Security Digest · page 4 of 4
Critical Go advisories (page 4)
391 critical advisories for Go packages since October 2023, newest first. Check your project with govulncheck ./....
- goshs route not protected, allows command execution CVE-2025-46816 CVSS 9.4 Critical
github.com/patrickhener/goshs>= 0.3.4, <= 1.0.4 → fixed in 1.0.5 - Wazuh server vulnerable to remote code execution CVE-2025-24016 CVSS 9.9 Critical
github.com/wazuh/wazuh>= 4.4.0, < 4.9.1 → fixed in 4.9.1 - Traefik affected by Go HTTP Request Smuggling Vulnerability GHSA-5423-jcjm-2gpv CVSS 9.1 Critical
github.com/traefik/traefik/v2< 2.11.24 → fixed in 2.11.24;github.com/traefik/traefik/v3< 3.3.6 → fixed in 3.3.6;github.com/traefik/traefik/v3= 3.4.0-rc1 → fixed in 3.4.0-rc2 - Dpanel's hard-coded JWT secret leads to remote code execution CVE-2025-30206 CVSS 9.8 Critical
github.com/donknap/dpanel< 1.6.1 → fixed in 1.6.1 - NATS Server may fail to authorize certain Jetstream admin APIs CVE-2025-30215 CVSS 9.6 Critical
github.com/nats-io/nats-server/v2>= 2.11.0-RC.1, < 2.11.1 → fixed in 2.11.1;github.com/nats-io/nats-server/v2>= 2.2.0, < 2.10.27 → fixed in 2.10.27 - Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR CVE-2025-32445 CVSS 9.9 Critical
github.com/argoproj/argo-events< 1.9.6 → fixed in 1.9.6 - Rancher: Restricted Administrator can change Administrator's passwords CVE-2025-23391 CVSS 9.1 Critical
github.com/rancher/rancher>= 2.8.0, < 2.8.14 → fixed in 2.8.14;github.com/rancher/rancher>= 2.9.0, < 2.9.8 → fixed in 2.9.8;github.com/rancher/rancher>= 2.10.0, < 2.10.4 → fixed in 2.10.4 - Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVE-2025-30223 CVSS 9.3 Critical
github.com/beego/beego/v2< 2.3.6 → fixed in 2.3.6;github.com/beego/beego<= 1.12.14 → no fix listed - ingress-nginx admission controller RCE escalation CVE-2025-1974 CVSS 9.8 Critical
k8s.io/ingress-nginx< 1.11.5 → fixed in 1.11.5;k8s.io/ingress-nginx>= 1.12.0-beta.0, < 1.12.1 → fixed in 1.12.1 - kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace CVE-2025-29922 CVSS 9.6 Critical
github.com/kcp-dev/kcp< 0.26.3 → fixed in 0.26.3 - cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) GHSA-h2rp-8vpx-q9r4
github.com/cheqd/cheqd-node< 3.1.8 → fixed in 3.1.8 - IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt GHSA-4wf3-5qj9-368v
github.com/cosmos/ibc-go< 7.10.0 → fixed in 7.10.0;github.com/cosmos/ibc-go/v8>= 8.0.0-alpha.1, < 8.7.0 → fixed in 8.7.0;github.com/cosmos/ibc-go/v2< 7.10.0 → fixed in 7.10.0; +5 more packages - cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-33cr-m232-xqch CVSS 9.3 Critical
github.com/cheqd/cheqd-node< 3.1.7 → fixed in 3.1.7 - Fleet has SAML authentication vulnerability due to improper SAML response validation CVE-2025-27509 CVSS 9.3 Critical
github.com/fleetdm/fleet/v4>= 4.64.0, < 4.64.2 → fixed in 4.64.2;github.com/fleetdm/fleet/v4>= 4.63.0, < 4.63.2 → fixed in 4.63.2;github.com/fleetdm/fleet/v4>= 4.62.0, < 4.62.4 → fixed in 4.62.4; +2 more packages - IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations CVE-2025-27507 CVSS 9.0 Critical
