---
title: "Critical Go advisories (page 4)"
url: https://erroneo.us/security/ecosystem/go/4/
description: "All 391 critical GitHub-reviewed Go security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 4 of 4."
type: ecosystem
section: "Security Digest"
date_modified: 2025-05-06
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Go advisories (page 4)

- 2025-05-06 [CVE-2025-46816](https://erroneo.us/security/cve/CVE-2025-46816/index.md) goshs route not protected, allows command execution — github.com/patrickhener/goshs >= 0.3.4, <= 1.0.4 → 1.0.5
- 2025-04-22 [CVE-2025-24016](https://erroneo.us/security/cve/CVE-2025-24016/index.md) Wazuh server vulnerable to remote code execution — github.com/wazuh/wazuh >= 4.4.0, < 4.9.1 → 4.9.1
- 2025-04-18 [GHSA-5423-jcjm-2gpv](https://erroneo.us/security/ghsa/GHSA-5423-jcjm-2gpv/index.md) Traefik affected by Go HTTP Request Smuggling Vulnerability — github.com/traefik/traefik/v2 < 2.11.24 → 2.11.24; github.com/traefik/traefik/v3 < 3.3.6 → 3.3.6; github.com/traefik/traefik/v3 = 3.4.0-rc1 → 3.4.0-rc2
- 2025-04-15 [CVE-2025-30206](https://erroneo.us/security/cve/CVE-2025-30206/index.md) Dpanel's hard-coded JWT secret leads to remote code execution — github.com/donknap/dpanel < 1.6.1 → 1.6.1
- 2025-04-15 [CVE-2025-30215](https://erroneo.us/security/cve/CVE-2025-30215/index.md) NATS Server may fail to authorize certain Jetstream admin APIs — github.com/nats-io/nats-server/v2 >= 2.11.0-RC.1, < 2.11.1 → 2.11.1; github.com/nats-io/nats-server/v2 >= 2.2.0, < 2.10.27 → 2.10.27
- 2025-04-14 [CVE-2025-32445](https://erroneo.us/security/cve/CVE-2025-32445/index.md) Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR — github.com/argoproj/argo-events < 1.9.6 → 1.9.6
- 2025-04-01 [CVE-2025-23391](https://erroneo.us/security/cve/CVE-2025-23391/index.md) Rancher: Restricted Administrator can change Administrator's passwords — github.com/rancher/rancher >= 2.8.0, < 2.8.14 → 2.8.14; github.com/rancher/rancher >= 2.9.0, < 2.9.8 → 2.9.8; github.com/rancher/rancher >= 2.10.0, < 2.10.4 → 2.10.4
- 2025-03-31 [CVE-2025-30223](https://erroneo.us/security/cve/CVE-2025-30223/index.md) Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input — github.com/beego/beego/v2 < 2.3.6 → 2.3.6; github.com/beego/beego <= 1.12.14 → no fix
- 2025-03-24 [CVE-2025-1974](https://erroneo.us/security/cve/CVE-2025-1974/index.md) ingress-nginx admission controller RCE escalation — k8s.io/ingress-nginx < 1.11.5 → 1.11.5; k8s.io/ingress-nginx >= 1.12.0-beta.0, < 1.12.1 → 1.12.1
- 2025-03-20 [CVE-2025-29922](https://erroneo.us/security/cve/CVE-2025-29922/index.md) kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace — github.com/kcp-dev/kcp < 0.26.3 → 0.26.3
- 2025-03-13 [GHSA-h2rp-8vpx-q9r4](https://erroneo.us/security/ghsa/GHSA-h2rp-8vpx-q9r4/index.md) cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) — github.com/cheqd/cheqd-node < 3.1.8 → 3.1.8
- 2025-03-12 [GHSA-4wf3-5qj9-368v](https://erroneo.us/security/ghsa/GHSA-4wf3-5qj9-368v/index.md) IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt — github.com/cosmos/ibc-go < 7.10.0 → 7.10.0; github.com/cosmos/ibc-go/v8 >= 8.0.0-alpha.1, < 8.7.0 → 8.7.0; github.com/cosmos/ibc-go/v2 < 7.10.0 → 7.10.0
