Golang
Monthly
Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.
Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.
Unauthenticated remote attackers can exhaust server memory in applications built on the Go standard library by submitting crafted multipart/form-data requests, because the mime/multipart parser reads an arbitrarily long line into memory whenever the remaining memory limit at the start of a part drops below 400 bytes. Affected runtimes are Go releases prior to 1.27.2 and prior to 1.26.9, including the mime/multipart and net/textproto packages; any service that parses attacker-supplied multipart forms - for example via net/http Request.ParseMultipartForm or Request.FormFile - is reachable, while internal or non-multipart endpoints are not. This is a denial-of-service (CWE-770) issue with no confirmed active exploitation and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), CISA SSVC rates exploitation as none with partial technical impact, and the vendor has shipped patched releases.
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Go toolchain (cmd/go) releases before 1.26.9 and 1.27.0 through 1.27.1 can be induced to substitute an attacker-controlled module in place of the bundled golang.org/fips140 dependency when a developer builds a project that ships a bogus golang.org/fips140 definition and connects the build to an attacker-operated GOMODPROXY. Successful abuse yields high confidentiality, integrity, and availability impact within the build environment because the toolchain fails to properly validate the module's integrity check value (CWE-354), so untrusted module content is accepted in place of the trusted bundled copy. Exploitation is conditional rather than widespread: it requires both an attacker-crafted project and explicit developer action to use a non-default, attacker-chosen proxy (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis, with EPSS at roughly 0.11% (1st percentile). Vendor patches are available in Go 1.26.9 and 1.27.2.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to pin a CPU core by supplying a crafted agile-encrypted .xlsx workbook whose OLE encryption header declares an excessively large spinCount, which the library feeds unbounded into its password-key derivation loop. Opening such a file with decryption attempted (OpenFile with a password) makes agileDecrypt run attacker-selected iterations before any verifier validation, and the work cannot be cancelled. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the impact per malicious file is bounded to one CPU core rather than a full host outage. An upstream fix exists in PR #2389 / commit 2badfcd, but no tagged patched release is confirmed.
Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.
Arbitrary file write as the grading teacher in Classroom 50 (the `gh teacher` CLI) before 1.11.0 lets an enrolled student escalate from a writable assignment repository to code execution in the teacher's session: because `gh teacher download` writes autograde artifacts (`result.json` and `results.json`) into the just-cloned student working tree without guarding pre-existing entries, a student who commits either name as a symlink, hardlink, FIFO or directory redirects that write to any path the teacher can reach - `~/.ssh/authorized_keys`, `~/.zshrc`, a cron file, or an in-clone `.git/hooks/*` script that git then executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`, or student-chosen submit-tag names for `results.json`), and the compromised `gh` token carries `admin:org`, `repo` and `workflow` across the whole classroom organization. Rated 9.4 under CVSS 4.0 and high priority by our independent review, exploitation is not anonymous and not zero-click: it requires classroom enrollment, a planted malicious entry, and the teacher running the vulnerable command against that untrusted repository (UI:P); no public exploit code was identified at time of analysis, no CISA KEV listing is present, and no EPSS score was supplied. Version 1.11.0 contains the patch.
Memory exhaustion and parser panics in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious PLC device, or an attacker able to inject or spoof frames on the industrial network path, to crash or exhaust the client application, resulting in denial of service. The flaws affect Go module github.com/apache/plc4x/plc4go from 0.11.0 up to but not including 1.0.0 and include unbounded wire-claimed array and buffer allocations, unchecked indexing of ADS and KNXnet/IP responses, zero-length framing that breaks ADS and EIP message boundaries, unlimited recursion in recursive protocol types, and 16-bit length/position arithmetic in generated serializers that wraps and can cause payloads larger than 8 KB to be mis-framed. CVSS vector indicates no authentication is required (PR:N) and no public exploit has been identified at time of analysis; exploitation is limited to environments where a PLC4Go client talks to untrusted or attacker-reachable industrial endpoints, and impact is availability only.
Signed integer overflow in the s2 dictionary API of klauspost/compress before 1.18.7 lets an attacker crash a consuming Go process: a dictionary carrying a uvarint-encoded repeat value larger than MaxInt64 slips past repeat-index validation, and a subsequent call to Dict.Encode() converts the overflowed negative repeat value into an out-of-bounds unsafe.Pointer access that aborts the process with SIGSEGV. The issue is availability-only (C:N/I:N, A:H) on a CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, but real exposure hinges on the application - it only matters where untrusted, attacker-influenced bytes reach s2.NewDict() and the resulting dictionary is then encoded, not in ordinary compression or decompression of arbitrary data. No public exploit code and no CISA KEV entry were identified at time of analysis; the vendor-released patch is v1.18.7.
SiYuan versions before v3.8.4 contain a SQL injection vulnerability (CWE-89) in block query embed blocks that allows remote, unauthenticated attackers to execute arbitrary SQL against the local siyuan.db database, but exploitation requires the victim to import a malicious .sy document (UI:R). Successful exploitation enables high confidentiality impact (e.g., data exfiltration via VACUUM INTO) and low integrity impact (data tampering), with no availability impact, per the independent CVSS 3.1 assessment. No public exploit or CISA KEV entry is currently known, but a vendor patch (v3.8.4) is available.
Workload secrets are written to the initializer's standard output at INFO level in Edgeless Systems Contrast versions 1.9.0 through 1.12.1, so any Kubernetes principal that holds get or list permission on the pods/logs subresource in the affected namespace can read them from the container log stream. Because those workload secrets back Contrast's encrypted storage and HashiCorp Vault integration, the storage keys and Vault credentials derived from them must also be treated as compromised, giving the attacker a path to decrypt protected data and reach Vault-backed secrets. The flaw is a regression of GHSA-h5f8-crrq-4pw8 (originally fixed in 1.8.1 but never ported to the main branch), patchable in 1.12.2; there is no public exploit identified at time of analysis and no KEV listing, so risk is driven by the low barrier of an existing log-read RBAC grant rather than by active exploitation.
Source-IP spoofing in Zoraxy 3.2.3 through 3.3.4 lets unauthenticated attackers who reach the service over IPv6 forge X-Forwarded-For and X-Original-IP values, so IP-based access controls enforced by Zoraxy's SSO forward-auth provider see a trusted client address and grant access (CWE-290). The 9.1 CVSS 4.0 severity reflects fully unauthenticated remote exploitation (PR:N), but our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) rates the real-world risk lower because exploitation requires IPv6 connectivity and a deployment that actually relies on forward-auth IP allowlisting as a security boundary, so IPv4-only or non-IP-gated instances are not exploitable. No public exploit code was identified at time of analysis and there is no KEV entry, though a vendor patch is available.
Remote code execution is achievable on self-hosted deployments of golang.org/x/playground by chaining two independent weaknesses: a crafted txtar archive that escapes the intended execution context and forces arbitrary writes into the playground host's trusted filesystem, plus a malicious go env configuration file that one of the three go vet invocation paths reads from the host's $HOME because that path fails to properly restrict its execution environment. Neither primitive is sufficient on its own - the attacker must combine the filesystem write with the poisoned environment file to reach code execution on the host, and the reachable surface is bounded to one specific vulnerable go vet invocation path out of three. The public go.dev/play service is explicitly NOT affected, so exposure is limited to independent forks and self-hosted deployments running golang.org/x/playground versions before 0.0.0-20260924211604-6d73cff14c17; no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none), and the vendor has released a patch.
Path traversal and arbitrary file write in the oras-go OCI artifact library prior to 2.6.2 allow a malicious artifact layer marked with the io.deis.oras.content.unpack=true annotation to escape the content/file.Store extraction root and create or overwrite any file writable by the pulling process, potentially leading to code execution. Exploitation is unauthenticated from an attacker's network position (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R) because the victim must pull the attacker-controlled artifact reference; the bug bypasses the AllowPathTraversalOnWrite=false default, so no permissive configuration is needed. Scored 8.8 High, with no public exploit identified at time of analysis and no CISA KEV listing; a vendor patch is available in oras-go 2.6.2.