github.com/zitadel/zitadel/v2< 2.63.8 → fixed in 2.63.8;github.com/zitadel/zitadel/v2>= 2.64.0, < 2.64.5 → fixed in 2.64.5;github.com/zitadel/zitadel/v2>= 2.65.0, < 2.65.6 → fixed in 2.65.6; +13 more packages - IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-jg6f-48ff-5xrw CVSS 9.3 Critical
github.com/cosmos/ibc-go< 7.9.2 → no fix listed;github.com/cosmos/ibc-go/v2< 7.9.2 → no fix listed;github.com/cosmos/ibc-go/v3< 7.9.2 → no fix listed; +5 more packages - Mattermost allows reading arbitrary files CVE-2025-20051 CVSS 9.9 Critical
github.com/mattermost/mattermost/server/v8< 8.0.0-20250122165010-4ed702ccff4e → fixed in 8.0.0-20250122165010-4ed702ccff4e;github.com/mattermost/mattermost/server/v8>= 9.11.0-rc1, < 9.11.8 → fixed in 9.11.8;github.com/mattermost/mattermost/server/v8>= 10.2.0-rc1, < 10.2.3 → fixed in 10.2.3; +2 more packages - Mattermost allows reading arbitrary files related to importing boards CVE-2025-25279 CVSS 9.9 Critical
github.com/mattermost/mattermost/server/v8< 8.0.0-20250122165010-4ed702ccff4e → fixed in 8.0.0-20250122165010-4ed702ccff4e;github.com/mattermost/mattermost/server/v8>= 9.11.0-rc1, < 9.11.8 → fixed in 9.11.8;github.com/mattermost/mattermost/server/v8>= 10.2.0-rc1, < 10.2.3 → fixed in 10.2.3; +2 more packages - MaysWind ezBookkeeping has Improper Privilege Management CVE-2024-57604 CVSS 9.8 Critical
github.com/mayswind/ezbookkeeping<= 0.7.0 → no fix listed - WhoDB has a path traversal opening Sqlite3 database CVE-2025-24786 CVSS 10.0 Critical
github.com/clidey/whodb/core< 0.0.0-20250127172032-547336ac73c8 → fixed in 0.0.0-20250127172032-547336ac73c8 - go-git has an Argument Injection via the URL field CVE-2025-21613 CVSS 9.2 Critical
gopkg.in/src-d/go-git.v4>= 4.0.0, <= 4.13.1 → no fix listed;github.com/go-git/go-git/v5< 5.13.0 → fixed in 5.13.0 - Gogs has an argument Injection in the built-in SSH server CVE-2024-39930 CVSS 9.9 Critical
gogs.io/gogs<= 0.13.0 → fixed in 0.13.1 - Gogs allows deletion of internal files CVE-2024-39931 CVSS 9.9 Critical
gogs.io/gogs<= 0.13.0 → fixed in 0.13.1 - Gogs allows argument injection during the previewing of changes CVE-2024-39932 CVSS 9.9 Critical
gogs.io/gogs<= 0.13.0 → fixed in 0.13.1 - GoCast OS Command Injection vulnerability CVE-2024-28892 CVSS 9.8 Critical
github.com/mayuresh82/gocast<= 1.1.3 → no fix listed - Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45337 CVSS 9.1 Critical
golang.org/x/crypto< 0.31.0 → fixed in 0.31.0 - Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE CVE-2024-51735 CVSS 9.3 Critical
github.com/j3ssie/osmedeus<= 4.6.4 → no fix listed - NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability CVE-2024-0132 CVSS 9.3 Critical
github.com/NVIDIA/nvidia-container-toolkit< 1.16.2 → fixed in 1.16.2 - RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists GHSA-x7xj-jvwp-97rv CVSS 9.1 Critical
