data/reports: add 51 reports - data/reports/GO-2026-5069.yaml - data/reports/GO-2026-5074.yaml - data/reports/GO-2026-5105.yaml - data/reports/GO-2026-5158.yaml - data/reports/GO-2026-5198.yaml - data/reports/GO-2026-5208.yaml - data/reports/GO-2026-5266.yaml - data/reports/GO-2026-5309.yaml - data/reports/GO-2026-5327.yaml - data/reports/GO-2026-5336.yaml - data/reports/GO-2026-5346.yaml - data/reports/GO-2026-5408.yaml - data/reports/GO-2026-5426.yaml - data/reports/GO-2026-5435.yaml - data/reports/GO-2026-5452.yaml - data/reports/GO-2026-5463.yaml - data/reports/GO-2026-5471.yaml - data/reports/GO-2026-5490.yaml - data/reports/GO-2026-5492.yaml - data/reports/GO-2026-5506.yaml - data/reports/GO-2026-5525.yaml - data/reports/GO-2026-5543.yaml - data/reports/GO-2026-5548.yaml - data/reports/GO-2026-5566.yaml - data/reports/GO-2026-5569.yaml - data/reports/GO-2026-5585.yaml - data/reports/GO-2026-5593.yaml - data/reports/GO-2026-5595.yaml - data/reports/GO-2026-5597.yaml - data/reports/GO-2026-5606.yaml - data/reports/GO-2026-5660.yaml - data/reports/GO-2026-5666.yaml - data/reports/GO-2026-5684.yaml - data/reports/GO-2026-5693.yaml - data/reports/GO-2026-5730.yaml - data/reports/GO-2026-5736.yaml - data/reports/GO-2026-5740.yaml - data/reports/GO-2026-5774.yaml - data/reports/GO-2026-5775.yaml - data/reports/GO-2026-5777.yaml - data/reports/GO-2026-5879.yaml - data/reports/GO-2026-5880.yaml - data/reports/GO-2026-5882.yaml - data/reports/GO-2026-5884.yaml - data/reports/GO-2026-5885.yaml - data/reports/GO-2026-5886.yaml - data/reports/GO-2026-5887.yaml - data/reports/GO-2026-5912.yaml - data/reports/GO-2026-5954.yaml - data/reports/GO-2026-5955.yaml - data/reports/GO-2026-5971.yaml Fixes golang/vulndb#5069 Fixes golang/vulndb#5074 Fixes golang/vulndb#5105 Fixes golang/vulndb#5158 Fixes golang/vulndb#5198 Fixes golang/vulndb#5208 Fixes golang/vulndb#5266 Fixes golang/vulndb#5309 Fixes golang/vulndb#5327 Fixes golang/vulndb#5336 Fixes golang/vulndb#5346 Fixes golang/vulndb#5408 Fixes golang/vulndb#5426 Fixes golang/vulndb#5435 Fixes golang/vulndb#5452 Fixes golang/vulndb#5463 Fixes golang/vulndb#5471 Fixes golang/vulndb#5490 Fixes golang/vulndb#5492 Fixes golang/vulndb#5506 Fixes golang/vulndb#5525 Fixes golang/vulndb#5543 Fixes golang/vulndb#5548 Fixes golang/vulndb#5566 Fixes golang/vulndb#5569 Fixes golang/vulndb#5585 Fixes golang/vulndb#5593 Fixes golang/vulndb#5595 Fixes golang/vulndb#5597 Fixes golang/vulndb#5606 Fixes golang/vulndb#5660 Fixes golang/vulndb#5666 Fixes golang/vulndb#5684 Fixes golang/vulndb#5693 Fixes golang/vulndb#5730 Fixes golang/vulndb#5736 Fixes golang/vulndb#5740 Fixes golang/vulndb#5774 Fixes golang/vulndb#5775 Fixes golang/vulndb#5777 Fixes golang/vulndb#5879 Fixes golang/vulndb#5880 Fixes golang/vulndb#5882 Fixes golang/vulndb#5884 Fixes golang/vulndb#5885 Fixes golang/vulndb#5886 Fixes golang/vulndb#5887 Fixes golang/vulndb#5912 Fixes golang/vulndb#5954 Fixes golang/vulndb#5955 Fixes golang/vulndb#5971 Change-Id: I0acb616f56d8f400de1b593ffef5df191ea52c19 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/805120 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ethan Lee <ethanalee@google.com>
diff --git a/data/osv/GO-2026-5069.json b/data/osv/GO-2026-5069.json new file mode 100644 index 0000000..de51d6e --- /dev/null +++ b/data/osv/GO-2026-5069.json
@@ -0,0 +1,61 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5069", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-30246", + "GHSA-35hp-hqmv-8qg8" + ], + "summary": "Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber", + "details": "Fiber: Cache middleware key generator ignores query string in github.com/gofiber/fiber", + "affected": [ + { + "package": { + "name": "github.com/gofiber/fiber/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gofiber/fiber/v3/middleware/cache", + "symbols": [ + "New" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8" + }, + { + "type": "FIX", + "url": "https://github.com/gofiber/fiber/commit/050ff1ff18511c1475b8ec627460216aaecddd4e" + }, + { + "type": "FIX", + "url": "https://github.com/gofiber/fiber/commit/9a0d12c07ed895b84c72987f9288b04137afe5de" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5069", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5074.json b/data/osv/GO-2026-5074.json new file mode 100644 index 0000000..9f6dc10 --- /dev/null +++ b/data/osv/GO-2026-5074.json
@@ -0,0 +1,89 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5074", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-45022", + "GHSA-389r-gv7p-r3rp" + ], + "summary": "Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git", + "details": "Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git", + "affected": [ + { + "package": { + "name": "github.com/go-git/go-git/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-git/v5/plumbing/object", + "symbols": [ + "Commit.Decode", + "Commit.IsAncestor", + "Commit.MergeBase", + "Commit.Parent", + "Commit.Stats", + "Commit.StatsContext", + "DecodeCommit", + "DecodeObject", + "DecodeTag", + "GetCommit", + "GetObject", + "GetTag", + "Independents", + "NewCommitAllIter", + "ObjectIter.Next", + "Tag.Commit", + "Tag.Decode", + "Tag.Object", + "Tag.String", + "Tag.Tree", + "TagIter.Next", + "bfsCommitIterator.ForEach", + "bfsCommitIterator.Next", + "commitIteratorByCTime.ForEach", + "commitIteratorByCTime.Next", + "commitPostIterator.ForEach", + "commitPostIterator.Next", + "commitPreIterator.ForEach", + "commitPreIterator.Next", + "filterCommitIter.ForEach", + "filterCommitIter.Next", + "storerCommitIter.ForEach", + "storerCommitIter.Next" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp" + }, + { + "type": "WEB", + "url": "https://github.com/go-git/go-git/releases/tag/v5.19.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5074", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5105.json b/data/osv/GO-2026-5105.json new file mode 100644 index 0000000..588f6f7 --- /dev/null +++ b/data/osv/GO-2026-5105.json
@@ -0,0 +1,57 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5105", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-41506", + "GHSA-3xc5-wrhm-f963" + ], + "summary": "Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git", + "details": "Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git", + "affected": [ + { + "package": { + "name": "github.com/go-git/go-git/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.18.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-git/v5/plumbing/transport/http", + "symbols": [ + "NewClient" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963" + }, + { + "type": "WEB", + "url": "https://github.com/go-git/go-git/releases/tag/v5.18.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5105", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5158.json b/data/osv/GO-2026-5158.json new file mode 100644 index 0000000..4bd79d2 --- /dev/null +++ b/data/osv/GO-2026-5158.json
@@ -0,0 +1,70 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5158", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-41178", + "GHSA-5wrp-cwcj-q835" + ], + "summary": "Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel", + "details": "Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel", + "affected": [ + { + "package": { + "name": "go.opentelemetry.io/otel", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "1.41.0" + }, + { + "fixed": "1.42.0" + }, + { + "introduced": "1.43.0" + }, + { + "fixed": "1.44.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "go.opentelemetry.io/otel/baggage", + "symbols": [ + "New", + "Parse" + ] + }, + { + "path": "go.opentelemetry.io/otel/propagation", + "symbols": [ + "Baggage.Extract" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835" + }, + { + "type": "WEB", + "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5158", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5198.json b/data/osv/GO-2026-5198.json new file mode 100644 index 0000000..978d805 --- /dev/null +++ b/data/osv/GO-2026-5198.json