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) allows an authenticated attacker or server misconfiguration to crash the process by triggering a panic in an internal goroutine that escapes the panic-recovery middleware. The flaw requires a network-reachable instance and low-privilege access (e.g., superuser) for the most directly reachable paths such as backup restore or view creation; public exploit code exists. Impact is limited to availability, causing process termination and requiring a restart, with no data exposure or code execution.
Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer to permanently freeze an SSH connection by flooding the incomingRequests queue of a channel that has been registered in the mux's chanList but not yet established. The attack exploits the absence of any established-state guard in the packet handler, causing a deadlock that renders the entire connection unresponsive without triggering an explicit teardown. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, no-authentication CVSS vector makes this straightforward to trigger against any Go application using this library for SSH.
Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an entire SSH connection by sending crafted RFC 4254 channel messages after a channel is established. All versions of golang.org/x/crypto/ssh below 0.56.0 are affected; the flaw manifests because unrecognized channel messages were buffered and allowed to block rather than being rejected as protocol errors. No public exploit or active exploitation has been identified, but the attack requires no privileges in the worst-case client scenario where a malicious SSH server targets a connecting client.
Stack-based buffer overflow in Tenda F453 firmware 1.0.0.3 allows remote attackers with valid credentials to achieve unauthenticated code execution through a malformed GO parameter in the WrlclientSet function. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations using vulnerable F453 devices should implement network segmentation and access controls to mitigate exploitation risk.
Stack-based buffer overflow in Tenda F453 firmware version 1.0.0.3 allows authenticated remote attackers to achieve complete system compromise through a malformed GO parameter in the WrlExtraSet function. Public exploit code exists for this vulnerability, and no patch is currently available. Affected systems face high risk of unauthorized code execution, data theft, and service disruption.
Unauthenticated attackers can enumerate workspace members and harvest sensitive information including email addresses, user roles, and internal identifiers from Plane prior to version 1.2.2 due to misconfigured Django REST Framework permissions. The vulnerability requires no authentication or user interaction and allows remote attackers to directly access protected endpoints over the network. No patch is currently available for affected Golang and Django deployments.
X.509 certificate chain validation in Go 1.26.0 improperly enforces email address constraints when multiple constraints share local parts but differ in domain parts, causing all but the last constraint to be ignored. This CWE-295 (Improper Certificate Validation) flaw allows attackers to bypass intended certificate usage restrictions through specially crafted certificate chains, potentially enabling unauthorized access to services relying on Go's TLS implementation for email-based certificate validation. EPSS score of 0.03% (9th percentile) indicates low predicted exploitation likelihood, and no active exploitation or public exploit code has been identified at time of analysis.
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed URLs with invalid host/authority components. The url.Parse function fails to properly validate authority sections, enabling resource exhaustion attacks against any Go application parsing untrusted URLs. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation despite the network attack vector. Vendor patch available with multiple Red Hat security advisories issued.
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authentication is enabled, allowing remote attackers to crash the application by sending concurrent requests to the login endpoint. The vulnerability stems from unsynchronized access to shared state during OAuth2 processing, triggering a Go runtime panic. Public exploit code exists for this high-severity flaw, which is patched in version 3000.10.3 and later.
Remote attackers can inject arbitrary command-line arguments into bird-lg-go's traceroute module through unsanitized user input, enabling denial-of-service attacks that exhaust system resources. The vulnerability affects Golang and bird-lg-go installations prior to commit 6187a4e, and public exploit code exists. A patch is available to remediate this high-severity flaw.
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.php script lacks authentication, allowing unauthorized access. PoC available.
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to validate file paths in ZIP archives, allowing attackers with high privileges to write arbitrary files to the host system. Public exploit code exists for this vulnerability, and malformed archives can trigger a denial of service that permanently wipes the database before crashing the application. The flaw affects Vikunja and the underlying Go platform, with no patch currently available.
Wasmtime versions 39.0.0 and later experience a denial-of-service panic when async WebAssembly component functions are called and then abandoned by the host before completion, such as when the Future is dropped after a single poll during an async yield. This affects applications using Wasmtime's component model with async support, allowing an attacker to crash the runtime through specially crafted async function invocations. A patch is available to address this stability issue.
Authorization bypass in Kargo Kubernetes promotion tool from 1.7.0 before 1.7.8/1.8.11/1.9.3. Batch resource creation bypasses authorization checks. Patch available.
Go Ethereum (Geth) versions prior to 1.16.9 contain a cryptographic implementation flaw in ECIES that allows remote attackers to extract portions of the p2p node key without authentication. This exposure could compromise the confidentiality of node communications and potentially enable impersonation or network-level attacks against affected Ethereum nodes. Administrators should upgrade to version 1.16.9 or later and rotate their node keys by deleting the nodekey file.
Geth versions prior to 1.16.9 can be remotely crashed by sending a specially crafted message over the network, allowing unauthenticated attackers to cause denial of service against Ethereum nodes. This vulnerability in Go Ethereum's message handling requires no user interaction and affects the availability of affected nodes. Patched versions 1.16.9 and 1.17.0 are available to remediate this issue.
Go Ethereum versions up to 1.17.0 is affected by allocation of resources without limits or throttling (CVSS 7.5).
emp3r0r C2 framework versions prior to 3.21.2 crash due to unsynchronized concurrent map access in Go goroutines, allowing attackers with network access to trigger denial of service against the C2 infrastructure. Public exploit code exists for this vulnerability. The issue is resolved in version 3.21.2 and later.
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI processing. PoC and patch available.
METIS WIC devices expose an unauthenticated /dbviewer/ endpoint that permits remote attackers to directly access and export internal SQLite databases containing sensitive operational telemetry. The affected Golang and Django applications run with debug mode enabled, causing error responses to leak backend source code, local file paths, and system configuration details. No patch is currently available.
JinJava template engine has a server-side template injection vulnerability enabling arbitrary code execution through crafted Jinja-style templates.
Apko versions 0.14.8 through 1.1.0 are vulnerable to denial of service when processing APK packages from untrusted repositories due to missing decompression limits in the ExpandApk function. An attacker controlling a compromised APK repository can provide a malicious small, highly-compressed package that expands into a massive tar stream, exhausting disk space and CPU resources on the build host. The vulnerability affects Golang and Apko products and has been patched in version 1.1.1.
Apko versions up to 1.1.1 contains a vulnerability that allows attackers to build and publish OCI container images built from apk packages (CVSS 7.5).
Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any file on the server including secrets and configuration.
Kargo's GetConfig() API endpoint fails to validate Bearer token authenticity, allowing unauthenticated attackers to retrieve sensitive configuration data including Argo CD cluster endpoints and namespaces that could facilitate further attacks. The same authentication bypass affects the RefreshResource endpoint, which can be leveraged for denial-of-service attacks. Versions 1.6.3, 1.7.7, and 1.8.7 and later include patches for this vulnerability.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices due to insufficient input validation. The vulnerability requires valid credentials to exploit but provides complete system compromise with high confidentiality, integrity, and availability impact. No patch is currently available for this issue.
Remote code execution in ALGO 8180 IP Audio Alerter devices via command injection in the web UI allows authenticated attackers to execute arbitrary system commands due to insufficient input validation. An attacker with valid credentials can inject malicious commands through user-supplied parameters to gain code execution on the affected device. No patch is currently available for this vulnerability.
ALGO 8180 has a use-after-free in SIP session handling (EPSS 1.1%) enabling remote code execution through crafted VoIP signaling sequences.
ALGO 8180 has a heap-based buffer overflow in InformaCast message processing enabling remote code execution through the emergency notification protocol.
ALGO 8180 has a stack-based buffer overflow in SIP INVITE Alert-Info header processing, enabling remote code execution through the VoIP protocol.
ALGO 8180 has a stack-based buffer overflow in SIP INVITE Replaces header processing enabling remote code execution through crafted VoIP calls.
8180 Ip Audio Alerter Firmware versions up to 5.5 contains a vulnerability that allows attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio A (CVSS 7.5).
