Security Digest · page 3 of 4
Critical Go advisories (page 3)
391 critical advisories for Go packages since October 2023, newest first. Check your project with govulncheck ./....
- Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR GHSA-2pv8-4c52-mf8j CVSS 9.1 Critical
code.vikunja.io/api<= 2.2.0 → fixed in 2.2.1 - SiYuan has directory traversal within its publishing service CVE-2026-33670 CVSS 9.8 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260317012524-fe4523fff2c8 → no fix listed - SiYuan has Arbitrary Document Reading within the Publishing Service CVE-2026-33669 CVSS 9.8 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260317012524-fe4523fff2c8 → no fix listed;github.com/siyuan-note/siyuan/kernel> 0 → no fix listed - Trivy ecosystem supply chain was briefly compromised CVE-2026-33634 CVSS 9.4 Critical
github.com/aquasecurity/trivy= 0.69.4 → no fix listed;aquasecurity/trivy-action< 0.35.0 → fixed in 0.35.0;aquasecurity/setup-trivy< 0.2.6 → fixed in 0.2.6 - Harbor allows the use of the default password for web UI login CVE-2026-4404 CVSS 9.4 Critical
github.com/goharbor/harbor<= 2.15.0 → no fix listed - Ory Oathkeeper has a path traversal authorization bypass CVE-2026-33494 CVSS 10.0 Critical
github.com/ory/oathkeeper< 0.40.10-0.20260320084758-8e0002140491 → fixed in 0.40.10-0.20260320084758-8e0002140491 - MinIO LDAP login brute-force via user enumeration and missing rate limit CVE-2026-33419 CVSS 9.1 Critical
github.com/minio/minio<= 0.0.0-20260212201848-7aac2a2c5b7c → no fix listed - step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) CVE-2026-30836 CVSS 10.0 Critical
github.com/smallstep/certificates< 0.30.0 → fixed in 0.30.0 - qui CORS Misconfiguration: Arbitrary Origins Trusted CVE-2026-30924 CVSS 9.0 Critical
github.com/autobrr/qui< 1.15.0 → fixed in 1.15.0 - MinIO has JWT Algorithm Confusion in OIDC Authentication CVE-2026-33322 CVSS 9.2 Critical
github.com/minio/minio<= 0.0.0-20260212201848-7aac2a2c5b7c → no fix listed - gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186 CVSS 9.1 Critical
google.golang.org/grpc< 1.79.3 → fixed in 1.79.3 - Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod CVE-2026-33211 CVSS 9.6 Critical
github.com/tektoncd/pipeline>= 1.0.0, < 1.0.1 → fixed in 1.0.1;github.com/tektoncd/pipeline>= 1.1.0, < 1.3.3 → fixed in 1.3.3;github.com/tektoncd/pipeline>= 1.4.0, < 1.6.1 → fixed in 1.6.1; +2 more packages - SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service CVE-2026-32938 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260313024916-fd6526133bb3 → no fix listed - SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) CVE-2026-32940 CVSS 9.3 Critical
github.com/siyuan-note/siyuan<= 0.0.0-20260313024916-fd6526133bb3 → no fix listed - SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API CVE-2026-32767 CVSS 9.8 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260313024916-fd6526133bb3 → no fix listed - File Browser Signup Grants Admin When Default Permissions Include Admin CVE-2026-32760 CVSS 10.0 Critical
github.com/filebrowser/filebrowser/v2<= 2.61.2 → fixed in 2.62.0 - Dagu: Path Traversal via `dagRunId` in Inline DAG Execution CVE-2026-31886 CVSS 9.1 Critical
github.com/dagu-org/dagu<= 2.2.4 → no fix listed - Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVE-2026-32301 CVSS 9.3 Critical