- 2025-03-11 [GHSA-33cr-m232-xqch](https://erroneo.us/security/ghsa/GHSA-33cr-m232-xqch/index.md) cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement — github.com/cheqd/cheqd-node < 3.1.7 → 3.1.7
- 2025-03-06 [CVE-2025-27509](https://erroneo.us/security/cve/CVE-2025-27509/index.md) Fleet has SAML authentication vulnerability due to improper SAML response validation — github.com/fleetdm/fleet/v4 >= 4.64.0, < 4.64.2 → 4.64.2; github.com/fleetdm/fleet/v4 >= 4.63.0, < 4.63.2 → 4.63.2; github.com/fleetdm/fleet/v4 >= 4.62.0, < 4.62.4 → 4.62.4
- 2025-03-04 [CVE-2025-27507](https://erroneo.us/security/cve/CVE-2025-27507/index.md) IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations — github.com/zitadel/zitadel/v2 < 2.63.8 → 2.63.8; github.com/zitadel/zitadel/v2 >= 2.64.0, < 2.64.5 → 2.64.5; github.com/zitadel/zitadel/v2 >= 2.65.0, < 2.65.6 → 2.65.6
- 2025-02-28 [GHSA-jg6f-48ff-5xrw](https://erroneo.us/security/ghsa/GHSA-jg6f-48ff-5xrw/index.md) IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement — github.com/cosmos/ibc-go < 7.9.2 → no fix; github.com/cosmos/ibc-go/v2 < 7.9.2 → no fix; github.com/cosmos/ibc-go/v3 < 7.9.2 → no fix
- 2025-02-24 [CVE-2025-20051](https://erroneo.us/security/cve/CVE-2025-20051/index.md) Mattermost allows reading arbitrary files — github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e → 8.0.0-20250122165010-4ed702ccff4e; github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8 → 9.11.8; github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3 → 10.2.3
- 2025-02-24 [CVE-2025-25279](https://erroneo.us/security/cve/CVE-2025-25279/index.md) Mattermost allows reading arbitrary files related to importing boards — github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e → 8.0.0-20250122165010-4ed702ccff4e; github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8 → 9.11.8; github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3 → 10.2.3
- 2025-02-12 [CVE-2024-57604](https://erroneo.us/security/cve/CVE-2024-57604/index.md) MaysWind ezBookkeeping has Improper Privilege Management — github.com/mayswind/ezbookkeeping <= 0.7.0 → no fix
- 2025-02-06 [CVE-2025-24786](https://erroneo.us/security/cve/CVE-2025-24786/index.md) WhoDB has a path traversal opening Sqlite3 database — github.com/clidey/whodb/core < 0.0.0-20250127172032-547336ac73c8 → 0.0.0-20250127172032-547336ac73c8
- 2025-01-06 [CVE-2025-21613](https://erroneo.us/security/cve/CVE-2025-21613/index.md) go-git has an Argument Injection via the URL field — gopkg.in/src-d/go-git.v4 >= 4.0.0, <= 4.13.1 → no fix; github.com/go-git/go-git/v5 < 5.13.0 → 5.13.0
- 2024-12-23 [CVE-2024-39930](https://erroneo.us/security/cve/CVE-2024-39930/index.md) Gogs has an argument Injection in the built-in SSH server — gogs.io/gogs <= 0.13.0 → 0.13.1
- 2024-12-23 [CVE-2024-39931](https://erroneo.us/security/cve/CVE-2024-39931/index.md) Gogs allows deletion of internal files — gogs.io/gogs <= 0.13.0 → 0.13.1
- 2024-12-23 [CVE-2024-39932](https://erroneo.us/security/cve/CVE-2024-39932/index.md) Gogs allows argument injection during the previewing of changes — gogs.io/gogs <= 0.13.0 → 0.13.1