github.com/rancher/rke2>= 1.27.0, < 1.27.15 → fixed in 1.27.15;github.com/rancher/rke2>= 1.28.0, < 1.28.11 → fixed in 1.28.11;github.com/rancher/rke2>= 1.29.0, < 1.29.6 → fixed in 1.29.6; +1 more packages - Rancher Remote Code Execution via Cluster/Node Drivers CVE-2024-22036 CVSS 9.1 Critical
github.com/rancher/rancher>= 2.7.0, < 2.7.16 → fixed in 2.7.16;github.com/rancher/rancher>= 2.8.0, < 2.8.9 → fixed in 2.8.9;github.com/rancher/rancher>= 2.9.0, < 2.9.3 → fixed in 2.9.3 - Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists CVE-2023-32197 CVSS 9.4 Critical
github.com/rancher/rancher>= 2.7.0, < 2.8.9 → fixed in 2.8.9;github.com/rancher/rancher>= 2.9.0, < 2.9.3 → fixed in 2.9.3 - github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses GHSA-7h65-4p22-39j6 CVSS 9.8 Critical
github.com/crossplane/crossplane= 1.15.5 → fixed in 1.15.6;github.com/crossplane/crossplane= 1.16.2 → fixed in 1.16.3;github.com/crossplane/crossplane= 1.17.1 → fixed in 1.17.2 - Grafana Command Injection And Local File Inclusion Via Sql Expressions CVE-2024-9264 CVSS 9.4 Critical
github.com/grafana/grafana>= 11.0.0, <= 11.0.6 → fixed in 11.0.6+security-01;github.com/grafana/grafana>= 11.1.0, <= 11.1.7 → fixed in 11.1.7+security-01;github.com/grafana/grafana>= 11.2.0, <= 11.2.2 → fixed in 11.2.2+security-01 - VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder CVE-2024-9486 CVSS 9.3 Critical
github.com/kubernetes-sigs/image-builder< 0.1.38 → fixed in 0.1.38 - SSOReady has an XML Signature Bypass via differential XML parsing CVE-2024-47832 CVSS 9.3 Critical
github.com/ssoready/ssoready< 0.0.0-20241009153838-7f92a0630439 → fixed in 0.0.0-20241009153838-7f92a0630439 - Mellium allows Authentication Bypass by Spoofing CVE-2024-46957 CVSS 9.3 Critical
mellium.im/xmpp< 0.22.0 → fixed in 0.22.0 - Navidrome has Multiple SQL Injections and ORM Leak CVE-2024-47062 CVSS 9.4 Critical
github.com/navidrome/navidrome< 0.53.0 → fixed in 0.53.0 - Grafana plugin SDK Information Leakage CVE-2024-8986 CVSS 9.1 Critical
github.com/grafana/grafana-plugin-sdk-go<= 0.249.0 → fixed in 0.250.0 - Dragonfly2 has hard coded cyptographic key CVE-2023-27584 CVSS 9.3 Critical
d7y.io/dragonfly/v2>= 2.1.0-alpha.0, < 2.1.0-beta.1 → fixed in 2.1.0-beta.1;d7y.io/dragonfly/v2< 2.0.9-rc.2 → fixed in 2.0.9-rc.2 - HTTP client can manipulate custom HTTP headers that are added by Traefik CVE-2024-45410 CVSS 9.3 Critical
github.com/traefik/traefik/v3>= 3.0.0-beta3, < 3.1.3 → fixed in 3.1.3;github.com/traefik/traefik/v2< 2.11.9 → fixed in 2.11.9;github.com/traefik/traefik< 2.11.9 → fixed in 2.11.9 - Chaosblade vulnerable to OS command execution CVE-2023-47105 CVSS 9.3 Critical
github.com/chaosblade-io/chaosblade>= 0.0.3, < 1.7.4 → fixed in 1.7.4 - GoAuthentik vulnerable to Insufficient Authorization for several API endpoints CVE-2024-42490 CVSS 9.1 Critical
goauthentik.io>= 2024.6.0-rc1, < 2024.6.4 → fixed in 2024.6.4;goauthentik.io< 2024.4.4 → fixed in 2024.4.4 - SQL injection in github.com/stashapp/stash CVE-2024-32231 CVSS 9.1 Critical