github.com/centrifugal/centrifugo/v6<= 6.6.2 → fixed in 6.7.0;github.com/centrifugal/centrifugo<= 2.4.0 → no fix listed;github.com/centrifugal/centrifugo/v3<= 3.2.3 → no fix listed; +2 more packages - SM9 Infinity-Point Ciphertext Forgery Vulnerability CVE-2026-32614 CVSS 9.2 Critical
github.com/emmansun/gmsm< 0.41.1 → fixed in 0.41.1 - AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass CVE-2026-32136 CVSS 9.8 Critical
github.com/AdguardTeam/AdGuardHome< 0.107.73 → fixed in 0.107.73 - Cosmos EVM: incorrect state handling during nested EVM execution paths GHSA-54gx-3cgr-7mfm CVSS 9.3 Critical
github.com/cosmos/evm< 0.6.0 → fixed in 0.6.0 - Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go GHSA-j443-wcqq-xprh CVSS 10.0 Critical
github.com/arslanbekov/terraform-provider-sendgrid<= 1.1.3-0.20250606002314-b4a2dfeb7b0f → no fix listed - Linkdave Missing Authentication on REST and WebSocket endpoints GHSA-xv8g-fj9h-6gmv CVSS 9.3 Critical
github.com/shi-gg/linkdave< 0.1.5 → fixed in 0.1.5 - WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation CVE-2026-30861 CVSS 10.0 Critical
github.com/Tencent/WeKnora>= 0.2.5, < 0.2.10 → fixed in 0.2.10 - WeKnora Vulnerable to Broken Access Control in Tenant Management CVE-2026-30855 CVSS 9.8 Critical
github.com/Tencent/WeKnora<= 0.3.1 → fixed in 0.3.2 - WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool CVE-2026-30860 CVSS 10.0 Critical
github.com/Tencent/WeKnora<= 0.2.11 → fixed in 0.2.12 - soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import CVE-2026-30832 CVSS 9.1 Critical
github.com/charmbracelet/soft-serve>= 0.6.0, < 0.11.4 → fixed in 0.11.4 - SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage CVE-2026-30869 CVSS 9.3 Critical
github.com/siyuan-note/siyuan/kernel<= 3.5.9 → fixed in 3.5.10 - Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure CVE-2026-27944 CVSS 9.8 Critical
github.com/0xJacky/Nginx-UI< 2.3.3 → fixed in 2.3.3 - Gogs: Cross-repository LFS object overwrite via missing content hash verification CVE-2026-25921 CVSS 9.3 Critical
gogs.io/gogs<= 0.14.1 → fixed in 0.14.2 - ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint CVE-2026-29191 CVSS 9.3 Critical
github.com/zitadel/zitadel>= 4.0.0, < 4.12.0 → fixed in 4.12.0;github.com/zitadel/zitadel/v2>= 4.0.0, < 4.12.0 → fixed in 4.12.0 - File Browser's TUS Delete Endpoint Bypasses Delete Permission Check CVE-2026-29188 CVSS 9.1 Critical
github.com/filebrowser/filebrowser/v2<= 2.61.0 → fixed in 2.61.1 - SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint CVE-2026-29183 CVSS 9.3 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260304034809-d68bd5a79391 → fixed in 0.0.0-20260304034809-d68bd5a79391 - Rancher cloud credentials can be used through proxy API by users without access CVE-2021-25320 CVSS 9.9 Critical
github.com/rancher/rancher>= 2.2.0, < 2.4.16 → fixed in 2.4.16;github.com/rancher/rancher>= 2.5.0, < 2.5.9 → fixed in 2.5.9 - Rancher doesn't properly sanitize credentials in cluster template answers CVE-2021-36783 CVSS 9.9 Critical
github.com/rancher/rancher>= 2.5.0, <= 2.5.12 → fixed in 2.5.13;github.com/rancher/rancher>= 2.6.0, <= 2.6.3 → fixed in 2.6.4 - Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) CVE-2022-31247 CVSS 9.1 Critical
github.com/rancher/rancher>= 2.5.0, <= 2.5.15 → fixed in 2.5.16;github.com/rancher/rancher>= 2.6.0, <= 2.6.6 → fixed in 2.6.7 - Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse CVE-2026-28268 CVSS 9.8 Critical