- 2024-12-20 [CVE-2024-28892](https://erroneo.us/security/cve/CVE-2024-28892/index.md) GoCast OS Command Injection vulnerability — github.com/mayuresh82/gocast <= 1.1.3 → no fix
- 2024-12-11 [CVE-2024-45337](https://erroneo.us/security/cve/CVE-2024-45337/index.md) Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto — golang.org/x/crypto < 0.31.0 → 0.31.0
- 2024-11-05 [CVE-2024-51735](https://erroneo.us/security/cve/CVE-2024-51735/index.md) Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE — github.com/j3ssie/osmedeus <= 4.6.4 → no fix
- 2024-10-29 [CVE-2024-0132](https://erroneo.us/security/cve/CVE-2024-0132/index.md) NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability — github.com/NVIDIA/nvidia-container-toolkit < 1.16.2 → 1.16.2
- 2024-10-25 [GHSA-x7xj-jvwp-97rv](https://erroneo.us/security/ghsa/GHSA-x7xj-jvwp-97rv/index.md) RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists — github.com/rancher/rke2 >= 1.27.0, < 1.27.15 → 1.27.15; github.com/rancher/rke2 >= 1.28.0, < 1.28.11 → 1.28.11; github.com/rancher/rke2 >= 1.29.0, < 1.29.6 → 1.29.6
- 2024-10-25 [CVE-2024-22036](https://erroneo.us/security/cve/CVE-2024-22036/index.md) Rancher Remote Code Execution via Cluster/Node Drivers — github.com/rancher/rancher >= 2.7.0, < 2.7.16 → 2.7.16; github.com/rancher/rancher >= 2.8.0, < 2.8.9 → 2.8.9; github.com/rancher/rancher >= 2.9.0, < 2.9.3 → 2.9.3
- 2024-10-25 [CVE-2023-32197](https://erroneo.us/security/cve/CVE-2023-32197/index.md) Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists — github.com/rancher/rancher >= 2.7.0, < 2.8.9 → 2.8.9; github.com/rancher/rancher >= 2.9.0, < 2.9.3 → 2.9.3
- 2024-10-25 [GHSA-7h65-4p22-39j6](https://erroneo.us/security/ghsa/GHSA-7h65-4p22-39j6/index.md) github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses — github.com/crossplane/crossplane = 1.15.5 → 1.15.6; github.com/crossplane/crossplane = 1.16.2 → 1.16.3; github.com/crossplane/crossplane = 1.17.1 → 1.17.2
- 2024-10-17 [CVE-2024-9264](https://erroneo.us/security/cve/CVE-2024-9264/index.md) Grafana Command Injection And Local File Inclusion Via Sql Expressions — github.com/grafana/grafana >= 11.0.0, <= 11.0.6 → 11.0.6+security-01; github.com/grafana/grafana >= 11.1.0, <= 11.1.7 → 11.1.7+security-01; github.com/grafana/grafana >= 11.2.0, <= 11.2.2 → 11.2.2+security-01
- 2024-10-15 [CVE-2024-9486](https://erroneo.us/security/cve/CVE-2024-9486/index.md) VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder — github.com/kubernetes-sigs/image-builder < 0.1.38 → 0.1.38
- 2024-10-11 [CVE-2024-47832](https://erroneo.us/security/cve/CVE-2024-47832/index.md) SSOReady has an XML Signature Bypass via differential XML parsing — github.com/ssoready/ssoready < 0.0.0-20241009153838-7f92a0630439 → 0.0.0-20241009153838-7f92a0630439
- 2024-09-24 [CVE-2024-46957](https://erroneo.us/security/cve/CVE-2024-46957/index.md) Mellium allows Authentication Bypass by Spoofing — mellium.im/xmpp < 0.22.0 → 0.22.0
- 2024-09-20 [CVE-2024-47062](https://erroneo.us/security/cve/CVE-2024-47062/index.md) Navidrome has Multiple SQL Injections and ORM Leak — github.com/navidrome/navidrome < 0.53.0 → 0.53.0