@@ -0,0 +1,59 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5198", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-41642", + "GHSA-7235-89m6-f4px" + ], + "summary": "GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute in github.com/osrg/gobgp", + "details": "GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute in github.com/osrg/gobgp", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.4.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v4/pkg/server", + "symbols": [ + "BgpServer.AddPeer", + "NewBgpServer", + "server.AddPeer" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px" + }, + { + "type": "WEB", + "url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5198", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5208.json b/data/osv/GO-2026-5208.json new file mode 100644 index 0000000..50ef1b6 --- /dev/null +++ b/data/osv/GO-2026-5208.json
@@ -0,0 +1,57 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5208", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-40890", + "GHSA-77fj-vx54-gvh7" + ], + "summary": "Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown", + "details": "Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown", + "affected": [ + { + "package": { + "name": "github.com/gomarkdown/markdown", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20260411013819-759bbc3e3207" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gomarkdown/markdown/html", + "symbols": [ + "NewRenderer" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7" + }, + { + "type": "FIX", + "url": "https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5208", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5266.json b/data/osv/GO-2026-5266.json new file mode 100644 index 0000000..5174428 --- /dev/null +++ b/data/osv/GO-2026-5266.json
@@ -0,0 +1,59 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5266", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-41643", + "GHSA-8rxh-r2p6-7f2q" + ], + "summary": "GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp", + "details": "GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE in github.com/osrg/gobgp", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v4/pkg/server", + "symbols": [ + "BgpServer.AddPeer", + "NewBgpServer", + "server.AddPeer" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q" + }, + { + "type": "WEB", + "url": "https://github.com/osrg/gobgp/releases/tag/v4.3.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5266", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5309.json b/data/osv/GO-2026-5309.json new file mode 100644 index 0000000..ab75844 --- /dev/null +++ b/data/osv/GO-2026-5309.json
@@ -0,0 +1,56 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5309", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-c3wq-j5vh-68rc" + ], + "summary": "Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo", + "details": "Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo", + "affected": [ + { + "package": { + "name": "github.com/gohugoio/hugo", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0.123.0" + }, + { + "fixed": "0.163.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gohugoio/hugo/tpl/os", + "symbols": [ + "Namespace.ReadFile" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc" + }, + { + "type": "WEB", + "url": "https://github.com/gohugoio/hugo/releases/tag/v0.163.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5309", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5327.json b/data/osv/GO-2026-5327.json new file mode 100644 index 0000000..6024e53 --- /dev/null +++ b/data/osv/GO-2026-5327.json
@@ -0,0 +1,86 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5327", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-2303", + "GHSA-cp6g-7hqx-qxhp" + ], + "summary": "Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver", + "details": "Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver", + "affected": [ + { + "package": { + "name": "go.mongodb.org/mongo-driver", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.17.7" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "go.mongodb.org/mongo-driver/mongo", + "symbols": [ + "Connect" + ] + } + ] + } + }, + { + "package": { + "name": "go.mongodb.org/mongo-driver/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.2" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "go.mongodb.org/mongo-driver/v2/mongo", + "symbols": [ + "Connect" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-cp6g-7hqx-qxhp" + }, + { + "type": "WEB", + "url": "https://jira.mongodb.org/browse/GODRIVER-3770" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5327", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5336.json b/data/osv/GO-2026-5336.json new file mode 100644 index 0000000..7a57f76 --- /dev/null +++ b/data/osv/GO-2026-5336.json
@@ -0,0 +1,67 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5336", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-45571", + "GHSA-crhj-59gh-8x96" + ], + "summary": "Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git", + "details": "Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git", + "affected": [ + { + "package": { + "name": "github.com/go-git/go-git/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-git/v5", + "symbols": [ + "Clone", + "CloneContext", + "PlainClone", + "PlainCloneContext", + "Submodule.Update", + "Submodule.UpdateContext", + "Submodules.Update", + "Submodules.UpdateContext", + "Worktree.Checkout", + "Worktree.Pull", + "Worktree.PullContext" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96" + }, + { + "type": "WEB", + "url": "https://github.com/go-git/go-git/releases/tag/v5.19.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5336", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5346.json b/data/osv/GO-2026-5346.json new file mode 100644 index 0000000..530fc82 --- /dev/null +++ b/data/osv/GO-2026-5346.json
@@ -0,0 +1,73 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5346", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-52845", + "GHSA-f59h-q822-g45g" + ], + "summary": "Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy", + "details": "Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy", + "affected": [ + { + "package": { + "name": "github.com/caddyserver/caddy/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy/fastcgi", + "symbols": [ + "Transport.Provision", + "Transport.RoundTrip", + "Transport.UnmarshalCaddyfile", + "client.Do", + "client.Get", + "client.Head", + "client.Options", + "client.Post", + "client.PostFile", + "client.PostForm", + "client.Request", + "clientCloser.Close", + "record.Read", + "streamReader.Read", + "streamWriter.Flush", + "streamWriter.FlushStream", + "streamWriter.Write" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g" + }, + { + "type": "FIX", + "url": "https://github.com/caddyserver/caddy/pull/7633" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5346", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5408.json b/data/osv/GO-2026-5408.json new file mode 100644 index 0000000..59d249a --- /dev/null +++ b/data/osv/GO-2026-5408.json
@@ -0,0 +1,61 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5408", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-gx7w-56w6-g48x" + ], + "summary": "Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy", + "details": "Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy", + "affected": [ + { + "package": { + "name": "github.com/caddyserver/caddy/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.3" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/caddyserver/caddy/v2/modules/caddypki", + "symbols": [ + "CA.NewAuthority", + "CA.Provision", + "CA.RootKey", + "KeyPair.Load", + "PKI.CaddyModule", + "PKI.GetCA", + "PKI.Provision", + "PKI.ProvisionDefaultCA", + "PKI.Start", + "adminAPI.Provision" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-gx7w-56w6-g48x" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5408", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5426.json b/data/osv/GO-2026-5426.json new file mode 100644 index 0000000..993261b --- /dev/null +++ b/data/osv/GO-2026-5426.json
@@ -0,0 +1,57 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5426", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-39883", + "GHSA-hfvc-g4fc-pqhx" + ], + "summary": "Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk", + "details": "Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk", + "affected": [ + { + "package": { + "name": "go.opentelemetry.io/otel/sdk", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "1.15.0" + }, + { + "fixed": "1.43.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "go.opentelemetry.io/otel/sdk/resource", + "symbols": [ + "New" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx" + }, + { + "type": "WEB", + "url": "http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5426", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5435.json b/data/osv/GO-2026-5435.json new file mode 100644 index 0000000..0bcdbcd --- /dev/null +++ b/data/osv/GO-2026-5435.json