code.vikunja.io/api<= 0.24.6 → no fix listed - Vitess users with backup storage access can write to arbitrary file paths on restore CVE-2026-27969 CVSS 9.3 Critical
vitess.io/vitess>= 0.23.0-rc1, < 0.23.3 → fixed in 0.23.3;vitess.io/vitess< 0.22.4 → fixed in 0.22.4 - OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks CVE-2026-27626 CVSS 9.9 Critical
github.com/OliveTin/OliveTin< 0.0.0-20260222101908-4bbd2eab1532 → fixed in 0.0.0-20260222101908-4bbd2eab1532 - Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVE-2026-27575 CVSS 9.1 Critical
code.vikunja.io/api<= 0.24.6 → no fix listed - Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVE-2026-27112 CVSS 9.4 Critical
github.com/akuity/kargo>= 1.9.0-rc.1, < 1.9.3 → fixed in 1.9.3;github.com/akuity/kargo>= 1.8.0-rc.1, < 1.8.11 → fixed in 1.8.11;github.com/akuity/kargo>= 1.7.0, < 1.7.8 → fixed in 1.7.8 - Dagu affected by unauthenticated RCE via inline DAG spec in default configuration GHSA-6qr9-g2xw-cw92 CVSS 9.8 Critical
github.com/dagu-org/dagu<= 1.30.3 → no fix listed - Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise CVE-2026-26190 CVSS 9.8 Critical
github.com/milvus-io/milvus< 2.5.27 → fixed in 2.5.27;github.com/milvus-io/milvus>= 2.6.0, < 2.6.10 → fixed in 2.6.10 - Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure CVE-2025-66630 CVSS 9.2 Critical
github.com/gofiber/fiber/v2< 2.52.11 → fixed in 2.52.11 - Gogs's update .git/config file allows remote command execution CVE-2025-64111 CVSS 9.3 Critical
gogs.io/gogs<= 0.13.3 → fixed in 0.13.4 - FrankenPHP has delayed propagation of security fixes in upstream base images GHSA-x9p2-77v6-6vhf CVSS 9.8 Critical
github.com/dunglas/frankenphp< 1.1.11 → fixed in 1.1.11 - Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern CVE-2025-62878 CVSS 9.9 Critical
github.com/rancher/local-path-provisioner< 0.0.34 → fixed in 0.0.34 - Alist has Insecure TLS Config CVE-2026-25160 CVSS 9.1 Critical
github.com/alist-org/alist/v3< 3.57.0 → fixed in 3.57.0 - Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>`… CVE-2026-25579 CVSS 9.2 Critical
github.com/navidrome/navidrome< 0.60.0 → fixed in 0.60.0 - SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE CVE-2026-25539 CVSS 9.1 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260126094835-d5d10dd41b0c → no fix listed - Kyverno Cross-Namespace Privilege Escalation via Policy apiCall CVE-2026-22039 CVSS 9.9 Critical
github.com/kyverno/kyverno< 1.15.3 → fixed in 1.15.3;github.com/kyverno/kyverno>= 1.16.0-rc.1, < 1.16.3 → fixed in 1.16.3 - Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value CVE-2025-66719 CVSS 9.1 Critical
github.com/free5gc/nrf< 1.4.1 → fixed in 1.4.1 - External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVE-2026-22822 CVSS 9.3 Critical
github.com/external-secrets/external-secrets>= 0.20.2, < 1.2.0 → fixed in 1.2.0 - Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment CVE-2026-23518 CVSS 9.3 Critical
github.com/fleetdm/fleet>= 4.78.0, < 4.78.3 → fixed in 4.78.3;github.com/fleetdm/fleet>= 4.77.0, < 4.77.1 → fixed in 4.77.1;github.com/fleetdm/fleet>= 4.76.0, < 4.76.2 → fixed in 4.76.2; +2 more packages - Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE CVE-2026-23520 CVSS 9.0 Critical