- 2024-09-19 [CVE-2024-8986](https://erroneo.us/security/cve/CVE-2024-8986/index.md) Grafana plugin SDK Information Leakage — github.com/grafana/grafana-plugin-sdk-go <= 0.249.0 → 0.250.0
- 2024-09-19 [CVE-2023-27584](https://erroneo.us/security/cve/CVE-2023-27584/index.md) Dragonfly2 has hard coded cyptographic key — d7y.io/dragonfly/v2 >= 2.1.0-alpha.0, < 2.1.0-beta.1 → 2.1.0-beta.1; d7y.io/dragonfly/v2 < 2.0.9-rc.2 → 2.0.9-rc.2
- 2024-09-19 [CVE-2024-45410](https://erroneo.us/security/cve/CVE-2024-45410/index.md) HTTP client can manipulate custom HTTP headers that are added by Traefik — github.com/traefik/traefik/v3 >= 3.0.0-beta3, < 3.1.3 → 3.1.3; github.com/traefik/traefik/v2 < 2.11.9 → 2.11.9; github.com/traefik/traefik < 2.11.9 → 2.11.9
- 2024-09-18 [CVE-2023-47105](https://erroneo.us/security/cve/CVE-2023-47105/index.md) Chaosblade vulnerable to OS command execution — github.com/chaosblade-io/chaosblade >= 0.0.3, < 1.7.4 → 1.7.4
- 2024-08-22 [CVE-2024-42490](https://erroneo.us/security/cve/CVE-2024-42490/index.md) GoAuthentik vulnerable to Insufficient Authorization for several API endpoints — goauthentik.io >= 2024.6.0-rc1, < 2024.6.4 → 2024.6.4; goauthentik.io < 2024.4.4 → 2024.4.4
- 2024-08-15 [CVE-2024-32231](https://erroneo.us/security/cve/CVE-2024-32231/index.md) SQL injection in github.com/stashapp/stash — github.com/stashapp/stash < 0.26.0 → 0.26.0
- 2024-08-12 [CVE-2024-42480](https://erroneo.us/security/cve/CVE-2024-42480/index.md) RBAC Roles for `etcd` created by Kamaji are not disjunct — github.com/clastix/kamaji <= 1.0.0 → no fix
- 2024-08-05 [CVE-2023-37469](https://erroneo.us/security/cve/CVE-2023-37469/index.md) CasaOS Command Injection vulnerability — github.com/IceWhaleTech/CasaOS < 0.4.4 → 0.4.4
- 2024-08-05 [CVE-2024-6886](https://erroneo.us/security/cve/CVE-2024-6886/index.md) Gitea Cross-site Scripting Vulnerability — code.gitea.io/gitea < 1.22.1 → 1.22.1
- 2024-08-05 [CVE-2023-30625](https://erroneo.us/security/cve/CVE-2023-30625/index.md) rudder-server is vulnerable to SQL injection — github.com/rudderlabs/rudder-server < 1.3.0-rc.1 → 1.3.0-rc.1
- 2024-08-01 [CVE-2024-39777](https://erroneo.us/security/cve/CVE-2024-39777/index.md) Mattermost allows unsolicited invites to expose access to local channels — github.com/mattermost/mattermost/server/v8 >= 9.9.0, < 9.9.1 → 9.9.1; github.com/mattermost/mattermost/server/v8 >= 9.5.0, < 9.5.7 → 9.5.7; github.com/mattermost/mattermost/server/v8 >= 9.7.0, < 9.7.6 → 9.7.6
- 2024-08-01 [CVE-2024-39274](https://erroneo.us/security/cve/CVE-2024-39274/index.md) Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel — github.com/mattermost/mattermost/server/v8 >= 9.5.0, < 9.5.7 → 9.5.7; github.com/mattermost/mattermost/server/v8 >= 9.7.0, < 9.7.6 → 9.7.6; github.com/mattermost/mattermost/server/v8 >= 9.8.0, < 9.8.2 → 9.8.2
- 2024-07-30 [GHSA-wm25-j4gw-6vr3](https://erroneo.us/security/ghsa/GHSA-wm25-j4gw-6vr3/index.md) pREST vulnerable to jwt bypass + sql injection — github.com/prest/prest < 1.5.4 → 1.5.4
