/ciliumEPSS 0.18%via OSV

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

CVE-2025-65965High

▾ TwilightRed Hat · Red Hat Enterprise Linux AppStream E4S (v.8.6)EPSS 0.67%via CSAF

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSH_AGENT_SUCCESS (0x06) message to requests expecting typed replies (e.g., List, Sign). The unmarshal layer produces an une…

CVE-2025-64324High· 7.7

▾ Twilightkubevirt · kubevirt.io/kubevirtEPSS 0.24%via OSV

KubeVirt Vulnerable to Arbitrary Host File Read and Write

CVE-2025-64436Medium· 5.3

▾ Sunlitkubevirt · kubevirt.io/kubevirtEPSS 0.28%via OSV

KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

CVE-2025-64437Medium· 5.0

▾ Sunlitkubevirt · kubevirt.io/kubevirtEPSS 0.23%via OSV

KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes

CVE-2025-58188High· 7.5

▾ Twilightgolang · goEPSS 0.38%via NVD

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.

CVE-2025-58183Medium· 4.3