@@ -0,0 +1,62 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5435", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-35206", + "GHSA-hr2v-4r36-88hr" + ], + "summary": "Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm", + "details": "Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm", + "affected": [ + { + "package": { + "name": "helm.sh/helm/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.20.2" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "helm.sh/helm/v3/pkg/chartutil", + "symbols": [ + "Expand", + "ExpandFile" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr" + }, + { + "type": "FIX", + "url": "https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436" + }, + { + "type": "WEB", + "url": "https://github.com/helm/helm/releases/tag/v4.1.4" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5435", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5452.json b/data/osv/GO-2026-5452.json new file mode 100644 index 0000000..248261f --- /dev/null +++ b/data/osv/GO-2026-5452.json
@@ -0,0 +1,58 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5452", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-34783", + "GHSA-j6v5-g24h-vg4j" + ], + "summary": "Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write in github.com/MontFerret/ferret", + "details": "Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write in github.com/MontFerret/ferret", + "affected": [ + { + "package": { + "name": "github.com/MontFerret/ferret/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.0-alpha.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/MontFerret/ferret/v2/pkg/stdlib/io/fs", + "symbols": [ + "Read", + "Write" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j" + }, + { + "type": "FIX", + "url": "https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5452", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5463.json b/data/osv/GO-2026-5463.json new file mode 100644 index 0000000..c8a2c19 --- /dev/null +++ b/data/osv/GO-2026-5463.json
@@ -0,0 +1,70 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5463", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-8276", + "GHSA-jcqv-2g3v-gm88" + ], + "summary": "Bettercap has an integer coercion error in modules/mysql_server/mysql_server.go in github.com/bettercap/bettercap", + "details": "Bettercap has an integer coercion error in modules/mysql_server/mysql_server.go in github.com/bettercap/bettercap", + "affected": [ + { + "package": { + "name": "github.com/bettercap/bettercap/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.41.7" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/bettercap/bettercap/v2/modules/mysql_server", + "symbols": [ + "MySQLServer.Start", + "MySQLServer.Stop" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-jcqv-2g3v-gm88" + }, + { + "type": "FIX", + "url": "https://github.com/bettercap/bettercap/commit/0eaa375c5e5446bfba94a290eff92967a5deac9e" + }, + { + "type": "FIX", + "url": "https://github.com/bettercap/bettercap/pull/1266" + }, + { + "type": "REPORT", + "url": "https://github.com/bettercap/bettercap/issues/1265" + }, + { + "type": "WEB", + "url": "https://github.com/bettercap/bettercap/releases/tag/v2.41.7" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5463", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5471.json b/data/osv/GO-2026-5471.json new file mode 100644 index 0000000..d8da0c5 --- /dev/null +++ b/data/osv/GO-2026-5471.json
@@ -0,0 +1,58 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5471", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-6993", + "GHSA-jj45-xvq5-rhh9" + ], + "summary": "Kratos has a Confused Deputy issue in github.com/go-kratos/kratos", + "details": "Kratos has a Confused Deputy issue in github.com/go-kratos/kratos", + "affected": [ + { + "package": { + "name": "github.com/go-kratos/kratos/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-kratos/kratos/v2/transport/http", + "symbols": [ + "Server.ServeHTTP" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-jj45-xvq5-rhh9" + }, + { + "type": "FIX", + "url": "https://github.com/go-kratos/kratos/pull/3814" + }, + { + "type": "REPORT", + "url": "https://github.com/go-kratos/kratos/issues/3810" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5471", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5490.json b/data/osv/GO-2026-5490.json new file mode 100644 index 0000000..994fdc0 --- /dev/null +++ b/data/osv/GO-2026-5490.json
@@ -0,0 +1,68 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5490", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-44740", + "GHSA-m3xc-h892-ggx6" + ], + "summary": "Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy", + "details": "Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy", + "affected": [ + { + "package": { + "name": "github.com/go-git/go-billy/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.9.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-billy/v5/util", + "symbols": [ + "Walk" + ] + }, + { + "path": "github.com/go-git/go-billy/v5/helper/chroot", + "symbols": [ + "ChrootHelper.Chroot", + "New" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6" + }, + { + "type": "FIX", + "url": "https://github.com/go-git/go-billy/pull/203" + }, + { + "type": "WEB", + "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5490", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5492.json b/data/osv/GO-2026-5492.json new file mode 100644 index 0000000..f83cc5f --- /dev/null +++ b/data/osv/GO-2026-5492.json
@@ -0,0 +1,81 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5492", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-45135", + "GHSA-m675-2p33-xv9g" + ], + "summary": "Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy", + "details": "Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy", + "affected": [ + { + "package": { + "name": "github.com/caddyserver/caddy/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.7.0" + }, + { + "fixed": "2.11.3" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy/fastcgi", + "symbols": [ + "Transport.Provision", + "Transport.RoundTrip", + "Transport.UnmarshalCaddyfile", + "client.Do", + "client.Get", + "client.Head", + "client.Options", + "client.Post", + "client.PostFile", + "client.PostForm", + "client.Request", + "clientCloser.Close", + "record.Read", + "streamReader.Read", + "streamWriter.Flush", + "streamWriter.FlushStream", + "streamWriter.Write" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g" + }, + { + "type": "FIX", + "url": "https://github.com/caddyserver/caddy/pull/7629" + }, + { + "type": "WEB", + "url": "https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm" + }, + { + "type": "WEB", + "url": "https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5492", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5506.json b/data/osv/GO-2026-5506.json new file mode 100644 index 0000000..035f3cc --- /dev/null +++ b/data/osv/GO-2026-5506.json
@@ -0,0 +1,88 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5506", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-29181", + "GHSA-mh2q-q3fh-2475" + ], + "summary": "OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel", + "details": "OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel", + "affected": [ + { + "package": { + "name": "go.opentelemetry.io/otel", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "1.36.0" + }, + { + "fixed": "1.41.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "go.opentelemetry.io/otel/internal/global", + "symbols": [ + "Debug", + "ErrDelegator.Handle", + "Error", + "GetErrorHandler", + "Info", + "SetErrorHandler", + "SetMeterProvider", + "SetTextMapPropagator", + "SetTracerProvider", + "Warn", + "textMapPropagator.SetDelegate" + ] + }, + { + "path": "go.opentelemetry.io/otel/baggage", + "symbols": [ + "New", + "Parse" + ] + }, + { + "path": "go.opentelemetry.io/otel/propagation", + "symbols": [ + "Baggage.Extract" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475" + }, + { + "type": "FIX", + "url": "https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f" + }, + { + "type": "WEB", + "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880" + }, + { + "type": "WEB", + "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5506", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5525.json b/data/osv/GO-2026-5525.json new file mode 100644 index 0000000..647e22f --- /dev/null +++ b/data/osv/GO-2026-5525.json