- 2024-07-30 [CVE-2024-41110](https://erroneo.us/security/cve/CVE-2024-41110/index.md) Authz zero length regression — github.com/docker/docker >= 24.0.0, < 25.0.6 → 25.0.6; github.com/docker/docker >= 19.03.0, < 23.0.15 → 23.0.15; github.com/docker/docker >= 26.0.0, < 26.1.5 → 26.1.5
- 2024-07-24 [CVE-2024-36536](https://erroneo.us/security/cve/CVE-2024-36536/index.md) fabedge has insecure permissions — github.com/fabedge/fabedge <= 0.8.1 → no fix
- 2024-07-24 [CVE-2024-36533](https://erroneo.us/security/cve/CVE-2024-36533/index.md) Volcano has insecure permissions — github.com/volcano-sh/volcano < 1.10.0-alpha.0 → 1.10.0-alpha.0; volcano.sh/volcano < 1.10.0-alpha.0 → 1.10.0-alpha.0
- 2024-07-18 [CVE-2024-39907](https://erroneo.us/security/cve/CVE-2024-39907/index.md) 1Panel has an SQL injection issue related to the orderBy clause — github.com/1Panel-dev/1Panel < 1.10.12-tls → 1.10.12-tls
- 2024-07-03 [CVE-2024-39223](https://erroneo.us/security/cve/CVE-2024-39223/index.md) Missing key verification in gost — github.com/ginuerzh/gost <= 2.11.5 → no fix
- 2024-07-01 [CVE-2024-38513](https://erroneo.us/security/cve/CVE-2024-38513/index.md) Session Middleware Token Injection Vulnerability — github.com/gofiber/fiber <= 2.52.4 → 2.52.5; github.com/gofiber/fiber/v2 <= 2.52.4 → 2.52.5; github.com/gofiber/fiber/v2/middleware/session <= 2.52.4 → 2.52.5
- 2024-06-28 [CVE-2019-25211](https://erroneo.us/security/cve/CVE-2019-25211/index.md) Gin mishandles a wildcard at the end of an origin string — github.com/gin-gonic/gin < 1.6.0 → 1.6.0; github.com/gin-contrib/cors < 1.6.0 → 1.6.0
- 2024-06-17 [CVE-2023-32191](https://erroneo.us/security/cve/CVE-2023-32191/index.md) rke's credentials are stored in the RKE1 Cluster state ConfigMap — github.com/rancher/rke >= 1.4.18, < 1.4.19 → 1.4.19; github.com/rancher/rke >= 1.5.9, < 1.5.10 → 1.5.10
- 2024-06-04 [CVE-2024-5262](https://erroneo.us/security/cve/CVE-2024-5262/index.md) Files or Directories Accessible to External Parties in ProjectDiscovery — github.com/projectdiscovery/interactsh < 1.2.0 → 1.2.0
- 2024-05-21 [CVE-2024-31989](https://erroneo.us/security/cve/CVE-2024-31989/index.md) ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache — github.com/argoproj/argo-cd/v2 < 2.8.19 → 2.8.19; github.com/argoproj/argo-cd/v2 >= 2.9.0-rc1, < 2.9.15 → 2.9.15; github.com/argoproj/argo-cd/v2 >= 2.10.0-rc1, < 2.10.10 → 2.10.10
- 2024-05-14 [CVE-2022-39328](https://erroneo.us/security/cve/CVE-2022-39328/index.md) Grafana Race condition allowing privilege escalation — github.com/grafana/grafana >= 9.2.0, < 9.2.4 → 9.2.4
- 2024-05-14 [CVE-2021-41244](https://erroneo.us/security/cve/CVE-2021-41244/index.md) Grafana Fine-grained access control vulnerability — github.com/grafana/grafana >= 8.0.0, < 8.2.4 → 8.2.4
- 2024-05-07 [CVE-2024-33434](https://erroneo.us/security/cve/CVE-2024-33434/index.md) tiagorlampert CHAOS vulnerable to arbitrary code execution — github.com/tiagorlampert/CHAOS < 0.0.0-20220716132853-b47438d36e3a → 0.0.0-20220716132853-b47438d36e3a
- 2024-05-03 [GHSA-vhxv-fg4m-p2w8](https://erroneo.us/security/ghsa/GHSA-vhxv-fg4m-p2w8/index.md) Some CORS middleware allow untrusted origins — github.com/jub0bs/cors < 0.1.3 → 0.1.3