github.com/getarcaneapp/arcane/backend< 0.0.0-20260114065515-5a9c2f92e11f → fixed in 0.0.0-20260114065515-5a9c2f92e11f - WeKnora has Command Injection in MCP stdio test CVE-2026-22688 CVSS 9.9 Critical
github.com/Tencent/WeKnora< 0.2.5 → fixed in 0.2.5 - OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware CVE-2026-0650 CVSS 9.3 Critical
github.com/openflagr/flagr< 0.0.0-20251009103504-fe83dc87aa40 → fixed in 0.0.0-20251009103504-fe83dc87aa40 - Bypassing Kyverno Policies via Double Policy Exceptions GHSA-gg4x-fgg2-h9w9 CVSS 9.0 Critical
github.com/kyverno/kyverno>= 1.9.0, <= 1.12.7 → fixed in 1.13.0 - Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer CVE-2025-62877 CVSS 9.8 Critical
github.com/harvester/harvester-installer>= 1.6.0, <= 1.6.1 → no fix listed;github.com/harvester/harvester-installer>= 1.5.0, <= 1.5.2 → no fix listed - Ollama Platform has missing authentication enabling attackers to perform model management operations CVE-2025-63389 CVSS 9.3 Critical
github.com/ollama/ollama<= 0.13.5 → no fix listed - OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources CVE-2025-13888 CVSS 9.1 Critical
github.com/redhat-developer/gitops-operator< 1.16.2 → fixed in 1.16.2 - Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values CVE-2025-66565 CVSS 9.2 Critical
github.com/gofiber/utils/v2< 2.0.0-rc.3.0.20251205210924-6c6cf047032b → fixed in 2.0.0-rc.4;github.com/gofiber/utils<= 1.1.0 → fixed in 1.2.0 - ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVE-2025-67494 CVSS 9.3 Critical
github.com/zitadel/zitadel< 1.80.0-v2.20.0.20251208091519-4c879b47334e → fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e;github.com/zitadel/zitadel>= 1.83.4, <= 1.87.5 → no fix listed;github.com/zitadel/zitadel>= 4.0.0-rc.1, < 4.7.1 → fixed in 4.7.1; +1 more packages - Step CA Has Authorization Bypass in ACME and SCEP Provisioners CVE-2025-44005 CVSS 10.0 Critical
github.com/smallstep/certificates<= 0.28.4 → fixed in 0.29.0 - Mattermost fails to to verify the token used during code exchange CVE-2025-12421 CVSS 9.9 Critical
github.com/mattermost/mattermost/server/v8< 8.0.0-20251022210333-acda1fb5dd46 → fixed in 8.0.0-20251022210333-acda1fb5dd46;github.com/mattermost/mattermost-server>= 11.0.0, < 11.0.3 → fixed in 11.0.3;github.com/mattermost/mattermost-server>= 10.12.0, < 10.12.2 → fixed in 10.12.2; +2 more packages - Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication CVE-2025-12419 CVSS 9.9 Critical
github.com/mattermost/mattermost/server/v8< 8.0.0-20251028000919-d3ed703dc833 → fixed in 8.0.0-20251028000919-d3ed703dc833;github.com/mattermost/mattermost-server>= 10.12.0, < 10.12.2 → fixed in 10.12.2;github.com/mattermost/mattermost-server>= 10.11.0, < 10.11.5 → fixed in 10.11.5; +2 more packages - LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction GHSA-rj4j-2jph-gg43 CVSS 9.3 Critical
github.com/lf-edge/ekuiper/v2< 2.3.0 → fixed in 2.3.0 - Grafana Incorrect Privilege Assignment vulnerability CVE-2025-41115 CVSS 10.0 Critical
github.com/grafana/grafana>= 12.0.0, < 12.0.7 → fixed in 12.0.7;github.com/grafana/grafana>= 12.1.0, < 12.1.4 → fixed in 12.1.4;github.com/grafana/grafana>= 12.2.0, < 12.2.2 → fixed in 12.2.2; +1 more packages - Milvus Proxy has a Critical Authentication Bypass Vulnerability CVE-2025-64513 CVSS 9.3 Critical
github.com/milvus-io/milvus>= 0.10.4, < 2.4.24 → fixed in 2.4.24;github.com/milvus-io/milvus>= 2.5.0, < 2.5.21 → fixed in 2.5.21;github.com/milvus-io/milvus>= 2.6.0, < 2.6.5 → fixed in 2.6.5; +1 more packages - File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency GHSA-6jqf-mv7m-3q7p CVSS 9.1 Critical
github.com/filebrowser/filebrowser/v2<= 2.45.1 → fixed in 2.45.2 - Soft Serve is vulnerable to SSRF through its Webhooks CVE-2025-64522 CVSS 9.1 Critical
github.com/charmbracelet/soft-serve< 0.11.1 → fixed in 0.11.1 - Karmada Dashboard API Unauthorized Access Vulnerability CVE-2025-62714
github.com/karmada-io/dashboard< 0.2.0 → fixed in 0.2.0 - NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow CVE-2025-54469 CVSS 9.9 Critical
github.com/neuvector/neuvector>= 5.3.0, < 5.3.5 → fixed in 5.3.5;github.com/neuvector/neuvector>= 5.4.0, <= 5.4.6 → fixed in 5.4.7;github.com/neuvector/neuvector>= 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b4 → fixed in 0.0.0-20251020133207-084a437033b4 - Cosmos EVM Vulnerability GHSA-8pfh-j44r-f654
github.com/cosmos/evm>= 0.3.0, < 0.3.2 → fixed in 0.3.2;github.com/cosmos/evm>= 0.4.0, < 0.4.2 → fixed in 0.4.2 - NetBird VPN does not remove the default password of an admin account CVE-2025-10678 CVSS 9.3 Critical
github.com/netbirdio/netbird< 0.57.0 → fixed in 0.57.0 - Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning CVE-2025-59823 CVSS 9.9 Critical
github.com/gardener/gardener-extension-provider-aws< 1.64.0 → fixed in 1.64.0;github.com/gardener/gardener-extension-provider-gcp< 1.46.0 → fixed in 1.46.0;github.com/gardener/gardener-extension-provider-azure< 1.55.0 → fixed in 1.55.0; +1 more packages - Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59360 CVSS 9.8 Critical
github.com/chaos-mesh/chaos-mesh< 2.7.3 → fixed in 2.7.3 - Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59359 CVSS 9.8 Critical
github.com/chaos-mesh/chaos-mesh< 2.7.3 → fixed in 2.7.3 - Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59361 CVSS 9.8 Critical
github.com/chaos-mesh/chaos-mesh< 2.7.3 → fixed in 2.7.3 - Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation CVE-2025-54123 CVSS 9.8 Critical
github.com/SpectoLabs/hoverfly<= 1.11.3 → no fix listed - pREST has a Systemic SQL Injection Vulnerability CVE-2025-58450 CVSS 9.3 Critical
github.com/prest/prest/v2< 2.0.0-rc2 → no fix listed - Argo CD's Project API Token Exposes Repository Credentials CVE-2025-55190 CVSS 9.9 Critical
github.com/argoproj/argo-cd/v2>= 2.13.0, < 2.13.9 → fixed in 2.13.9;github.com/argoproj/argo-cd/v2>= 2.14.0, < 2.14.16 → fixed in 2.14.16;github.com/argoproj/argo-cd/v3< 3.0.14 → fixed in 3.0.14; +1 more packages - NeuVector admin account has insecure default password CVE-2025-8077 CVSS 9.8 Critical
github.com/neuvector/neuvector< 0.0.0-20250825191744-da1a462074c3 → fixed in 0.0.0-20250825191744-da1a462074c3 - HydrAIDE Authentication Bypass Vulnerability GHSA-qp7j-x725-g67f CVSS 10.0 Critical
github.com/hydraide/hydraide>= 2.1.1, < 2.2.1 → fixed in 2.2.1;github.com/hydraide/hydraide< 0.0.0-20250816184905-1256db38c33c → fixed in 0.0.0-20250816184905-1256db38c33c - Capsule tenant owners with "patch namespace" permission can hijack system namespaces label CVE-2025-55205 CVSS 9.0 Critical
github.com/projectcapsule/capsule< 0.10.4 → fixed in 0.10.4 - Privileged OpenBao Operator May Execute Code on the Underlying Host CVE-2025-54997 CVSS 9.1 Critical