@@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5525", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-42285", + "GHSA-p3w2-64xm-833j" + ], + "summary": "GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp", + "details": "GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.5.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v4/pkg/server", + "symbols": [ + "BgpServer.AddPeer", + "NewBgpServer", + "server.AddPeer" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j" + }, + { + "type": "FIX", + "url": "https://github.com/osrg/gobgp/commit/d2d2be3e4e7915d407e662e5d388d9f8ae8a8f7b" + }, + { + "type": "WEB", + "url": "https://github.com/osrg/gobgp/releases/tag/v4.5.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5525", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5543.json b/data/osv/GO-2026-5543.json new file mode 100644 index 0000000..ebfda12 --- /dev/null +++ b/data/osv/GO-2026-5543.json
@@ -0,0 +1,61 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5543", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-32952", + "GHSA-pjcq-xvwq-hhpj" + ], + "summary": "Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp", + "details": "Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp", + "affected": [ + { + "package": { + "name": "github.com/Azure/go-ntlmssp", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/Azure/go-ntlmssp", + "symbols": [ + "ProcessChallenge" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj" + }, + { + "type": "FIX", + "url": "https://github.com/Azure/go-ntlmssp/commit/bd8579c18d41bf5d91a5f74b1117c958f635b866" + }, + { + "type": "WEB", + "url": "https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5543", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5548.json b/data/osv/GO-2026-5548.json new file mode 100644 index 0000000..27f0326 --- /dev/null +++ b/data/osv/GO-2026-5548.json
@@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5548", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-44166", + "GHSA-pq7p-mc74-g65w" + ], + "summary": "PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in github.com/pocketbase/pocketbase", + "details": "PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in github.com/pocketbase/pocketbase", + "affected": [ + { + "package": { + "name": "github.com/pocketbase/pocketbase", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.22.42" + }, + { + "introduced": "0.30.0" + }, + { + "fixed": "0.37.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/pocketbase/pocketbase/apis", + "symbols": [ + "Serve" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w" + }, + { + "type": "FIX", + "url": "https://github.com/pocketbase/pocketbase/commit/44bf55097af90c4c9dc240a8ea0d81923763a60e" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5548", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5566.json b/data/osv/GO-2026-5566.json new file mode 100644 index 0000000..42870e9 --- /dev/null +++ b/data/osv/GO-2026-5566.json
@@ -0,0 +1,65 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5566", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-35205", + "GHSA-q5jf-9vfq-h4h7" + ], + "summary": "Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm", + "details": "Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm", + "affected": [ + { + "package": { + "name": "helm.sh/helm/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.1.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "helm.sh/helm/v4/pkg/cmd", + "symbols": [ + "NewRootCmd" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7" + }, + { + "type": "FIX", + "url": "https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f" + }, + { + "type": "WEB", + "url": "https://github.com/helm/helm/releases/tag/v4.1.4" + }, + { + "type": "WEB", + "url": "https://helm.sh/docs/topics/provenance/#the-provenance-file" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5566", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5569.json b/data/osv/GO-2026-5569.json new file mode 100644 index 0000000..a6141f0 --- /dev/null +++ b/data/osv/GO-2026-5569.json
@@ -0,0 +1,60 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5569", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-q76j-gcg9-vxc6" + ], + "summary": "Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo", + "details": "Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo", + "affected": [ + { + "package": { + "name": "github.com/gohugoio/hugo", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0.60.0" + }, + { + "fixed": "0.163.3" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gohugoio/hugo/markup/highlight", + "symbols": [ + "WritePreStart", + "chromaHighlighter.Highlight", + "chromaHighlighter.HighlightCodeBlock", + "chromaHighlighter.RenderCodeblock", + "preWrapper.Start" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6" + }, + { + "type": "FIX", + "url": "https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5569", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5585.json b/data/osv/GO-2026-5585.json new file mode 100644 index 0000000..aec5178 --- /dev/null +++ b/data/osv/GO-2026-5585.json
@@ -0,0 +1,82 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5585", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-42554", + "GHSA-qjv7-627w-8qjv" + ], + "summary": "Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber", + "details": "Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber", + "affected": [ + { + "package": { + "name": "github.com/gofiber/fiber/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.52.13" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gofiber/fiber/v2", + "symbols": [ + "Ctx.Format" + ] + } + ] + } + }, + { + "package": { + "name": "github.com/gofiber/fiber/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gofiber/fiber/v3", + "symbols": [ + "DefaultRes.AutoFormat" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5585", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5593.json b/data/osv/GO-2026-5593.json new file mode 100644 index 0000000..93cdd93 --- /dev/null +++ b/data/osv/GO-2026-5593.json
@@ -0,0 +1,53 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5593", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-40611", + "GHSA-qqx8-2xmm-jrv8" + ], + "summary": "ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego", + "details": "ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego", + "affected": [ + { + "package": { + "name": "github.com/go-acme/lego/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.34.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-acme/lego/v4/providers/http/webroot", + "symbols": [ + "HTTPProvider.Present" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5593", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5595.json b/data/osv/GO-2026-5595.json new file mode 100644 index 0000000..2539fc5 --- /dev/null +++ b/data/osv/GO-2026-5595.json
@@ -0,0 +1,211 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5595", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-52844", + "GHSA-qrp7-cvwr-j2c6" + ], + "summary": "Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy", + "details": "Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy", + "affected": [ + { + "package": { + "name": "github.com/caddyserver/caddy/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver", + "symbols": [ + "FileServer.Provision", + "FileServer.ServeHTTP", + "FileServer.UnmarshalCaddyfile", + "MatchFile.Match", + "MatchFile.MatchWithError", + "MatchFile.Provision", + "MatchFile.UnmarshalCaddyfile", + "MatchFile.Validate", + "browseTemplateContext.HumanTotalFileSize", + "browseTemplateContext.HumanTotalFileSizeFollowingSymlinks", + "fileInfo.HasExt", + "fileInfo.HumanModTime", + "fileInfo.HumanSize", + "statusOverrideResponseWriter.WriteHeader" + ] + }, + { + "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp", + "symbols": [ + "App.Cleanup", + "App.Provision", + "App.Start", + "App.Stop", + "App.Validate", + "CELMatcherImpl", + "CELValueToMapStrList", + "CIDRExpressionToPrefix", + "Error", + "HandlerError.Error", + "HandlerFunc.ServeHTTP", + "Invoke.ServeHTTP", + "LoggableHTTPRequest.MarshalLogObject", + "LoggableTLSConnState.MarshalLogObject", + "MatchClientIP.CELLibrary", + "MatchClientIP.Match", + "MatchClientIP.MatchWithError", + "MatchClientIP.Provision", + "MatchClientIP.UnmarshalCaddyfile", + "MatchExpression.MarshalJSON", + "MatchExpression.Match", + "MatchExpression.MatchWithError", + "MatchExpression.Provision", + "MatchExpression.UnmarshalCaddyfile", + "MatchExpression.UnmarshalJSON", + "MatchHeader.CELLibrary", + "MatchHeader.Match", + "MatchHeader.MatchWithError", + "MatchHeader.UnmarshalCaddyfile", + "MatchHeaderRE.CELLibrary", + "MatchHeaderRE.Match", + "MatchHeaderRE.MatchWithError", + "MatchHeaderRE.Provision", + "MatchHeaderRE.UnmarshalCaddyfile", + "MatchHeaderRE.Validate", + "MatchHost.CELLibrary", + "MatchHost.Match", + "MatchHost.MatchWithError", + "MatchHost.Provision", + "MatchHost.UnmarshalCaddyfile", + "MatchMethod.CELLibrary", + "MatchMethod.UnmarshalCaddyfile", + "MatchNot.MarshalJSON", + "MatchNot.Match", + "MatchNot.MatchWithError", + "MatchNot.Provision", + "MatchNot.UnmarshalCaddyfile", + "MatchNot.UnmarshalJSON", + "MatchPath.CELLibrary", + "MatchPath.Match", + "MatchPath.MatchWithError", + "MatchPath.UnmarshalCaddyfile", + "MatchPathRE.CELLibrary", + "MatchPathRE.Match", + "MatchPathRE.MatchWithError", + "MatchProtocol.CELLibrary", + "MatchProtocol.Match", + "MatchProtocol.MatchWithError", + "MatchProtocol.UnmarshalCaddyfile", + "MatchQuery.CELLibrary", + "MatchQuery.Match", + "MatchQuery.MatchWithError", + "MatchQuery.UnmarshalCaddyfile", + "MatchRegexp.Match", + "MatchRegexp.Provision", + "MatchRegexp.UnmarshalCaddyfile", + "MatchRegexp.Validate", + "MatchRemoteIP.CELLibrary", + "MatchRemoteIP.Match", + "MatchRemoteIP.MatchWithError", + "MatchRemoteIP.Provision", + "MatchRemoteIP.UnmarshalCaddyfile", + "MatchTLS.UnmarshalCaddyfile", + "MatchVarsRE.CELLibrary", + "MatchVarsRE.Match", + "MatchVarsRE.MatchWithError", + "MatchVarsRE.Provision", + "MatchVarsRE.UnmarshalCaddyfile", + "MatchVarsRE.Validate", + "MatcherSet.Match", + "MatcherSet.MatchWithError", + "MatcherSets.AnyMatch", + "MatcherSets.AnyMatchWithError", + "MatcherSets.FromInterface", + "MatcherSets.String", + "ParseCaddyfileNestedMatcherSet", + "ParseNamedResponseMatcher", + "PrepareRequest", + "ResponseHandler.Provision", + "ResponseMatcher.Match", + "ResponseWriterWrapper.Push", + "ResponseWriterWrapper.ReadFrom", + "Route.Provision", + "Route.ProvisionHandlers", + "Route.ProvisionMatchers", + "Route.String", + "RouteList.Provision", + "RouteList.ProvisionHandlers", + "RouteList.ProvisionMatchers", + "Server.ServeHTTP", + "StaticError.ServeHTTP", + "StaticError.UnmarshalCaddyfile", + "StaticIPRange.Provision", + "StaticResponse.ServeHTTP", + "StaticResponse.UnmarshalCaddyfile", + "StringArray.UnmarshalJSON", + "Subroute.Provision", + "Subroute.ServeHTTP", + "VarsMatcher.CELLibrary", + "VarsMatcher.Match", + "VarsMatcher.MatchWithError", + "VarsMatcher.UnmarshalCaddyfile", + "VarsMiddleware.ServeHTTP", + "VarsMiddleware.UnmarshalCaddyfile", + "WeakString.MarshalJSON", + "WeakString.UnmarshalJSON", + "celHTTPRequest.Equal", + "celPkixName.ConvertToType", + "celPkixName.Equal", + "celTypeAdapter.NativeToValue", + "extraFieldsSlogHandler.Handle", + "extraFieldsSlogHandler.WithAttrs", + "hijackedConn.Read", + "hijackedConn.ReadFrom", + "hijackedConn.Write", + "hijackedConn.WriteTo", + "http2Conn.Read", + "http2Listener.Accept", + "httpRedirectConn.Read", + "httpRedirectListener.Accept", + "lengthReader.Close", + "lengthReader.Read", + "metricsInstrumentedRoute.ServeHTTP", + "requestID.String", + "responseRecorder.FlushError", + "responseRecorder.Hijack", + "responseRecorder.ReadFrom", + "responseRecorder.Write", + "responseRecorder.WriteHeader", + "responseRecorder.WriteResponse" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5595", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5597.json b/data/osv/GO-2026-5597.json new file mode 100644 index 0000000..10d15c8 --- /dev/null +++ b/data/osv/GO-2026-5597.json
@@ -0,0 +1,69 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5597", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-44973", + "GHSA-qw64-3x98-g7q2" + ], + "summary": "Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy", + "details": "Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy", + "affected": [ + { + "package": { + "name": "github.com/go-git/go-billy/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.9.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-billy/v5/osfs", + "symbols": [ + "BoundOS.Chroot", + "New" + ] + }, + { + "path": "github.com/go-git/go-billy/v5/helper/chroot", + "symbols": [ + "ChrootHelper.Chroot", + "New" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2" + }, + { + "type": "FIX", + "url": "https://github.com/go-git/go-billy/pull/205" + }, + { + "type": "WEB", + "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5597", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5606.json b/data/osv/GO-2026-5606.json new file mode 100644 index 0000000..71595be --- /dev/null +++ b/data/osv/GO-2026-5606.json
@@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5606", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-r46f-3rpw-hxrv" + ], + "summary": "Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo", + "details": "Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo", + "affected": [ + { + "package": { + "name": "github.com/gohugoio/hugo", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0.162.0" + }, + { + "fixed": "0.163.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gohugoio/hugo/tpl/os", + "symbols": [ + "Namespace.FileExists", + "Namespace.Stat" + ] + }, + { + "path": "github.com/gohugoio/hugo/config/security", + "symbols": [ + "Config.CheckAllowedHTTPURL" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv" + }, + { + "type": "FIX", + "url": "https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5606", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5660.json b/data/osv/GO-2026-5660.json new file mode 100644 index 0000000..c3bbcc7 --- /dev/null +++ b/data/osv/GO-2026-5660.json
@@ -0,0 +1,60 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5660", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-52846", + "GHSA-vcc4-2c75-vc9v" + ], + "summary": "Caddy: stripHTML template function bypass in github.com/caddyserver/caddy", + "details": "Caddy: stripHTML template function bypass in github.com/caddyserver/caddy", + "affected": [ + { + "package": { + "name": "github.com/caddyserver/caddy/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp/templates", + "symbols": [ + "TemplateContext.Cookie", + "TemplateContext.NewTemplate", + "Templates.Provision", + "Templates.ServeHTTP", + "Templates.Validate", + "WrappedHeader.Add", + "WrappedHeader.Del", + "WrappedHeader.Set" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5660", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5666.json b/data/osv/GO-2026-5666.json new file mode 100644 index 0000000..66dd00d --- /dev/null +++ b/data/osv/GO-2026-5666.json
@@ -0,0 +1,69 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5666", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-35204", + "GHSA-vmx8-mqv2-9gmg" + ], + "summary": "Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm", + "details": "Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm", + "affected": [ + { + "package": { + "name": "helm.sh/helm/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.1.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "helm.sh/helm/v4/internal/plugin", + "symbols": [ + "ExtractTgzPluginMetadata", + "FindPlugin", + "FindPlugins", + "LoadAll", + "LoadDir", + "Metadata.Validate", + "MetadataLegacy.Validate", + "MetadataV1.Validate", + "SignPlugin" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg" + }, + { + "type": "FIX", + "url": "https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027" + }, + { + "type": "WEB", + "url": "https://github.com/helm/helm/releases/tag/v4.1.4" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5666", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5684.json b/data/osv/GO-2026-5684.json new file mode 100644 index 0000000..aa16a77 --- /dev/null +++ b/data/osv/GO-2026-5684.json
@@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5684", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-42328", + "GHSA-w239-58x2-q8p5" + ], + "summary": "Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime", + "details": "Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime", + "affected": [ + { + "package": { + "name": "github.com/ipld/go-ipld-prime", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.23.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/ipld/go-ipld-prime/codec/dagcbor", + "symbols": [ + "Decode" + ] + }, + { + "path": "github.com/ipld/go-ipld-prime/codec/dagjson", + "symbols": [ + "Decode" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5" + }, + { + "type": "FIX", + "url": "https://github.com/ipld/go-ipld-prime/pull/625" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5684", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5693.json b/data/osv/GO-2026-5693.json new file mode 100644 index 0000000..52f4723 --- /dev/null +++ b/data/osv/GO-2026-5693.json
@@ -0,0 +1,83 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5693", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-w5pp-99ch-qj29" + ], + "summary": "Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git", + "details": "Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git", + "affected": [ + { + "package": { + "name": "github.com/go-git/go-git/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.19.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-git/v5/plumbing/format/packfile", + "symbols": [ + "Parser.Parse", + "UpdateObjectStorage" + ] + } + ] + } + }, + { + "package": { + "name": "github.com/go-git/go-git/v6", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0.0-alpha.4" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-git/go-git/v6/plumbing/format/packfile", + "symbols": [ + "Parser.Parse", + "UpdateObjectStorage" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-git/go-git/security/advisories/GHSA-w5pp-99ch-qj29" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5693", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5730.json b/data/osv/GO-2026-5730.json new file mode 100644 index 0000000..0a48dfe --- /dev/null +++ b/data/osv/GO-2026-5730.json
@@ -0,0 +1,196 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5730", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-wwhq-w58m-w29c" + ], + "summary": "Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy", + "details": "Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy", + "affected": [ + { + "package": { + "name": "github.com/caddyserver/caddy/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.11.3" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/caddyserver/caddy/v2/modules/caddyhttp", + "symbols": [ + "App.Cleanup", + "App.Provision", + "App.Start", + "App.Stop", + "App.Validate", + "CELMatcherImpl", + "CELValueToMapStrList", + "CIDRExpressionToPrefix", + "Error", + "HandlerError.Error", + "HandlerFunc.ServeHTTP", + "Invoke.ServeHTTP", + "LoggableHTTPHeader.MarshalLogObject", + "LoggableHTTPRequest.MarshalLogObject", + "LoggableTLSConnState.MarshalLogObject", + "MatchClientIP.CELLibrary", + "MatchClientIP.Match", + "MatchClientIP.MatchWithError", + "MatchClientIP.Provision", + "MatchClientIP.UnmarshalCaddyfile", + "MatchExpression.MarshalJSON", + "MatchExpression.Match", + "MatchExpression.MatchWithError", + "MatchExpression.Provision", + "MatchExpression.UnmarshalCaddyfile", + "MatchExpression.UnmarshalJSON", + "MatchHeader.CELLibrary", + "MatchHeader.Match", + "MatchHeader.MatchWithError", + "MatchHeader.UnmarshalCaddyfile", + "MatchHeaderRE.CELLibrary", + "MatchHeaderRE.Match", + "MatchHeaderRE.MatchWithError", + "MatchHeaderRE.Provision", + "MatchHeaderRE.UnmarshalCaddyfile", + "MatchHeaderRE.Validate", + "MatchHost.CELLibrary", + "MatchHost.Match", + "MatchHost.MatchWithError", + "MatchHost.Provision", + "MatchHost.UnmarshalCaddyfile", + "MatchMethod.CELLibrary", + "MatchMethod.UnmarshalCaddyfile", + "MatchNot.MarshalJSON", + "MatchNot.Match", + "MatchNot.MatchWithError", + "MatchNot.Provision", + "MatchNot.UnmarshalCaddyfile", + "MatchNot.UnmarshalJSON", + "MatchPath.CELLibrary", + "MatchPath.Match", + "MatchPath.MatchWithError", + "MatchPath.UnmarshalCaddyfile", + "MatchPathRE.CELLibrary", + "MatchPathRE.Match", + "MatchPathRE.MatchWithError", + "MatchProtocol.CELLibrary", + "MatchProtocol.Match", + "MatchProtocol.MatchWithError", + "MatchProtocol.UnmarshalCaddyfile", + "MatchQuery.CELLibrary", + "MatchQuery.Match", + "MatchQuery.MatchWithError", + "MatchQuery.UnmarshalCaddyfile", + "MatchRegexp.Match", + "MatchRegexp.Provision", + "MatchRegexp.UnmarshalCaddyfile", + "MatchRegexp.Validate", + "MatchRemoteIP.CELLibrary", + "MatchRemoteIP.Match", + "MatchRemoteIP.MatchWithError", + "MatchRemoteIP.Provision", + "MatchRemoteIP.UnmarshalCaddyfile", + "MatchTLS.UnmarshalCaddyfile", + "MatchVarsRE.CELLibrary", + "MatchVarsRE.Match", + "MatchVarsRE.MatchWithError", + "MatchVarsRE.Provision", + "MatchVarsRE.UnmarshalCaddyfile", + "MatchVarsRE.Validate", + "MatcherSet.Match", + "MatcherSet.MatchWithError", + "MatcherSets.AnyMatch", + "MatcherSets.AnyMatchWithError", + "MatcherSets.FromInterface", + "MatcherSets.String", + "ParseCaddyfileNestedMatcherSet", + "ParseNamedResponseMatcher", + "PrepareRequest", + "ResponseHandler.Provision", + "ResponseMatcher.Match", + "ResponseWriterWrapper.Push", + "ResponseWriterWrapper.ReadFrom", + "Route.Provision", + "Route.ProvisionHandlers", + "Route.ProvisionMatchers", + "Route.String", + "RouteList.Provision", + "RouteList.ProvisionHandlers", + "RouteList.ProvisionMatchers", + "Server.ServeHTTP", + "StaticError.ServeHTTP", + "StaticError.UnmarshalCaddyfile", + "StaticIPRange.Provision", + "StaticResponse.ServeHTTP", + "StaticResponse.UnmarshalCaddyfile", + "StringArray.UnmarshalJSON", + "Subroute.Provision", + "Subroute.ServeHTTP", + "VarsMatcher.CELLibrary", + "VarsMatcher.Match", + "VarsMatcher.MatchWithError", + "VarsMatcher.UnmarshalCaddyfile", + "VarsMiddleware.ServeHTTP", + "VarsMiddleware.UnmarshalCaddyfile", + "WeakString.MarshalJSON", + "WeakString.UnmarshalJSON", + "celHTTPRequest.Equal", + "celPkixName.ConvertToType", + "celPkixName.Equal", + "celTypeAdapter.NativeToValue", + "extraFieldsSlogHandler.Handle", + "extraFieldsSlogHandler.WithAttrs", + "hijackedConn.Read", + "hijackedConn.ReadFrom", + "hijackedConn.Write", + "hijackedConn.WriteTo", + "http2Conn.Read", + "http2Listener.Accept", + "httpRedirectConn.Read", + "httpRedirectListener.Accept", + "lengthReader.Close", + "lengthReader.Read", + "metricsInstrumentedRoute.ServeHTTP", + "requestID.String", + "responseRecorder.FlushError", + "responseRecorder.Hijack", + "responseRecorder.ReadFrom", + "responseRecorder.Write", + "responseRecorder.WriteHeader", + "responseRecorder.WriteResponse" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-wwhq-w58m-w29c" + }, + { + "type": "FIX", + "url": "https://github.com/caddyserver/caddy/pull/7629" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5730", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5736.json b/data/osv/GO-2026-5736.json new file mode 100644 index 0000000..3fd1749 --- /dev/null +++ b/data/osv/GO-2026-5736.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5736", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-44283", + "GHSA-x35m-3gp4-4fh5" + ], + "summary": "Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server", + "details": "Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server", + "affected": [ + { + "package": { + "name": "go.etcd.io/etcd/server/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.5.0" + }, + { + "fixed": "3.5.30" + }, + { + "introduced": "3.6.0" + }, + { + "fixed": "3.6.11" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "go.etcd.io/etcd/server/v3/etcdserver", + "symbols": [ + "EtcdServer.Txn" + ] + } + ], + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.44" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5736", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5740.json b/data/osv/GO-2026-5740.json new file mode 100644 index 0000000..554944c --- /dev/null +++ b/data/osv/GO-2026-5740.json
@@ -0,0 +1,95 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5740", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-44301", + "GHSA-x597-9fr4-5857" + ], + "summary": "Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo", + "details": "Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo", + "affected": [ + { + "package": { + "name": "github.com/gohugoio/hugo", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.161.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gohugoio/hugo/config/security", + "symbols": [ + "DecodeConfig" + ] + }, + { + "path": "github.com/gohugoio/hugo/common/hexec", + "symbols": [ + "Exec.Npx", + "New" + ] + }, + { + "path": "github.com/gohugoio/hugo/resources/resource_transformers/babel", + "symbols": [ + "DecodeOptions", + "New", + "babelTransformation.Transform" + ] + }, + { + "path": "github.com/gohugoio/hugo/common/hugo", + "symbols": [ + "GetExecEnviron" + ] + }, + { + "path": "github.com/gohugoio/hugo/deps", + "symbols": [ + "Deps.Clone", + "Deps.Init" + ] + } + ], + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.43.0" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857" + }, + { + "type": "FIX", + "url": "https://github.com/gohugoio/hugo/commit/a54c398b93821865547a9e21c73aad8a1d7f7bc1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5740", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5774.json b/data/osv/GO-2026-5774.json new file mode 100644 index 0000000..66406ee --- /dev/null +++ b/data/osv/GO-2026-5774.json
@@ -0,0 +1,56 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5774", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-3fxj-6jh8-hvhx" + ], + "summary": "Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi", + "details": "Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi", + "affected": [ + { + "package": { + "name": "github.com/go-chi/chi/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "5.2.1" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-chi/chi/v5/middleware", + "symbols": [ + "RealIP" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx" + }, + { + "type": "FIX", + "url": "https://github.com/go-chi/chi/pull/967" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5774", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5775.json b/data/osv/GO-2026-5775.json new file mode 100644 index 0000000..b0d8a3e --- /dev/null +++ b/data/osv/GO-2026-5775.json
@@ -0,0 +1,60 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5775", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-9g5q-2w5x-hmxf" + ], + "summary": "Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi", + "details": "Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi", + "affected": [ + { + "package": { + "name": "github.com/go-chi/chi/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-chi/chi/v5/middleware", + "symbols": [ + "RealIP" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf" + }, + { + "type": "FIX", + "url": "https://github.com/go-chi/chi/pull/967" + }, + { + "type": "WEB", + "url": "https://github.com/go-chi/chi/releases/tag/v5.3.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5775", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5777.json b/data/osv/GO-2026-5777.json new file mode 100644 index 0000000..d11b477 --- /dev/null +++ b/data/osv/GO-2026-5777.json
@@ -0,0 +1,60 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5777", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-rjr7-jggh-pgcp" + ], + "summary": "Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi", + "details": "Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi", + "affected": [ + { + "package": { + "name": "github.com/go-chi/chi/v5", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/go-chi/chi/v5/middleware", + "symbols": [ + "RealIP" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp" + }, + { + "type": "FIX", + "url": "https://github.com/go-chi/chi/pull/967" + }, + { + "type": "WEB", + "url": "https://github.com/go-chi/chi/releases/tag/v5.3.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5777", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5879.json b/data/osv/GO-2026-5879.json new file mode 100644 index 0000000..775cd34 --- /dev/null +++ b/data/osv/GO-2026-5879.json
@@ -0,0 +1,58 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5879", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-50162", + "GHSA-8xwf-rjm4-xvhv" + ], + "summary": "Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go", + "details": "Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go", + "affected": [ + { + "package": { + "name": "oras.land/oras-go/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "oras.land/oras-go/v2/content/file", + "symbols": [ + "New", + "Store.Add" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv" + }, + { + "type": "FIX", + "url": "https://github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5879", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5880.json b/data/osv/GO-2026-5880.json new file mode 100644 index 0000000..7317d23 --- /dev/null +++ b/data/osv/GO-2026-5880.json
@@ -0,0 +1,58 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5880", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-50163", + "GHSA-fxhp-mv3v-67qp" + ], + "summary": "Hardlink path traversal during tar extraction in oras.land/oras-go", + "details": "Hardlink path traversal during tar extraction in oras.land/oras-go", + "affected": [ + { + "package": { + "name": "oras.land/oras-go/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.2" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "oras.land/oras-go/v2/content/file", + "symbols": [ + "New", + "Store.Add" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp" + }, + { + "type": "FIX", + "url": "https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5880", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5882.json b/data/osv/GO-2026-5882.json new file mode 100644 index 0000000..1496c8b --- /dev/null +++ b/data/osv/GO-2026-5882.json
@@ -0,0 +1,65 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5882", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-50151", + "GHSA-jxpm-75mh-9fp7" + ], + "summary": "Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go", + "details": "Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go", + "affected": [ + { + "package": { + "name": "oras.land/oras-go/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "oras.land/oras-go/v2/registry/remote", + "symbols": [ + "Repository.Push" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7" + }, + { + "type": "FIX", + "url": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991" + }, + { + "type": "FIX", + "url": "https://github.com/oras-project/oras-go/pull/1152" + }, + { + "type": "WEB", + "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5882", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5884.json b/data/osv/GO-2026-5884.json new file mode 100644 index 0000000..282cb18 --- /dev/null +++ b/data/osv/GO-2026-5884.json
@@ -0,0 +1,60 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5884", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-vh4v-2xq2-g5cg" + ], + "summary": "ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go", + "details": "ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go", + "affected": [ + { + "package": { + "name": "oras.land/oras-go/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "oras.land/oras-go/v2/registry/remote/auth", + "symbols": [ + "Client.Do" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-vh4v-2xq2-g5cg" + }, + { + "type": "FIX", + "url": "https://github.com/oras-project/oras-go/commit/3c2e884e12ea52b6bff60c97f1edb7df7d0e0909" + }, + { + "type": "WEB", + "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5884", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5885.json b/data/osv/GO-2026-5885.json new file mode 100644 index 0000000..64eabd8 --- /dev/null +++ b/data/osv/GO-2026-5885.json
@@ -0,0 +1,61 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5885", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-48978", + "GHSA-xf85-363p-868w" + ], + "summary": "Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go", + "details": "Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go", + "affected": [ + { + "package": { + "name": "oras.land/oras-go/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "oras.land/oras-go/v2/registry/remote/auth", + "symbols": [ + "Client.Do" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w" + }, + { + "type": "FIX", + "url": "https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764" + }, + { + "type": "WEB", + "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5885", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5886.json b/data/osv/GO-2026-5886.json new file mode 100644 index 0000000..cd37edc --- /dev/null +++ b/data/osv/GO-2026-5886.json