- 2024-05-03 [GHSA-v84h-653v-4pq9](https://erroneo.us/security/ghsa/GHSA-v84h-653v-4pq9/index.md) Some CORS middleware allow untrusted origins — github.com/jub0bs/fcors <= 0.8.0 → 0.9.0
- 2024-04-24 [CVE-2020-28991](https://erroneo.us/security/cve/CVE-2020-28991/index.md) Improper Access Control in Gitea — github.com/go-gitea/gitea >= 0.9.99, < 1.12.6 → 1.12.6
- 2024-04-24 [CVE-2020-14316](https://erroneo.us/security/cve/CVE-2020-14316/index.md) Privilege Escalation in kubevirt — kubevirt.io/kubevirt < 0.30.0 → 0.30.0
- 2024-04-17 [GHSA-v6rw-hhgg-wc4x](https://erroneo.us/security/ghsa/GHSA-v6rw-hhgg-wc4x/index.md) Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit — github.com/evmos/evmos/v11 < 12.0.0 → 12.0.0
- 2024-04-17 [CVE-2024-3817](https://erroneo.us/security/cve/CVE-2024-3817/index.md) HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches — github.com/hashicorp/go-getter >= 1.5.9, < 1.7.4 → 1.7.4
- 2024-04-10 [CVE-2024-2029](https://erroneo.us/security/cve/CVE-2024-2029/index.md) LocalAI Command Injection in audioToWav — github.com/go-skynet/LocalAI < 2.10.0 → 2.10.0
- 2024-04-10 [CVE-2024-32644](https://erroneo.us/security/cve/CVE-2024-32644/index.md) Evmos transaction execution not accounting for all state transition after interaction with precompiles — github.com/evmos/evmos/v16 <= 16.0.4 → 17.0.0; github.com/evmos/evmos/v7 <= 7.0.0 → no fix; github.com/evmos/evmos/v6 <= 6.0.4 → no fix
- 2024-04-05 [GHSA-j496-crgh-34mx](https://erroneo.us/security/ghsa/GHSA-j496-crgh-34mx/index.md) ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks — github.com/cosmos/ibc-go/v4 < 4.6.0 → 4.6.0; github.com/cosmos/ibc-go/v5 < 5.4.0 → 5.4.0; github.com/cosmos/ibc-go/v6 < 6.3.0 → 6.3.0
- 2024-03-18 [CVE-2024-21652](https://erroneo.us/security/cve/CVE-2024-21652/index.md) Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss — github.com/argoproj/argo-cd/v2 < 2.8.13 → 2.8.13; github.com/argoproj/argo-cd/v2 >= 2.9.0, < 2.9.9 → 2.9.9; github.com/argoproj/argo-cd/v2 >= 2.10.0, < 2.10.4 → 2.10.4
- 2024-03-15 [CVE-2024-28175](https://erroneo.us/security/cve/CVE-2024-28175/index.md) Cross-site scripting on application summary component — github.com/argoproj/argo-cd/v2 >= 2.9.0, < 2.9.8 → 2.9.8; github.com/argoproj/argo-cd/v2 >= 2.10.0, < 2.10.3 → 2.10.3; github.com/argoproj/argo-cd/v2 >= 2.0.0, < 2.8.12 → 2.8.12
- 2024-03-15 [CVE-2024-27102](https://erroneo.us/security/cve/CVE-2024-27102/index.md) Pterodactyl Wings vulnerable to improper isolation of server file access — github.com/pterodactyl/wings < 1.11.9 → 1.11.9
- 2024-03-04 [CVE-2024-27302](https://erroneo.us/security/cve/CVE-2024-27302/index.md) Authorization Bypass Through User-Controlled Key in go-zero — github.com/zeromicro/go-zero < 1.4.4 → 1.4.4
- 2024-02-27 [GHSA-x5r5-2qrx-rqj8](https://erroneo.us/security/ghsa/GHSA-x5r5-2qrx-rqj8/index.md) Transparent TLS may not be applied to Marbles with certain manifest configurations — github.com/edgelesssys/marblerun < 1.4.1 → 1.4.1
- 2024-02-22 [CVE-2024-25124](https://erroneo.us/security/cve/CVE-2024-25124/index.md) Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials — github.com/gofiber/fiber/v2 < 2.52.1 → 2.52.1