github.com/stashapp/stash< 0.26.0 → fixed in 0.26.0 - RBAC Roles for `etcd` created by Kamaji are not disjunct CVE-2024-42480 CVSS 9.3 Critical
github.com/clastix/kamaji<= 1.0.0 → no fix listed - CasaOS Command Injection vulnerability CVE-2023-37469 CVSS 9.3 Critical
github.com/IceWhaleTech/CasaOS< 0.4.4 → fixed in 0.4.4 - Gitea Cross-site Scripting Vulnerability CVE-2024-6886 CVSS 10.0 Critical
code.gitea.io/gitea< 1.22.1 → fixed in 1.22.1 - rudder-server is vulnerable to SQL injection CVE-2023-30625 CVSS 9.3 Critical
github.com/rudderlabs/rudder-server< 1.3.0-rc.1 → fixed in 1.3.0-rc.1 - Mattermost allows unsolicited invites to expose access to local channels CVE-2024-39777 CVSS 9.3 Critical
github.com/mattermost/mattermost/server/v8>= 9.9.0, < 9.9.1 → fixed in 9.9.1;github.com/mattermost/mattermost/server/v8>= 9.5.0, < 9.5.7 → fixed in 9.5.7;github.com/mattermost/mattermost/server/v8>= 9.7.0, < 9.7.6 → fixed in 9.7.6; +1 more packages - Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel CVE-2024-39274 CVSS 9.3 Critical
github.com/mattermost/mattermost/server/v8>= 9.5.0, < 9.5.7 → fixed in 9.5.7;github.com/mattermost/mattermost/server/v8>= 9.7.0, < 9.7.6 → fixed in 9.7.6;github.com/mattermost/mattermost/server/v8>= 9.8.0, < 9.8.2 → fixed in 9.8.2; +1 more packages - pREST vulnerable to jwt bypass + sql injection GHSA-wm25-j4gw-6vr3 CVSS 9.3 Critical
github.com/prest/prest< 1.5.4 → fixed in 1.5.4 - Authz zero length regression CVE-2024-41110 CVSS 9.4 Critical
github.com/docker/docker>= 24.0.0, < 25.0.6 → fixed in 25.0.6;github.com/docker/docker>= 19.03.0, < 23.0.15 → fixed in 23.0.15;github.com/docker/docker>= 26.0.0, < 26.1.5 → fixed in 26.1.5; +1 more packages - fabedge has insecure permissions CVE-2024-36536 CVSS 9.1 Critical
github.com/fabedge/fabedge<= 0.8.1 → no fix listed - Volcano has insecure permissions CVE-2024-36533 CVSS 9.3 Critical
github.com/volcano-sh/volcano< 1.10.0-alpha.0 → fixed in 1.10.0-alpha.0;volcano.sh/volcano< 1.10.0-alpha.0 → fixed in 1.10.0-alpha.0 - 1Panel has an SQL injection issue related to the orderBy clause CVE-2024-39907 CVSS 9.3 Critical
github.com/1Panel-dev/1Panel< 1.10.12-tls → fixed in 1.10.12-tls - Missing key verification in gost CVE-2024-39223 CVSS 9.8 Critical
github.com/ginuerzh/gost<= 2.11.5 → no fix listed - Session Middleware Token Injection Vulnerability CVE-2024-38513 CVSS 10.0 Critical
github.com/gofiber/fiber<= 2.52.4 → fixed in 2.52.5;github.com/gofiber/fiber/v2<= 2.52.4 → fixed in 2.52.5;github.com/gofiber/fiber/v2/middleware/session<= 2.52.4 → fixed in 2.52.5 - Gin mishandles a wildcard at the end of an origin string CVE-2019-25211 CVSS 9.3 Critical
github.com/gin-gonic/gin< 1.6.0 → fixed in 1.6.0;github.com/gin-contrib/cors< 1.6.0 → fixed in 1.6.0 - rke's credentials are stored in the RKE1 Cluster state ConfigMap CVE-2023-32191 CVSS 9.9 Critical