The ALGO 8180 IP Audio Alerter web interface improperly exposes authentication cookies in HTTP response bodies, enabling unauthenticated remote attackers to steal sensitive credentials and gain unauthorized access to affected devices. This information disclosure vulnerability requires no authentication or user interaction to exploit and affects the device's web-based management interface. No patch is currently available for this vulnerability.
ALGO 8180 IP Audio Alerter has a command injection in the SAC interface (EPSS 0.68%) allowing remote code execution on the emergency notification device.
Remote code execution in ALGO 8180 IP Audio Alerter firmware results from insufficient input validation in the SCI module, allowing authenticated attackers to inject arbitrary commands and execute code with device privileges. The vulnerability affects Golang-based implementations and carries a high CVSS score of 8.8, with no patch currently available. Exploitation requires valid credentials but poses significant risk to networked audio alerting infrastructure.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the API interface allows authenticated attackers to execute arbitrary system commands on affected devices due to insufficient input validation. The vulnerability has a high CVSS score of 8.8 and currently lacks a patch. With an EPSS score of 0.8%, exploitation is possible but not yet widely observed in the wild.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on vulnerable devices due to insufficient input validation. An attacker with valid credentials can inject malicious commands through unsanitized user input to compromise the device and execute code with device privileges. No patch is currently available for this vulnerability.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices through insufficient input validation. An attacker with valid credentials can inject malicious commands through unsanitized user input parameters to achieve code execution in the device context. No patch is currently available for this high-severity vulnerability.
Remote code execution in ALGO 8180 IP Audio Alerter devices through command injection in the web management interface allows authenticated attackers to execute arbitrary commands with device privileges. The vulnerability stems from insufficient input validation of user-supplied parameters passed to system calls. A patch is not currently available for this high-severity flaw affecting Golang-based firmware.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices due to insufficient input validation. An attacker with valid credentials can exploit this vulnerability to achieve code execution in the device context. No patch is currently available for this high-severity vulnerability (CVSS 8.8).
Remote code execution in ALGO 8180 IP Audio Alerter firmware through command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices due to insufficient input validation. The vulnerability requires valid credentials to exploit but enables complete device compromise once authenticated. No patch is currently available for this high-severity flaw affecting the Golang-based firmware.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web interface allows authenticated attackers to execute arbitrary code on affected devices through insufficient input validation. The vulnerability requires valid credentials but no user interaction to exploit, presenting significant risk to networked audio alerting systems. No patch is currently available.
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers to write arbitrary files to the server through malicious tar archives, bypassing incomplete path sanitization. Public exploit code exists for this vulnerability. The issue stems from improper validation of absolute paths in tar file entries, enabling potential code execution or service disruption on affected systems.
Go Ethereum (geth) nodes can be remotely crashed through maliciously crafted network messages, causing denial of service to affected network participants. An unauthenticated attacker on the network can exploit this vulnerability without user interaction to force vulnerable nodes offline. A patch is available in version 1.16.8 and later.
Go Ethereum nodes can be remotely crashed by unauthenticated attackers sending specially crafted network messages, resulting in denial of service. This network-based attack requires no user interaction and affects Golang and Go Ethereum implementations prior to version 1.16.8. A patch is available to remediate this high-severity vulnerability.
Gin-vue-admin versions 2.8.7 and earlier contain a path traversal vulnerability in the breakpoint resume upload API that allows authenticated attackers to write arbitrary files to any directory on the system. Public exploit code exists for this vulnerability, which affects administrators and users with file upload privileges. An attacker can bypass directory restrictions by injecting traversal sequences (../) into the fileName parameter to escape the intended fileDir location.
Concurrent requests in axios4go prior to version 0.6.4 trigger unsynchronized mutations to the shared HTTP client configuration, allowing attackers to manipulate transport settings, timeouts, and redirect handlers across simultaneous operations. Applications using async requests or multiple goroutines with different proxy configurations or handling sensitive credentials are vulnerable to request interception, credential leakage, or denial of service. Upgrade to version 0.6.4 or later to resolve this race condition.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SSRF protection bypass in the Lancet Go library's netutil.IsInternalIP allows applications that use this helper as their allow/deny filter to fetch internal services and cloud metadata endpoints via IPv6 and transition address forms the function misclassifies as external. Affected releases are Lancet 1.3.1 through 1.4.6 and 2.1.2 through 2.3.9; the function must be consumed by a server-side fetch path that accepts attacker-controlled hostnames, which is why the issue is assessed as moderate priority rather than emergency (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, CVSS 4.0 base 6.3). Publicly available exploit code exists (SSVC Exploitation: poc) and an unauthenticated, remote attacker providing hostnames that resolve to fd00::/8, fe80::/10, 100.64.0.0/10, or NAT64/6to4/Teredo encodings of internal IPv4 can reach otherwise unreachable targets; exploitation is not reliably automatable at scale (SSVC Automatable: no) and no confirmed active exploitation (CISA KEV) has been reported.
Cookie-parser confusion in OWASP Coraza WAF prior to 3.8.1 allows unauthenticated remote attackers to hide cookie-carried attack payloads from SecRules that inspect REQUEST_COOKIES or REQUEST_COOKIES_NAMES, because Coraza splits a Cookie header into name/value pairs differently than the protected backend application does. The bypass applies only when a Web Application Firewall ruleset is scoped to specific cookie names or values and the backend is a parser confirmed to trim boundary control characters - PHP's $_COOKIE and Python's http.cookies - while Node's cookie package and current Werkzeug 3.1.9 split the header the same way Coraza does, so exploitation does not apply there; the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, score 4.0) reflects that attacker-supplied data repositions the name/value boundary across a security-authority change, producing limited integrity impact with high attack complexity and no availability or confidentiality effect. There is no public exploit identified at time of analysis, and the issue is fixed in version 3.8.1; this is a modest-severity WAF-bypass condition rather than an emergency, but operators running cookie-scoped rules against PHP or Python backends should treat it as a real detection gap.
Resource exhaustion in OWASP Coraza WAF 3.0.0 through 3.7.x lets an unauthenticated remote attacker (CVSS vector PR:N/UI:N) drain the host process's file-descriptor table by submitting a multipart/form-data body built from tens of thousands of minimal file parts, each of which holds an open temporary-file descriptor until the entire request returns. Because the default 128MB body limit caps bytes rather than part count, roughly 6.8MB of ~104-byte parts is enough to reach the Linux default 65536-descriptor ceiling, after which os.CreateTemp calls fail, the MULTIPART_STRICT_ERROR flag is set (causing CRS rule 200001 to return 400s, including for legitimate traffic), and the process can no longer open files or sockets - a process-wide availability impact that our assessment rates High, in contrast to the vendor-issued 5.3 score that rates availability only Low. The leak is transient (descriptors are released when the request ends), so sustained denial requires repeated or concurrent flooding, and it only affects deployments that actually inspect multipart bodies with filesystem-backed temp storage. No entry appears in CISA KEV and no confirmed active exploitation has been observed, but the vendor advisory ships a public proof-of-concept reproducer; the flaw is fixed in 3.8.0.
Improper JavaScript context tracking in Go's html/template package fails to treat the `yield` keyword as a regular-expression preceder, so a regexp literal that follows `yield` inside a template-literal expression is mis-escaped instead of being correctly recognized and neutralized. Only applications that server-render HTML with html/template and whose trusted template source actually contains this specific yield-plus-regexp construct are meaningfully exposed, and a victim must load the rendered page (CVSS PR:N - no authentication required, but UI:R - user interaction required). No public exploit code identified at time of analysis; fixes ship in Go 1.27.2 and Go 1.26.9.
Path traversal in HashiCorp go-getter's S3 and GCS directory-download handling lets files be written outside the requested destination, affecting go-getter before 1.8.10 and go-getter/v2 before 2.2.5. Unauthenticated remote attackers (CVSS PR:N) can only succeed if a victim initiates a download against an attacker-influenced S3 or GCS bucket that contains crafted object keys with traversal sequences, which is why the vector requires user interaction (UI:R) and carries high attack complexity (AC:H); the resulting impact is integrity-only (CVSS 5.3, I:H with no confidentiality or availability effect). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available.
A negative index panic in the Go Excelize library (versions 2.8.0 through 2.11.0) allows unauthenticated remote attackers to cause a denial of service when an application reads cell styling from a crafted .xlsx file. The flaw arises because GetStyle's extraction predicates for fill, border, and font IDs only validate upper bounds, permitting negative fillId, borderId, or fontId values from attacker-controlled styles.xml to reach slice indexing and trigger a panic. No fixed version is available, though an upstream patch (PR #2367) exists; no public exploit has been identified, and exploitation requires the application to parse an untrusted file and call File.GetStyle (UI:R).
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-streaming worksheet API, resulting in an unrecovered panic that terminates the process. The bug occurs when a row lists a higher-column cell (e.g. D1) before a lower-column final cell (e.g. B1): checkRow sizes its backing cell slice from the last cell in document order, so the earlier cell's column index falls outside the slice and triggers an out-of-bounds access. Exploitation requires the victim or application to load the malicious workbook (UI:R), impact is limited to availability with no data disclosure or code execution, and no public exploit was identified at time of analysis; an upstream fix is available as a PR/commit but a released patched version is not independently confirmed.
Formula evaluation in the Excelize Go library (versions 2.10.1 through 2.11.0) can be crashed by a spreadsheet whose cells contain a RIGHT() formula applied to supplementary-plane (non-BMP) text, because the function validates the requested length in UTF-16 code units but then slices a rune array using code-point counts, producing a negative slice index and a Go panic. This is a denial-of-service (availability-only) issue: per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, there is no confidentiality or integrity impact, and remote unauthenticated attackers can trigger it only if the host application calls Excelize's CalcCellValue on attacker-controlled workbook content. No public exploit code was identified at time of analysis, and although an upstream fix commit and pull request exist, no released patched version has been confirmed.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
Denial of service in Sliver C2 framework 1.7.7 and earlier allows an attacker who controls a compromised implant session to crash the entire teamserver by returning a malformed or zero-length Download response, disrupting all connected operators. Publicly available exploit code exists, but the provided data does not indicate confirmed active exploitation (CISA KEV). The CVSS 4.0 score is 6.8 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H, so this is a bounded availability impact requiring an established implant session and an operator-initiated download.
Log-download path traversal (Zip Slip) in Dozzle before 11.1.2 allows attackers who control container display names to embed directory-traversal sequences such as '../../etc/cron.d/evil' into ZIP entry names, so that files are written outside the intended extraction directory when a user downloads and unpacks the log archive. The flaw affects the web log-download endpoint (/api/containers/.../download), which previously sanitized only the 'name' query parameter while writing unsanitized container names into archive entries; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N, 4.6 in the CVE's CVSS 4.0 scoring) reflects that exploitation requires an attacker who can name/label containers plus a legitimate user who downloads and extracts the archive with a traversal-unsafe tool, and the resulting integrity impact lands on the extracting user's machine (SI:H) rather than on the Dozzle server. There is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but a vendor patch is available: Dozzle 11.1.2 ships a sanitizeFileName helper that reduces entry names to alphanumerics, hyphens, underscores and dots and trims leading dots. Because the traversal is written into the archive rather than triggered server-side, this is a client-side/Zip Slip write primitive, not a direct remote code execution path against the Dozzle instance itself.
Malicious Kubernetes hosts can read confidential data written to Contrast secure persistent volumes by supplying a crafted LUKS2 block device that the pod VM wrongly accepts as encrypted. The flaw affects Contrast (Go module github.com/edgelesssys/contrast) through 1.12.0 when the opt-in secure persistent volume feature is enabled and the guest bundles cryptsetup older than 2.8.1: LUKS2 metadata is unauthenticated and a header declaring the cipher_null-ecb null keyslot algorithm is accepted without error, so the Initializer assumes the device is protected when 'cryptsetup open' succeeds and writes secrets to a volume that is plaintext or keyed with an attacker-known volume key. Exploitation requires host-level provisioning privilege (CVSS 4.0 AV:A/AC:L/PR:L/UI:N, confidentiality-only; independent assessment CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the adversary is a malicious or compromised infrastructure operator rather than a conventional remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is closed by Contrast 1.12.1, which ships cryptsetup 2.8.1, and further hardened by 1.13.0.
Missing authorization in the mayfly-go AI Assistant (server/internal/ai/api/ai.go) allows an authenticated user - authenticated, per CVSS PR:L - to execute compound shell commands without a genuine approval gate; the command whitelist is only one token wide, so any chained command containing curl, wget, or sed auto-runs, and approval can be self-granted by the same session user. All versions up to and including 1.11.5 are affected, and publicly available exploit code exists (a gist PoC is referenced); the issue is not listed in CISA KEV, so there is no confirmation of active exploitation. This is a low-priority issue by every available signal: the vendor-assigned CVSS 4.0 base score is 2.1, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and CISA's SSVC decision framework rates exploitation as 'poc', automatable as 'no', and technical impact as 'partial'. The practical effect is a bounded policy bypass enabling unapproved command execution within a legitimate user's existing privileges, not a privilege-escalation or full-compromise primitive.
Quill before v0.7.1 is susceptible to denial of service through unbounded memory allocation when processing maliciously crafted Mach-O binaries. Environments accepting externally-submitted binaries for signing—such as CI/CD pipelines and shared signing services—face resource exhaustion attacks if they process attacker-controlled files. An authenticated local attacker can trigger excessive memory consumption by exploiting unvalidated size fields in code signing structures, causing the application to crash or hang.
HTML meta tags with http-equiv="refresh" attributes fail to properly escape URLs inserted through certain actions, enabling cross-site scripting (XSS) attacks against applications using this functionality. An unauthenticated attacker can exploit this to execute arbitrary JavaScript in users' browsers by crafting malicious URLs. No patch is currently available, though a GODEBUG setting (htmlmetacontenturlescape=0) can be configured as a temporary mitigation.
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. [CVSS 2.5 LOW]
DNS certificate verification can crash in systems handling X.509 certificate chains when processing certificates with empty DNS names paired with excluded name constraints, affecting applications performing direct certificate validation or using TLS. This denial of service condition requires no authentication or user interaction but depends on specific certificate chain configurations. No patch is currently available for this vulnerability.
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public share links, enabling any user with a share link to access and download files from sibling directories beyond the intended shared folder. This authenticated network-based vulnerability affects Golang and Filebrowser and has public exploit code available. The issue is resolved in version 2.61.0 and later.
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. [CVSS 3.7 LOW]
Packetbeat's PostgreSQL protocol parser improperly validates array indices, allowing authenticated attackers on the same network to crash the monitoring service by sending malicious packets. An attacker exploiting this denial-of-service vulnerability can terminate the Packetbeat process, disrupting monitoring capabilities on systems with PostgreSQL protocol monitoring enabled. No patch is currently available.
Stored XSS in the WordPress Custom Logo plugin through version 2.2 allows authenticated administrators to inject malicious scripts into admin settings that execute for other users. This affects multi-site WordPress installations and single-site setups where unfiltered_html is disabled, requiring high-privilege attacker access but enabling persistent script injection across affected pages.
Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. [CVSS 5.3 MEDIUM]
Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. [CVSS 7.5 HIGH]
Kargo versions 1.9.0 through 1.9.2 fail to enforce the custom "promote" authorization verb in three REST API endpoints, allowing authenticated users with standard Kubernetes RBAC permissions to trigger promotions without the intended fine-grained access controls. An attacker with patch permissions on freight status or create permissions on promotions can bypass promotion pipeline restrictions and advance software artifacts unauthorized. A patch is available to restore the missing authorization checks.
Missing Authorization vulnerability in cliengo Cliengo - Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cliengo - Chatbot: from n/a through <= 3.0.4. [CVSS 6.5 MEDIUM]
Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.
Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.
Unauthenticated remote attackers can exhaust server memory in applications built on the Go standard library by submitting crafted multipart/form-data requests, because the mime/multipart parser reads an arbitrarily long line into memory whenever the remaining memory limit at the start of a part drops below 400 bytes. Affected runtimes are Go releases prior to 1.27.2 and prior to 1.26.9, including the mime/multipart and net/textproto packages; any service that parses attacker-supplied multipart forms - for example via net/http Request.ParseMultipartForm or Request.FormFile - is reachable, while internal or non-multipart endpoints are not. This is a denial-of-service (CWE-770) issue with no confirmed active exploitation and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), CISA SSVC rates exploitation as none with partial technical impact, and the vendor has shipped patched releases.
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Go toolchain (cmd/go) releases before 1.26.9 and 1.27.0 through 1.27.1 can be induced to substitute an attacker-controlled module in place of the bundled golang.org/fips140 dependency when a developer builds a project that ships a bogus golang.org/fips140 definition and connects the build to an attacker-operated GOMODPROXY. Successful abuse yields high confidentiality, integrity, and availability impact within the build environment because the toolchain fails to properly validate the module's integrity check value (CWE-354), so untrusted module content is accepted in place of the trusted bundled copy. Exploitation is conditional rather than widespread: it requires both an attacker-crafted project and explicit developer action to use a non-default, attacker-chosen proxy (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis, with EPSS at roughly 0.11% (1st percentile). Vendor patches are available in Go 1.26.9 and 1.27.2.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to pin a CPU core by supplying a crafted agile-encrypted .xlsx workbook whose OLE encryption header declares an excessively large spinCount, which the library feeds unbounded into its password-key derivation loop. Opening such a file with decryption attempted (OpenFile with a password) makes agileDecrypt run attacker-selected iterations before any verifier validation, and the work cannot be cancelled. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the impact per malicious file is bounded to one CPU core rather than a full host outage. An upstream fix exists in PR #2389 / commit 2badfcd, but no tagged patched release is confirmed.
Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.
Arbitrary file write as the grading teacher in Classroom 50 (the `gh teacher` CLI) before 1.11.0 lets an enrolled student escalate from a writable assignment repository to code execution in the teacher's session: because `gh teacher download` writes autograde artifacts (`result.json` and `results.json`) into the just-cloned student working tree without guarding pre-existing entries, a student who commits either name as a symlink, hardlink, FIFO or directory redirects that write to any path the teacher can reach - `~/.ssh/authorized_keys`, `~/.zshrc`, a cron file, or an in-clone `.git/hooks/*` script that git then executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`, or student-chosen submit-tag names for `results.json`), and the compromised `gh` token carries `admin:org`, `repo` and `workflow` across the whole classroom organization. Rated 9.4 under CVSS 4.0 and high priority by our independent review, exploitation is not anonymous and not zero-click: it requires classroom enrollment, a planted malicious entry, and the teacher running the vulnerable command against that untrusted repository (UI:P); no public exploit code was identified at time of analysis, no CISA KEV listing is present, and no EPSS score was supplied. Version 1.11.0 contains the patch.
Memory exhaustion and parser panics in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious PLC device, or an attacker able to inject or spoof frames on the industrial network path, to crash or exhaust the client application, resulting in denial of service. The flaws affect Go module github.com/apache/plc4x/plc4go from 0.11.0 up to but not including 1.0.0 and include unbounded wire-claimed array and buffer allocations, unchecked indexing of ADS and KNXnet/IP responses, zero-length framing that breaks ADS and EIP message boundaries, unlimited recursion in recursive protocol types, and 16-bit length/position arithmetic in generated serializers that wraps and can cause payloads larger than 8 KB to be mis-framed. CVSS vector indicates no authentication is required (PR:N) and no public exploit has been identified at time of analysis; exploitation is limited to environments where a PLC4Go client talks to untrusted or attacker-reachable industrial endpoints, and impact is availability only.
Signed integer overflow in the s2 dictionary API of klauspost/compress before 1.18.7 lets an attacker crash a consuming Go process: a dictionary carrying a uvarint-encoded repeat value larger than MaxInt64 slips past repeat-index validation, and a subsequent call to Dict.Encode() converts the overflowed negative repeat value into an out-of-bounds unsafe.Pointer access that aborts the process with SIGSEGV. The issue is availability-only (C:N/I:N, A:H) on a CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, but real exposure hinges on the application - it only matters where untrusted, attacker-influenced bytes reach s2.NewDict() and the resulting dictionary is then encoded, not in ordinary compression or decompression of arbitrary data. No public exploit code and no CISA KEV entry were identified at time of analysis; the vendor-released patch is v1.18.7.
SiYuan versions before v3.8.4 contain a SQL injection vulnerability (CWE-89) in block query embed blocks that allows remote, unauthenticated attackers to execute arbitrary SQL against the local siyuan.db database, but exploitation requires the victim to import a malicious .sy document (UI:R). Successful exploitation enables high confidentiality impact (e.g., data exfiltration via VACUUM INTO) and low integrity impact (data tampering), with no availability impact, per the independent CVSS 3.1 assessment. No public exploit or CISA KEV entry is currently known, but a vendor patch (v3.8.4) is available.
Workload secrets are written to the initializer's standard output at INFO level in Edgeless Systems Contrast versions 1.9.0 through 1.12.1, so any Kubernetes principal that holds get or list permission on the pods/logs subresource in the affected namespace can read them from the container log stream. Because those workload secrets back Contrast's encrypted storage and HashiCorp Vault integration, the storage keys and Vault credentials derived from them must also be treated as compromised, giving the attacker a path to decrypt protected data and reach Vault-backed secrets. The flaw is a regression of GHSA-h5f8-crrq-4pw8 (originally fixed in 1.8.1 but never ported to the main branch), patchable in 1.12.2; there is no public exploit identified at time of analysis and no KEV listing, so risk is driven by the low barrier of an existing log-read RBAC grant rather than by active exploitation.
Source-IP spoofing in Zoraxy 3.2.3 through 3.3.4 lets unauthenticated attackers who reach the service over IPv6 forge X-Forwarded-For and X-Original-IP values, so IP-based access controls enforced by Zoraxy's SSO forward-auth provider see a trusted client address and grant access (CWE-290). The 9.1 CVSS 4.0 severity reflects fully unauthenticated remote exploitation (PR:N), but our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) rates the real-world risk lower because exploitation requires IPv6 connectivity and a deployment that actually relies on forward-auth IP allowlisting as a security boundary, so IPv4-only or non-IP-gated instances are not exploitable. No public exploit code was identified at time of analysis and there is no KEV entry, though a vendor patch is available.
Remote code execution is achievable on self-hosted deployments of golang.org/x/playground by chaining two independent weaknesses: a crafted txtar archive that escapes the intended execution context and forces arbitrary writes into the playground host's trusted filesystem, plus a malicious go env configuration file that one of the three go vet invocation paths reads from the host's $HOME because that path fails to properly restrict its execution environment. Neither primitive is sufficient on its own - the attacker must combine the filesystem write with the poisoned environment file to reach code execution on the host, and the reachable surface is bounded to one specific vulnerable go vet invocation path out of three. The public go.dev/play service is explicitly NOT affected, so exposure is limited to independent forks and self-hosted deployments running golang.org/x/playground versions before 0.0.0-20260924211604-6d73cff14c17; no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none), and the vendor has released a patch.
Path traversal and arbitrary file write in the oras-go OCI artifact library prior to 2.6.2 allow a malicious artifact layer marked with the io.deis.oras.content.unpack=true annotation to escape the content/file.Store extraction root and create or overwrite any file writable by the pulling process, potentially leading to code execution. Exploitation is unauthenticated from an attacker's network position (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R) because the victim must pull the attacker-controlled artifact reference; the bug bypasses the AllowPathTraversalOnWrite=false default, so no permissive configuration is needed. Scored 8.8 High, with no public exploit identified at time of analysis and no CISA KEV listing; a vendor patch is available in oras-go 2.6.2.
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) allows an authenticated attacker or server misconfiguration to crash the process by triggering a panic in an internal goroutine that escapes the panic-recovery middleware. The flaw requires a network-reachable instance and low-privilege access (e.g., superuser) for the most directly reachable paths such as backup restore or view creation; public exploit code exists. Impact is limited to availability, causing process termination and requiring a restart, with no data exposure or code execution.
Connection deadlock in golang.org/x/crypto/ssh (all versions before 0.56.0) allows a malicious remote SSH peer to permanently freeze an SSH connection by flooding the incomingRequests queue of a channel that has been registered in the mux's chanList but not yet established. The attack exploits the absence of any established-state guard in the packet handler, causing a deadlock that renders the entire connection unresponsive without triggering an explicit teardown. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, no-authentication CVSS vector makes this straightforward to trigger against any Go application using this library for SSH.
Denial-of-service in the Go extended cryptography library's SSH package allows a malicious peer to deadlock an entire SSH connection by sending crafted RFC 4254 channel messages after a channel is established. All versions of golang.org/x/crypto/ssh below 0.56.0 are affected; the flaw manifests because unrecognized channel messages were buffered and allowed to block rather than being rejected as protocol errors. No public exploit or active exploitation has been identified, but the attack requires no privileges in the worst-case client scenario where a malicious SSH server targets a connecting client.
Stack-based buffer overflow in Tenda F453 firmware 1.0.0.3 allows remote attackers with valid credentials to achieve unauthenticated code execution through a malformed GO parameter in the WrlclientSet function. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations using vulnerable F453 devices should implement network segmentation and access controls to mitigate exploitation risk.
Stack-based buffer overflow in Tenda F453 firmware version 1.0.0.3 allows authenticated remote attackers to achieve complete system compromise through a malformed GO parameter in the WrlExtraSet function. Public exploit code exists for this vulnerability, and no patch is currently available. Affected systems face high risk of unauthorized code execution, data theft, and service disruption.
Unauthenticated attackers can enumerate workspace members and harvest sensitive information including email addresses, user roles, and internal identifiers from Plane prior to version 1.2.2 due to misconfigured Django REST Framework permissions. The vulnerability requires no authentication or user interaction and allows remote attackers to directly access protected endpoints over the network. No patch is currently available for affected Golang and Django deployments.
X.509 certificate chain validation in Go 1.26.0 improperly enforces email address constraints when multiple constraints share local parts but differ in domain parts, causing all but the last constraint to be ignored. This CWE-295 (Improper Certificate Validation) flaw allows attackers to bypass intended certificate usage restrictions through specially crafted certificate chains, potentially enabling unauthorized access to services relying on Go's TLS implementation for email-based certificate validation. EPSS score of 0.03% (9th percentile) indicates low predicted exploitation likelihood, and no active exploitation or public exploit code has been identified at time of analysis.
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed URLs with invalid host/authority components. The url.Parse function fails to properly validate authority sections, enabling resource exhaustion attacks against any Go application parsing untrusted URLs. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation despite the network attack vector. Vendor patch available with multiple Red Hat security advisories issued.
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authentication is enabled, allowing remote attackers to crash the application by sending concurrent requests to the login endpoint. The vulnerability stems from unsynchronized access to shared state during OAuth2 processing, triggering a Go runtime panic. Public exploit code exists for this high-severity flaw, which is patched in version 3000.10.3 and later.
Remote attackers can inject arbitrary command-line arguments into bird-lg-go's traceroute module through unsanitized user input, enabling denial-of-service attacks that exhaust system resources. The vulnerability affects Golang and bird-lg-go installations prior to commit 6187a4e, and public exploit code exists. A patch is available to remediate this high-severity flaw.
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.php script lacks authentication, allowing unauthorized access. PoC available.
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to validate file paths in ZIP archives, allowing attackers with high privileges to write arbitrary files to the host system. Public exploit code exists for this vulnerability, and malformed archives can trigger a denial of service that permanently wipes the database before crashing the application. The flaw affects Vikunja and the underlying Go platform, with no patch currently available.
Wasmtime versions 39.0.0 and later experience a denial-of-service panic when async WebAssembly component functions are called and then abandoned by the host before completion, such as when the Future is dropped after a single poll during an async yield. This affects applications using Wasmtime's component model with async support, allowing an attacker to crash the runtime through specially crafted async function invocations. A patch is available to address this stability issue.
Authorization bypass in Kargo Kubernetes promotion tool from 1.7.0 before 1.7.8/1.8.11/1.9.3. Batch resource creation bypasses authorization checks. Patch available.
Go Ethereum (Geth) versions prior to 1.16.9 contain a cryptographic implementation flaw in ECIES that allows remote attackers to extract portions of the p2p node key without authentication. This exposure could compromise the confidentiality of node communications and potentially enable impersonation or network-level attacks against affected Ethereum nodes. Administrators should upgrade to version 1.16.9 or later and rotate their node keys by deleting the nodekey file.
Geth versions prior to 1.16.9 can be remotely crashed by sending a specially crafted message over the network, allowing unauthenticated attackers to cause denial of service against Ethereum nodes. This vulnerability in Go Ethereum's message handling requires no user interaction and affects the availability of affected nodes. Patched versions 1.16.9 and 1.17.0 are available to remediate this issue.
Go Ethereum versions up to 1.17.0 is affected by allocation of resources without limits or throttling (CVSS 7.5).
emp3r0r C2 framework versions prior to 3.21.2 crash due to unsynchronized concurrent map access in Go goroutines, allowing attackers with network access to trigger denial of service against the C2 infrastructure. Public exploit code exists for this vulnerability. The issue is resolved in version 3.21.2 and later.
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI processing. PoC and patch available.
METIS WIC devices expose an unauthenticated /dbviewer/ endpoint that permits remote attackers to directly access and export internal SQLite databases containing sensitive operational telemetry. The affected Golang and Django applications run with debug mode enabled, causing error responses to leak backend source code, local file paths, and system configuration details. No patch is currently available.
JinJava template engine has a server-side template injection vulnerability enabling arbitrary code execution through crafted Jinja-style templates.
Apko versions 0.14.8 through 1.1.0 are vulnerable to denial of service when processing APK packages from untrusted repositories due to missing decompression limits in the ExpandApk function. An attacker controlling a compromised APK repository can provide a malicious small, highly-compressed package that expands into a massive tar stream, exhausting disk space and CPU resources on the build host. The vulnerability affects Golang and Apko products and has been patched in version 1.1.1.
Apko versions up to 1.1.1 contains a vulnerability that allows attackers to build and publish OCI container images built from apk packages (CVSS 7.5).
Erugo file-sharing platform up to version 0.2.14 has a CVSS 10.0 path traversal allowing authenticated users to read any file on the server including secrets and configuration.
Kargo's GetConfig() API endpoint fails to validate Bearer token authenticity, allowing unauthenticated attackers to retrieve sensitive configuration data including Argo CD cluster endpoints and namespaces that could facilitate further attacks. The same authentication bypass affects the RefreshResource endpoint, which can be leveraged for denial-of-service attacks. Versions 1.6.3, 1.7.7, and 1.8.7 and later include patches for this vulnerability.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices due to insufficient input validation. The vulnerability requires valid credentials to exploit but provides complete system compromise with high confidentiality, integrity, and availability impact. No patch is currently available for this issue.
Remote code execution in ALGO 8180 IP Audio Alerter devices via command injection in the web UI allows authenticated attackers to execute arbitrary system commands due to insufficient input validation. An attacker with valid credentials can inject malicious commands through user-supplied parameters to gain code execution on the affected device. No patch is currently available for this vulnerability.
ALGO 8180 has a use-after-free in SIP session handling (EPSS 1.1%) enabling remote code execution through crafted VoIP signaling sequences.
ALGO 8180 has a heap-based buffer overflow in InformaCast message processing enabling remote code execution through the emergency notification protocol.
ALGO 8180 has a stack-based buffer overflow in SIP INVITE Alert-Info header processing, enabling remote code execution through the VoIP protocol.
ALGO 8180 has a stack-based buffer overflow in SIP INVITE Replaces header processing enabling remote code execution through crafted VoIP calls.
8180 Ip Audio Alerter Firmware versions up to 5.5 contains a vulnerability that allows attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio A (CVSS 7.5).
The ALGO 8180 IP Audio Alerter web interface improperly exposes authentication cookies in HTTP response bodies, enabling unauthenticated remote attackers to steal sensitive credentials and gain unauthorized access to affected devices. This information disclosure vulnerability requires no authentication or user interaction to exploit and affects the device's web-based management interface. No patch is currently available for this vulnerability.
ALGO 8180 IP Audio Alerter has a command injection in the SAC interface (EPSS 0.68%) allowing remote code execution on the emergency notification device.
Remote code execution in ALGO 8180 IP Audio Alerter firmware results from insufficient input validation in the SCI module, allowing authenticated attackers to inject arbitrary commands and execute code with device privileges. The vulnerability affects Golang-based implementations and carries a high CVSS score of 8.8, with no patch currently available. Exploitation requires valid credentials but poses significant risk to networked audio alerting infrastructure.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the API interface allows authenticated attackers to execute arbitrary system commands on affected devices due to insufficient input validation. The vulnerability has a high CVSS score of 8.8 and currently lacks a patch. With an EPSS score of 0.8%, exploitation is possible but not yet widely observed in the wild.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on vulnerable devices due to insufficient input validation. An attacker with valid credentials can inject malicious commands through unsanitized user input to compromise the device and execute code with device privileges. No patch is currently available for this vulnerability.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices through insufficient input validation. An attacker with valid credentials can inject malicious commands through unsanitized user input parameters to achieve code execution in the device context. No patch is currently available for this high-severity vulnerability.
Remote code execution in ALGO 8180 IP Audio Alerter devices through command injection in the web management interface allows authenticated attackers to execute arbitrary commands with device privileges. The vulnerability stems from insufficient input validation of user-supplied parameters passed to system calls. A patch is not currently available for this high-severity flaw affecting Golang-based firmware.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices due to insufficient input validation. An attacker with valid credentials can exploit this vulnerability to achieve code execution in the device context. No patch is currently available for this high-severity vulnerability (CVSS 8.8).
Remote code execution in ALGO 8180 IP Audio Alerter firmware through command injection in the web UI allows authenticated attackers to execute arbitrary commands on affected devices due to insufficient input validation. The vulnerability requires valid credentials to exploit but enables complete device compromise once authenticated. No patch is currently available for this high-severity flaw affecting the Golang-based firmware.
Remote code execution in ALGO 8180 IP Audio Alerter firmware via command injection in the web interface allows authenticated attackers to execute arbitrary code on affected devices through insufficient input validation. The vulnerability requires valid credentials but no user interaction to exploit, presenting significant risk to networked audio alerting systems. No patch is currently available.
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers to write arbitrary files to the server through malicious tar archives, bypassing incomplete path sanitization. Public exploit code exists for this vulnerability. The issue stems from improper validation of absolute paths in tar file entries, enabling potential code execution or service disruption on affected systems.
Go Ethereum (geth) nodes can be remotely crashed through maliciously crafted network messages, causing denial of service to affected network participants. An unauthenticated attacker on the network can exploit this vulnerability without user interaction to force vulnerable nodes offline. A patch is available in version 1.16.8 and later.
Go Ethereum nodes can be remotely crashed by unauthenticated attackers sending specially crafted network messages, resulting in denial of service. This network-based attack requires no user interaction and affects Golang and Go Ethereum implementations prior to version 1.16.8. A patch is available to remediate this high-severity vulnerability.
Gin-vue-admin versions 2.8.7 and earlier contain a path traversal vulnerability in the breakpoint resume upload API that allows authenticated attackers to write arbitrary files to any directory on the system. Public exploit code exists for this vulnerability, which affects administrators and users with file upload privileges. An attacker can bypass directory restrictions by injecting traversal sequences (../) into the fileName parameter to escape the intended fileDir location.
Concurrent requests in axios4go prior to version 0.6.4 trigger unsynchronized mutations to the shared HTTP client configuration, allowing attackers to manipulate transport settings, timeouts, and redirect handlers across simultaneous operations. Applications using async requests or multiple goroutines with different proxy configurations or handling sensitive credentials are vulnerable to request interception, credential leakage, or denial of service. Upgrade to version 0.6.4 or later to resolve this race condition.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SSRF protection bypass in the Lancet Go library's netutil.IsInternalIP allows applications that use this helper as their allow/deny filter to fetch internal services and cloud metadata endpoints via IPv6 and transition address forms the function misclassifies as external. Affected releases are Lancet 1.3.1 through 1.4.6 and 2.1.2 through 2.3.9; the function must be consumed by a server-side fetch path that accepts attacker-controlled hostnames, which is why the issue is assessed as moderate priority rather than emergency (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, CVSS 4.0 base 6.3). Publicly available exploit code exists (SSVC Exploitation: poc) and an unauthenticated, remote attacker providing hostnames that resolve to fd00::/8, fe80::/10, 100.64.0.0/10, or NAT64/6to4/Teredo encodings of internal IPv4 can reach otherwise unreachable targets; exploitation is not reliably automatable at scale (SSVC Automatable: no) and no confirmed active exploitation (CISA KEV) has been reported.
Cookie-parser confusion in OWASP Coraza WAF prior to 3.8.1 allows unauthenticated remote attackers to hide cookie-carried attack payloads from SecRules that inspect REQUEST_COOKIES or REQUEST_COOKIES_NAMES, because Coraza splits a Cookie header into name/value pairs differently than the protected backend application does. The bypass applies only when a Web Application Firewall ruleset is scoped to specific cookie names or values and the backend is a parser confirmed to trim boundary control characters - PHP's $_COOKIE and Python's http.cookies - while Node's cookie package and current Werkzeug 3.1.9 split the header the same way Coraza does, so exploitation does not apply there; the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, score 4.0) reflects that attacker-supplied data repositions the name/value boundary across a security-authority change, producing limited integrity impact with high attack complexity and no availability or confidentiality effect. There is no public exploit identified at time of analysis, and the issue is fixed in version 3.8.1; this is a modest-severity WAF-bypass condition rather than an emergency, but operators running cookie-scoped rules against PHP or Python backends should treat it as a real detection gap.
Resource exhaustion in OWASP Coraza WAF 3.0.0 through 3.7.x lets an unauthenticated remote attacker (CVSS vector PR:N/UI:N) drain the host process's file-descriptor table by submitting a multipart/form-data body built from tens of thousands of minimal file parts, each of which holds an open temporary-file descriptor until the entire request returns. Because the default 128MB body limit caps bytes rather than part count, roughly 6.8MB of ~104-byte parts is enough to reach the Linux default 65536-descriptor ceiling, after which os.CreateTemp calls fail, the MULTIPART_STRICT_ERROR flag is set (causing CRS rule 200001 to return 400s, including for legitimate traffic), and the process can no longer open files or sockets - a process-wide availability impact that our assessment rates High, in contrast to the vendor-issued 5.3 score that rates availability only Low. The leak is transient (descriptors are released when the request ends), so sustained denial requires repeated or concurrent flooding, and it only affects deployments that actually inspect multipart bodies with filesystem-backed temp storage. No entry appears in CISA KEV and no confirmed active exploitation has been observed, but the vendor advisory ships a public proof-of-concept reproducer; the flaw is fixed in 3.8.0.
Improper JavaScript context tracking in Go's html/template package fails to treat the `yield` keyword as a regular-expression preceder, so a regexp literal that follows `yield` inside a template-literal expression is mis-escaped instead of being correctly recognized and neutralized. Only applications that server-render HTML with html/template and whose trusted template source actually contains this specific yield-plus-regexp construct are meaningfully exposed, and a victim must load the rendered page (CVSS PR:N - no authentication required, but UI:R - user interaction required). No public exploit code identified at time of analysis; fixes ship in Go 1.27.2 and Go 1.26.9.
Path traversal in HashiCorp go-getter's S3 and GCS directory-download handling lets files be written outside the requested destination, affecting go-getter before 1.8.10 and go-getter/v2 before 2.2.5. Unauthenticated remote attackers (CVSS PR:N) can only succeed if a victim initiates a download against an attacker-influenced S3 or GCS bucket that contains crafted object keys with traversal sequences, which is why the vector requires user interaction (UI:R) and carries high attack complexity (AC:H); the resulting impact is integrity-only (CVSS 5.3, I:H with no confidentiality or availability effect). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available.
A negative index panic in the Go Excelize library (versions 2.8.0 through 2.11.0) allows unauthenticated remote attackers to cause a denial of service when an application reads cell styling from a crafted .xlsx file. The flaw arises because GetStyle's extraction predicates for fill, border, and font IDs only validate upper bounds, permitting negative fillId, borderId, or fontId values from attacker-controlled styles.xml to reach slice indexing and trigger a panic. No fixed version is available, though an upstream patch (PR #2367) exists; no public exploit has been identified, and exploitation requires the application to parse an untrusted file and call File.GetStyle (UI:R).
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-streaming worksheet API, resulting in an unrecovered panic that terminates the process. The bug occurs when a row lists a higher-column cell (e.g. D1) before a lower-column final cell (e.g. B1): checkRow sizes its backing cell slice from the last cell in document order, so the earlier cell's column index falls outside the slice and triggers an out-of-bounds access. Exploitation requires the victim or application to load the malicious workbook (UI:R), impact is limited to availability with no data disclosure or code execution, and no public exploit was identified at time of analysis; an upstream fix is available as a PR/commit but a released patched version is not independently confirmed.
Formula evaluation in the Excelize Go library (versions 2.10.1 through 2.11.0) can be crashed by a spreadsheet whose cells contain a RIGHT() formula applied to supplementary-plane (non-BMP) text, because the function validates the requested length in UTF-16 code units but then slices a rune array using code-point counts, producing a negative slice index and a Go panic. This is a denial-of-service (availability-only) issue: per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, there is no confidentiality or integrity impact, and remote unauthenticated attackers can trigger it only if the host application calls Excelize's CalcCellValue on attacker-controlled workbook content. No public exploit code was identified at time of analysis, and although an upstream fix commit and pull request exist, no released patched version has been confirmed.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
Denial of service in Sliver C2 framework 1.7.7 and earlier allows an attacker who controls a compromised implant session to crash the entire teamserver by returning a malformed or zero-length Download response, disrupting all connected operators. Publicly available exploit code exists, but the provided data does not indicate confirmed active exploitation (CISA KEV). The CVSS 4.0 score is 6.8 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H, so this is a bounded availability impact requiring an established implant session and an operator-initiated download.
Log-download path traversal (Zip Slip) in Dozzle before 11.1.2 allows attackers who control container display names to embed directory-traversal sequences such as '../../etc/cron.d/evil' into ZIP entry names, so that files are written outside the intended extraction directory when a user downloads and unpacks the log archive. The flaw affects the web log-download endpoint (/api/containers/.../download), which previously sanitized only the 'name' query parameter while writing unsanitized container names into archive entries; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N, 4.6 in the CVE's CVSS 4.0 scoring) reflects that exploitation requires an attacker who can name/label containers plus a legitimate user who downloads and extracts the archive with a traversal-unsafe tool, and the resulting integrity impact lands on the extracting user's machine (SI:H) rather than on the Dozzle server. There is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but a vendor patch is available: Dozzle 11.1.2 ships a sanitizeFileName helper that reduces entry names to alphanumerics, hyphens, underscores and dots and trims leading dots. Because the traversal is written into the archive rather than triggered server-side, this is a client-side/Zip Slip write primitive, not a direct remote code execution path against the Dozzle instance itself.
Malicious Kubernetes hosts can read confidential data written to Contrast secure persistent volumes by supplying a crafted LUKS2 block device that the pod VM wrongly accepts as encrypted. The flaw affects Contrast (Go module github.com/edgelesssys/contrast) through 1.12.0 when the opt-in secure persistent volume feature is enabled and the guest bundles cryptsetup older than 2.8.1: LUKS2 metadata is unauthenticated and a header declaring the cipher_null-ecb null keyslot algorithm is accepted without error, so the Initializer assumes the device is protected when 'cryptsetup open' succeeds and writes secrets to a volume that is plaintext or keyed with an attacker-known volume key. Exploitation requires host-level provisioning privilege (CVSS 4.0 AV:A/AC:L/PR:L/UI:N, confidentiality-only; independent assessment CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the adversary is a malicious or compromised infrastructure operator rather than a conventional remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is closed by Contrast 1.12.1, which ships cryptsetup 2.8.1, and further hardened by 1.13.0.
Missing authorization in the mayfly-go AI Assistant (server/internal/ai/api/ai.go) allows an authenticated user - authenticated, per CVSS PR:L - to execute compound shell commands without a genuine approval gate; the command whitelist is only one token wide, so any chained command containing curl, wget, or sed auto-runs, and approval can be self-granted by the same session user. All versions up to and including 1.11.5 are affected, and publicly available exploit code exists (a gist PoC is referenced); the issue is not listed in CISA KEV, so there is no confirmation of active exploitation. This is a low-priority issue by every available signal: the vendor-assigned CVSS 4.0 base score is 2.1, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and CISA's SSVC decision framework rates exploitation as 'poc', automatable as 'no', and technical impact as 'partial'. The practical effect is a bounded policy bypass enabling unapproved command execution within a legitimate user's existing privileges, not a privilege-escalation or full-compromise primitive.
Quill before v0.7.1 is susceptible to denial of service through unbounded memory allocation when processing maliciously crafted Mach-O binaries. Environments accepting externally-submitted binaries for signing—such as CI/CD pipelines and shared signing services—face resource exhaustion attacks if they process attacker-controlled files. An authenticated local attacker can trigger excessive memory consumption by exploiting unvalidated size fields in code signing structures, causing the application to crash or hang.
HTML meta tags with http-equiv="refresh" attributes fail to properly escape URLs inserted through certain actions, enabling cross-site scripting (XSS) attacks against applications using this functionality. An unauthenticated attacker can exploit this to execute arbitrary JavaScript in users' browsers by crafting malicious URLs. No patch is currently available, though a GODEBUG setting (htmlmetacontenturlescape=0) can be configured as a temporary mitigation.
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. [CVSS 2.5 LOW]
DNS certificate verification can crash in systems handling X.509 certificate chains when processing certificates with empty DNS names paired with excluded name constraints, affecting applications performing direct certificate validation or using TLS. This denial of service condition requires no authentication or user interaction but depends on specific certificate chain configurations. No patch is currently available for this vulnerability.
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public share links, enabling any user with a share link to access and download files from sibling directories beyond the intended shared folder. This authenticated network-based vulnerability affects Golang and Filebrowser and has public exploit code available. The issue is resolved in version 2.61.0 and later.
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. [CVSS 3.7 LOW]
Packetbeat's PostgreSQL protocol parser improperly validates array indices, allowing authenticated attackers on the same network to crash the monitoring service by sending malicious packets. An attacker exploiting this denial-of-service vulnerability can terminate the Packetbeat process, disrupting monitoring capabilities on systems with PostgreSQL protocol monitoring enabled. No patch is currently available.
Stored XSS in the WordPress Custom Logo plugin through version 2.2 allows authenticated administrators to inject malicious scripts into admin settings that execute for other users. This affects multi-site WordPress installations and single-site setups where unfiltered_html is disabled, requiring high-privilege attacker access but enabling persistent script injection across affected pages.
Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. [CVSS 5.3 MEDIUM]
Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. [CVSS 7.5 HIGH]
Kargo versions 1.9.0 through 1.9.2 fail to enforce the custom "promote" authorization verb in three REST API endpoints, allowing authenticated users with standard Kubernetes RBAC permissions to trigger promotions without the intended fine-grained access controls. An attacker with patch permissions on freight status or create permissions on promotions can bypass promotion pipeline restrictions and advance software artifacts unauthorized. A patch is available to restore the missing authorization checks.
Missing Authorization vulnerability in cliengo Cliengo - Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cliengo - Chatbot: from n/a through <= 3.0.4. [CVSS 6.5 MEDIUM]