Skip to content
OpenAdvisories

Package · Go

github.com/l3montree-dev/devguard

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.1
    CVE-2026-48089

    DevGuard has improper authorization on public assets

    DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the …

    l3montree-dev devguard github.com/l3montree-dev/devguard Go
  • Critical 9.3
    CVE-2026-42300

    DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header

    DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session c…

    l3montree-dev devguard github.com/l3montree-dev/devguard Go