- 2024-01-31 [CVE-2024-23653](https://erroneo.us/security/cve/CVE-2024-23653/index.md) Buildkit's interactive containers API does not validate entitlements check — github.com/moby/buildkit < 0.12.5 → 0.12.5
- 2024-01-31 [CVE-2024-23652](https://erroneo.us/security/cve/CVE-2024-23652/index.md) BuildKit vulnerable to possible host system access from mount stub cleaner — github.com/moby/buildkit < 0.12.5 → 0.12.5
- 2024-01-30 [CVE-2020-10661](https://erroneo.us/security/cve/CVE-2020-10661/index.md) HashiCorp Vault Improper Privilege Management — github.com/hashicorp/vault >= 0.11.0, < 1.3.4 → 1.3.4
- 2024-01-29 [CVE-2024-23827](https://erroneo.us/security/cve/CVE-2024-23827/index.md) Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature — github.com/0xJacky/Nginx-UI < 1.9.10-0.20240128060047-8581bdd3c6f4 → 1.9.10-0.20240128060047-8581bdd3c6f4
- 2024-01-11 [CVE-2024-22199](https://erroneo.us/security/cve/CVE-2024-22199/index.md) Django Template Engine Vulnerable to XSS — github.com/gofiber/template/django/v3 < 3.1.9 → 3.1.9
- 2024-01-10 [CVE-2023-49569](https://erroneo.us/security/cve/CVE-2023-49569/index.md) Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients — github.com/go-git/go-git/v5 >= 5.0.0, < 5.11.0 → 5.11.0; gopkg.in/src-d/go-git.v4 >= 4.0.0, <= 4.13.1 → no fix
- 2024-01-08 [CVE-2022-3328](https://erroneo.us/security/cve/CVE-2022-3328/index.md) snapd Race Condition vulnerability — github.com/snapcore/snapd < 2.57.6 → 2.57.6
- 2023-12-13 [CVE-2023-50424](https://erroneo.us/security/cve/CVE-2023-50424/index.md) Improper Privilege Management in github.com/sap/cloud-security-client-go — github.com/sap/cloud-security-client-go < 0.17.0 → 0.17.0
- 2023-11-24 [CVE-2023-48312](https://erroneo.us/security/cve/CVE-2023-48312/index.md) Capsule Proxy Authentication bypass using an empty token — github.com/projectcapsule/capsule-proxy <= 0.4.5 → 0.4.6; github.com/clastix/capsule-proxy <= 0.4.5 → 0.4.6
- 2023-11-24 [CVE-2023-46575](https://erroneo.us/security/cve/CVE-2023-46575/index.md) SQL injection vulnerability in Meshery — github.com/layer5io/meshery < 0.6.179 → 0.6.179
- 2023-10-17 [CVE-2023-45128](https://erroneo.us/security/cve/CVE-2023-45128/index.md) CSRF Token Reuse Vulnerability — github.com/gofiber/fiber/v2 < 2.50.0 → 2.50.0
- 2023-10-17 [GHSA-7p92-x423-vwj6](https://erroneo.us/security/ghsa/GHSA-7p92-x423-vwj6/index.md) Plonk verifier KZG multi point verification — github.com/consensys/gnark < 0.9.1 → 0.9.1
- 2023-10-06 [CVE-2023-32188](https://erroneo.us/security/cve/CVE-2023-32188/index.md) JWT token compromise can allow malicious actions including Remote Code Execution (RCE) — github.com/neuvector/neuvector < 0.0.0-20230930010431-57d107118e92 → 0.0.0-20231003121714-be746957ee7c

Pages: https://erroneo.us/security/ecosystem/go/index.md · https://erroneo.us/security/ecosystem/go/2/index.md · https://erroneo.us/security/ecosystem/go/3/index.md · https://erroneo.us/security/ecosystem/go/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/go/4/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt