Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2024-3283
- CVE-2024-52309
- Affects: github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2
- Published: Nov 21, 2024
SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo
GO-2024-3282
- GHSA-r4pg-vg54-wxx4
- Affects: github.com/cert-manager/cert-manager
- Published: Nov 21, 2024
cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager
GO-2024-3281
- CVE-2024-52280, GHSA-j5hq-5jcr-xwx7
- Affects: github.com/rancher/steve
- Published: Nov 21, 2024
github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
GO-2024-3280
- CVE-2024-52282, GHSA-9c5p-35gj-jqp4
- Affects: github.com/rancher/rancher
- Published: Nov 21, 2024
Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/rancher/rancher from v2.8.0 before v2.8.10, from v2.9.0 before v2.9.4.
GO-2024-3279
- GHSA-7225-m954-23v7
- Affects: cosmossdk.io/math
- Published: Nov 21, 2024
ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.