Skip to content
OpenAdvisories

Ecosystem

Go

5,239 known vulnerabilities.

Most affected packages

github.com/mattermost/mattermost-server 296 github.com/mattermost/mattermost-server/v6 222 github.com/mattermost/mattermost/server/v8 207 github.com/mattermost/mattermost-server/v5 199 stdlib 182 code.gitea.io/gitea 123 github.com/siyuan-note/siyuan/kernel 113 gogs.io/gogs 76 github.com/usememos/memos 75 github.com/traefik/traefik 69 github.com/traefik/traefik/v2 68 code.vikunja.io/api 67 github.com/grafana/grafana 66 github.com/traefik/traefik/v3 61 github.com/rancher/rancher 60 github.com/hashicorp/vault 55 github.com/zitadel/zitadel 52 github.com/argoproj/argo-cd 50 k8s.io/kubernetes 50 github.com/argoproj/argo-cd/v2 48 toolchain 45 github.com/filebrowser/filebrowser/v2 45 gitea.dev 44 github.com/filebrowser/filebrowser 43 github.com/0xJacky/Nginx-UI 41 github.com/cilium/cilium 39 golang.org/x/net 38 github.com/docker/docker 36 github.com/answerdev/answer 34 github.com/hashicorp/nomad 34 github.com/openbao/openbao 33 github.com/fleetdm/fleet/v4 32 golang.org/x/crypto 32 github.com/lxc/incus/v6 32 github.com/hashicorp/consul 32 github.com/lxc/incus 32 github.com/rclone/rclone 29 github.com/nats-io/nats-server/v2 28 github.com/coder/coder 28 github.com/coder/coder/v2 28
All Critical High Medium Low Exploited only Public exploit

577 results · Clear filters · Feed

  • Critical 9.8
    CVE-2019-14544

    Insecure Permissions in Gogs

    routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

    gogs.io/gogs Go
  • Critical 9.8
    CVE-2019-11202

    Rancher Recreates Default User With Known Password Despite Deletion

    An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial …

    github.com/rancher/rancher Go
  • Critical 9.8
    CVE-2019-14271 Public exploit EPSS 19%

    Moby Docker cp broken with debian containers

    In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

    docker.io docker github.com/docker/docker github.com/moby/moby Debian Alpine Go
  • Critical 9.8
    CVE-2019-1010275

    Helm Improper Certificate Validation

    helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/…

    helm helm helm.sh/helm helm Ubuntu Go
  • Critical 9.8
    CVE-2019-9039

    SQL Injection in Couchbase Sync Gateway

    In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "_all…

    github.com/couchbase/sync_gateway Go
  • Critical 9.8
    CVE-2018-15747

    glot-code-runner RCE

    The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

    github.com/prasmussen/glot-code-runner Go
  • Critical 9.3
    CVE-2019-12243

    Istio may not check inbound TCP connections against istio-policy

    Istio 1.1.x through 1.1.6 has Incorrect Access Control.

    istio.io/istio Go
  • Critical 9.8
    CVE-2019-11576

    Gitea Allows 1FA Even for 2FA-Enrolled Accounts

    Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.

    code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  • Critical 9.8
    CVE-2018-1002105 Public exploit EPSS 87%

    Privilege Escalation in Kubernetes

    In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backe…

    Kubernetes Kubernetes kubernetes github.com/kubernetes/kubernetes Debian Go
  • Critical 9.8
    CVE-2018-18926

    Gitea Remote Code Execution (RCE)

    Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

    code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  • Critical 9.8
    CVE-2018-15727 Public exploit EPSS 63%

    Grafana Authentication Bypass

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

    grafana github.com/grafana/grafana Ubuntu Go
  • Critical 9.8
    CVE-2018-9057

    HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG

    aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account …

    github.com/hashicorp/terraform-provider-aws Go
  • Critical 9.8
    CVE-2017-1000056

    Kubernetes Privilege Escalation

    Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

    k8s.io/kubernetes kubernetes Debian Go
  • Critical 9.8
    CVE-2017-9232 Public exploit EPSS 49%

    Juju uses a UNIX domain socket without setting appropriate permissions

    Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

    github.com/juju/juju juju-core juju-core-1 Ubuntu Go
  • Critical 9.1
    CVE-2016-9121

    Elliptic Curve Key Disclosure in go-jose

    go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static pri…

    golang-gopkg-square-go-jose.v1 github.com/square/go-jose gopkg.in/square/go-jose.v1 Debian Go
  • Critical 9.8
    CVE-2016-1906

    Authorization bypass in Openshift

    Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.

    kubernetes-1.35 kubernetes-1.34 kubernetes-1.36 kubernetes-1.37 Wolfi Go
  • Critical 9.8
    CVE-2014-9357

    Arbitrary Code Execution

    Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

    docker.io github.com/docker/docker Debian Go