github.com/openbao/openbao>= 0.1.0, < 2.3.2 → fixed in 2.3.2;github.com/openbao/openbao< 0.0.0-20250806194004-a14053c9679d → fixed in 0.0.0-20250806194004-a14053c9679d - Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration CVE-2025-6000 CVSS 9.1 Critical
github.com/hashicorp/vault>= 0.8.0, < 1.20.1 → fixed in 1.20.1 - OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CVE-2025-54576 CVSS 9.1 Critical
github.com/oauth2-proxy/oauth2-proxy/v7<= 7.10.0 → fixed in 7.11.0 - NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path CVE-2025-23266 CVSS 9.0 Critical
github.com/NVIDIA/nvidia-container-toolkit< 1.17.8 → fixed in 1.17.8;github.com/NVIDIA/k8s-device-plugin< 0.17.3 → fixed in 0.17.3;github.com/NVIDIA/gpu-operator< 25.3.2 → fixed in 25.3.2; +1 more packages - Gogs allows deletion of internal files which leads to remote command execution CVE-2024-56731 CVSS 10.0 Critical
gogs.io/gogs<= 0.13.2 → fixed in 0.13.3 - Mattermost allows authenticated users to write files to arbitrary locations CVE-2025-4981 CVSS 9.9 Critical
github.com/mattermost/mattermost-server< 0.0.0-20250519205859-65aec10162f6 → fixed in 0.0.0-20250519205859-65aec10162f6;github.com/mattermost/mattermost/server/v8< 8.0.0-20250519205859-65aec10162f6 → fixed in 8.0.0-20250519205859-65aec10162f6;github.com/mattermost/mattermost/server/v8>= 10.5.0, <= 10.5.5 → fixed in 10.5.6; +4 more packages - Teleport allows remote authentication bypass CVE-2025-49825 CVSS 9.8 Critical
github.com/gravitational/teleport>= 17.0.0, < 17.5.2 → fixed in 17.5.2;github.com/gravitational/teleport>= 16.0.0, < 16.5.12 → fixed in 16.5.12;github.com/gravitational/teleport>= 15.0.0, < 15.5.3 → fixed in 15.5.3; +4 more packages - listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVE-2025-49136 CVSS 9.0 Critical
github.com/knadh/listmonk>= 4.0.0, < 5.0.2 → fixed in 5.0.2 - Fabio allows HTTP clients to manipulate custom headers it adds CVE-2025-48865 CVSS 9.1 Critical
github.com/fabiolb/fabio<= 1.6.5 → fixed in 1.6.6 - Argo CD allows cross-site scripting on repositories page CVE-2025-47933 CVSS 9.0 Critical
github.com/argoproj/argo-cd>= 1.2.0-rc1, <= 1.8.7 → no fix listed;github.com/argoproj/argo-cd/v2>= 2.0.0-rc3, < 2.13.8 → fixed in 2.13.8;github.com/argoproj/argo-cd/v2>= 2.14.0-rc1, < 2.14.13 → fixed in 2.14.13; +1 more packages - Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation CVE-2025-47282 CVSS 9.9 Critical
github.com/gardener/external-dns-management< 0.23.6 → fixed in 0.23.6;github.com/gardener/gardener-extension-shoot-dns-service<= 1.6.0 → no fix listed - Gardener allows metadata injection for a project secret which can lead to privilege escalation CVE-2025-47284 CVSS 9.9 Critical
github.com/gardener/gardener< 1.116.4 → fixed in 1.116.4;github.com/gardener/gardener>= 1.117.0, < 1.117.5 → fixed in 1.117.5;github.com/gardener/gardener>= 1.118.0, < 1.118.2 → fixed in 1.118.2 - Gardener allows bypassing project secret validation which can lead to privilege escalation CVE-2025-47283 CVSS 9.9 Critical
github.com/gardener/gardener< 1.116.4 → fixed in 1.116.4;github.com/gardener/gardener>= 1.117.0, < 1.117.5 → fixed in 1.117.5;github.com/gardener/gardener>= 1.118.0, < 1.118.2 → fixed in 1.118.2 - OPKSSH Vulnerable to Authentication Bypass CVE-2025-4658 CVSS 9.3 Critical
github.com/openpubkey/opkssh< 0.5.0 → fixed in 0.5.0 - OpenPubkey Vulnerable to Authentication Bypass CVE-2025-3757 CVSS 9.3 Critical
github.com/openpubkey/openpubkey< 0.10.0 → fixed in 0.10.0