github.com/rancher/rke>= 1.4.18, < 1.4.19 → fixed in 1.4.19;github.com/rancher/rke>= 1.5.9, < 1.5.10 → fixed in 1.5.10 - Files or Directories Accessible to External Parties in ProjectDiscovery CVE-2024-5262 CVSS 9.8 Critical
github.com/projectdiscovery/interactsh< 1.2.0 → fixed in 1.2.0 - ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVE-2024-31989 CVSS 9.0 Critical
github.com/argoproj/argo-cd/v2< 2.8.19 → fixed in 2.8.19;github.com/argoproj/argo-cd/v2>= 2.9.0-rc1, < 2.9.15 → fixed in 2.9.15;github.com/argoproj/argo-cd/v2>= 2.10.0-rc1, < 2.10.10 → fixed in 2.10.10; +2 more packages - Grafana Race condition allowing privilege escalation CVE-2022-39328 CVSS 9.3 Critical
github.com/grafana/grafana>= 9.2.0, < 9.2.4 → fixed in 9.2.4 - Grafana Fine-grained access control vulnerability CVE-2021-41244 CVSS 9.1 Critical
github.com/grafana/grafana>= 8.0.0, < 8.2.4 → fixed in 8.2.4 - tiagorlampert CHAOS vulnerable to arbitrary code execution CVE-2024-33434 CVSS 9.8 Critical
github.com/tiagorlampert/CHAOS< 0.0.0-20220716132853-b47438d36e3a → fixed in 0.0.0-20220716132853-b47438d36e3a - Some CORS middleware allow untrusted origins GHSA-vhxv-fg4m-p2w8 CVSS 9.3 Critical
github.com/jub0bs/cors< 0.1.3 → fixed in 0.1.3 - Some CORS middleware allow untrusted origins GHSA-v84h-653v-4pq9 CVSS 9.3 Critical
github.com/jub0bs/fcors<= 0.8.0 → fixed in 0.9.0 - Improper Access Control in Gitea CVE-2020-28991 CVSS 9.8 Critical
github.com/go-gitea/gitea>= 0.9.99, < 1.12.6 → fixed in 1.12.6 - Privilege Escalation in kubevirt CVE-2020-14316 CVSS 9.9 Critical
kubevirt.io/kubevirt< 0.30.0 → fixed in 0.30.0 - Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit GHSA-v6rw-hhgg-wc4x CVSS 9.1 Critical
github.com/evmos/evmos/v11< 12.0.0 → fixed in 12.0.0 - HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches CVE-2024-3817 CVSS 9.8 Critical
github.com/hashicorp/go-getter>= 1.5.9, < 1.7.4 → fixed in 1.7.4 - LocalAI Command Injection in audioToWav CVE-2024-2029 CVSS 9.3 Critical
github.com/go-skynet/LocalAI< 2.10.0 → fixed in 2.10.0 - Evmos transaction execution not accounting for all state transition after interaction with precompiles CVE-2024-32644 CVSS 9.1 Critical
github.com/evmos/evmos/v16<= 16.0.4 → fixed in 17.0.0;github.com/evmos/evmos/v7<= 7.0.0 → no fix listed;github.com/evmos/evmos/v6<= 6.0.4 → no fix listed; +6 more packages - ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks GHSA-j496-crgh-34mx CVSS 9.1 Critical
github.com/cosmos/ibc-go/v4< 4.6.0 → fixed in 4.6.0;github.com/cosmos/ibc-go/v5< 5.4.0 → fixed in 5.4.0;github.com/cosmos/ibc-go/v6< 6.3.0 → fixed in 6.3.0; +5 more packages - Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss CVE-2024-21652 CVSS 9.8 Critical
github.com/argoproj/argo-cd/v2< 2.8.13 → fixed in 2.8.13;github.com/argoproj/argo-cd/v2>= 2.9.0, < 2.9.9 → fixed in 2.9.9;github.com/argoproj/argo-cd/v2>= 2.10.0, < 2.10.4 → fixed in 2.10.4 - Cross-site scripting on application summary component CVE-2024-28175 CVSS 9.0 Critical
github.com/argoproj/argo-cd/v2>= 2.9.0, < 2.9.8 → fixed in 2.9.8;github.com/argoproj/argo-cd/v2>= 2.10.0, < 2.10.3 → fixed in 2.10.3;github.com/argoproj/argo-cd/v2>= 2.0.0, < 2.8.12 → fixed in 2.8.12; +1 more packages - Pterodactyl Wings vulnerable to improper isolation of server file access CVE-2024-27102 CVSS 9.9 Critical
github.com/pterodactyl/wings< 1.11.9 → fixed in 1.11.9 - Authorization Bypass Through User-Controlled Key in go-zero CVE-2024-27302 CVSS 9.1 Critical
github.com/zeromicro/go-zero< 1.4.4 → fixed in 1.4.4 - Transparent TLS may not be applied to Marbles with certain manifest configurations GHSA-x5r5-2qrx-rqj8 CVSS 9.1 Critical
github.com/edgelesssys/marblerun< 1.4.1 → fixed in 1.4.1 - Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVE-2024-25124 CVSS 9.4 Critical
github.com/gofiber/fiber/v2< 2.52.1 → fixed in 2.52.1 - Buildkit's interactive containers API does not validate entitlements check CVE-2024-23653 CVSS 9.8 Critical
github.com/moby/buildkit< 0.12.5 → fixed in 0.12.5 - BuildKit vulnerable to possible host system access from mount stub cleaner CVE-2024-23652 CVSS 10.0 Critical
github.com/moby/buildkit< 0.12.5 → fixed in 0.12.5 - HashiCorp Vault Improper Privilege Management CVE-2020-10661 CVSS 9.3 Critical
github.com/hashicorp/vault>= 0.11.0, < 1.3.4 → fixed in 1.3.4 - Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature CVE-2024-23827 CVSS 9.3 Critical
github.com/0xJacky/Nginx-UI< 1.9.10-0.20240128060047-8581bdd3c6f4 → fixed in 1.9.10-0.20240128060047-8581bdd3c6f4 - Django Template Engine Vulnerable to XSS CVE-2024-22199 CVSS 9.3 Critical
github.com/gofiber/template/django/v3< 3.1.9 → fixed in 3.1.9 - Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVE-2023-49569 CVSS 9.8 Critical
github.com/go-git/go-git/v5>= 5.0.0, < 5.11.0 → fixed in 5.11.0;gopkg.in/src-d/go-git.v4>= 4.0.0, <= 4.13.1 → no fix listed - snapd Race Condition vulnerability CVE-2022-3328 CVSS 9.0 Critical
github.com/snapcore/snapd< 2.57.6 → fixed in 2.57.6 - Improper Privilege Management in github.com/sap/cloud-security-client-go CVE-2023-50424 CVSS 9.3 Critical
github.com/sap/cloud-security-client-go< 0.17.0 → fixed in 0.17.0 - Capsule Proxy Authentication bypass using an empty token CVE-2023-48312 CVSS 9.8 Critical
github.com/projectcapsule/capsule-proxy<= 0.4.5 → fixed in 0.4.6;github.com/clastix/capsule-proxy<= 0.4.5 → fixed in 0.4.6 - SQL injection vulnerability in Meshery CVE-2023-46575 CVSS 9.1 Critical
github.com/layer5io/meshery< 0.6.179 → fixed in 0.6.179 - CSRF Token Reuse Vulnerability CVE-2023-45128 CVSS 9.6 Critical
github.com/gofiber/fiber/v2< 2.50.0 → fixed in 2.50.0 - Plonk verifier KZG multi point verification GHSA-7p92-x423-vwj6
github.com/consensys/gnark< 0.9.1 → fixed in 0.9.1 - JWT token compromise can allow malicious actions including Remote Code Execution (RCE) CVE-2023-32188 CVSS 9.4 Critical
github.com/neuvector/neuvector< 0.0.0-20230930010431-57d107118e92 → fixed in 0.0.0-20231003121714-be746957ee7c