@@ -0,0 +1,57 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5886", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-44332", + "GHSA-g5vh-55hw-rxm8" + ], + "summary": "GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber", + "details": "GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber", + "affected": [ + { + "package": { + "name": "github.com/gofiber/fiber/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.3.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gofiber/fiber/v3/middleware/basicauth", + "symbols": [ + "New" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8" + }, + { + "type": "FIX", + "url": "https://github.com/gofiber/fiber/pull/4245" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5886", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5887.json b/data/osv/GO-2026-5887.json new file mode 100644 index 0000000..70e7420 --- /dev/null +++ b/data/osv/GO-2026-5887.json
@@ -0,0 +1,58 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5887", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-45045", + "GHSA-gcfq-8gqf-4876" + ], + "summary": "GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber", + "details": "GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in github.com/gofiber/fiber", + "affected": [ + { + "package": { + "name": "github.com/gofiber/fiber/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.3.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gofiber/fiber/v3/middleware/proxy", + "symbols": [ + "Balancer", + "BalancerForward" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876" + }, + { + "type": "FIX", + "url": "https://github.com/gofiber/fiber/pull/4260" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5887", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5912.json b/data/osv/GO-2026-5912.json new file mode 100644 index 0000000..9d32fca --- /dev/null +++ b/data/osv/GO-2026-5912.json
@@ -0,0 +1,57 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5912", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-53624", + "GHSA-gv83-gqw6-9j2c" + ], + "summary": "GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber", + "details": "GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber", + "affected": [ + { + "package": { + "name": "github.com/gofiber/fiber/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/gofiber/fiber/v3/middleware/helmet", + "symbols": [ + "New" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c" + }, + { + "type": "FIX", + "url": "https://github.com/gofiber/fiber/pull/4389" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5912", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5954.json b/data/osv/GO-2026-5954.json new file mode 100644 index 0000000..a80ed09 --- /dev/null +++ b/data/osv/GO-2026-5954.json
@@ -0,0 +1,58 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5954", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-49838", + "GHSA-frrj-87jh-2772" + ], + "summary": "GoBGP confederation validation panics on empty AS_PATH attribute in github.com/osrg/gobgp", + "details": "GoBGP confederation validation panics on empty AS_PATH attribute in github.com/osrg/gobgp", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.7.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v4/pkg/packet/bgp", + "symbols": [ + "ValidateAttribute", + "ValidateUpdateMsg" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-frrj-87jh-2772" + }, + { + "type": "FIX", + "url": "https://github.com/osrg/gobgp/commit/4a319a6c25630fb3cdbda3e9ccfe56e702bdaaa0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5954", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5955.json b/data/osv/GO-2026-5955.json new file mode 100644 index 0000000..d8f9cd9 --- /dev/null +++ b/data/osv/GO-2026-5955.json
@@ -0,0 +1,66 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5955", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-49837", + "GHSA-gjrg-jjr3-56cm" + ], + "summary": "GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp", + "details": "GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries in github.com/osrg/gobgp", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.6.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v4/pkg/packet/bgp", + "symbols": [ + "BGPOpen.DecodeFromBytes", + "CapFQDN.DecodeFromBytes", + "CapFourOctetASNumber.DecodeFromBytes", + "CapGracefulRestart.DecodeFromBytes", + "CapMultiProtocol.DecodeFromBytes", + "CapSoftwareVersion.DecodeFromBytes", + "DecodeCapability", + "OptionParameterCapability.DecodeFromBytes", + "ParseBGPBody", + "ParseBGPMessage" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/osrg/gobgp/security/advisories/GHSA-gjrg-jjr3-56cm" + }, + { + "type": "FIX", + "url": "https://github.com/osrg/gobgp/commit/f02ca397821f6ca182ef4eb492c3cbc459552d7c" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5955", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-5971.json b/data/osv/GO-2026-5971.json new file mode 100644 index 0000000..89e2771 --- /dev/null +++ b/data/osv/GO-2026-5971.json
@@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-5971", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-37462", + "GHSA-pw7p-7fqv-hpj8" + ], + "summary": "GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function in github.com/osrg/gobgp", + "details": "GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function in github.com/osrg/gobgp", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.4.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v4/pkg/packet/bgp", + "symbols": [ + "BGPUpdate.DecodeFromBytes", + "ParseBGPBody", + "ParseBGPMessage" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-pw7p-7fqv-hpj8" + }, + { + "type": "FIX", + "url": "https://github.com/osrg/gobgp/commit/9ce8936672ebc07df524da77fa4c6ae26d92be6d" + }, + { + "type": "WEB", + "url": "https://github.com/osrg/gobgp/blob/v4.3.0/pkg/packet/bgp/bgp.go" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-5971", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/reports/GO-2026-5069.yaml b/data/reports/GO-2026-5069.yaml new file mode 100644 index 0000000..b94c08a --- /dev/null +++ b/data/reports/GO-2026-5069.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5069 +modules: + - module: github.com/gofiber/fiber/v3 + versions: + - fixed: 3.2.0 + vulnerable_at: 3.1.0 + packages: + - package: github.com/gofiber/fiber/v3/middleware/cache + symbols: + - New +summary: |- + Fiber: Cache middleware key generator ignores query string in + github.com/gofiber/fiber +cves: + - CVE-2026-30246 +ghsas: + - GHSA-35hp-hqmv-8qg8 +references: + - advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8 + - fix: https://github.com/gofiber/fiber/commit/050ff1ff18511c1475b8ec627460216aaecddd4e + - fix: https://github.com/gofiber/fiber/commit/9a0d12c07ed895b84c72987f9288b04137afe5de +source: + id: GHSA-35hp-hqmv-8qg8 + created: 2026-07-23T19:31:15.009567-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5074.yaml b/data/reports/GO-2026-5074.yaml new file mode 100644 index 0000000..113e9ca --- /dev/null +++ b/data/reports/GO-2026-5074.yaml
@@ -0,0 +1,57 @@ +id: GO-2026-5074 +modules: + - module: github.com/go-git/go-git/v5 + versions: + - fixed: 5.19.0 + vulnerable_at: 5.18.0 + packages: + - package: github.com/go-git/go-git/v5/plumbing/object + symbols: + - Commit.Decode + - Tag.Decode + derived_symbols: + - Commit.IsAncestor + - Commit.MergeBase + - Commit.Parent + - Commit.Stats + - Commit.StatsContext + - DecodeCommit + - DecodeObject + - DecodeTag + - GetCommit + - GetObject + - GetTag + - Independents + - NewCommitAllIter + - ObjectIter.Next + - Tag.Commit + - Tag.Object + - Tag.String + - Tag.Tree + - TagIter.Next + - bfsCommitIterator.ForEach + - bfsCommitIterator.Next + - commitIteratorByCTime.ForEach + - commitIteratorByCTime.Next + - commitPostIterator.ForEach + - commitPostIterator.Next + - commitPreIterator.ForEach + - commitPreIterator.Next + - filterCommitIter.ForEach + - filterCommitIter.Next + - storerCommitIter.ForEach + - storerCommitIter.Next +summary: |- + Go-git: Improper parsing of specially crafted objects may lead to inconsistent + interpretation in github.com/go-git/go-git +cves: + - CVE-2026-45022 +ghsas: + - GHSA-389r-gv7p-r3rp +references: + - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp + - web: https://github.com/go-git/go-git/releases/tag/v5.19.0 +source: + id: GHSA-389r-gv7p-r3rp + created: 2026-07-23T19:31:09.452054-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5105.yaml b/data/reports/GO-2026-5105.yaml new file mode 100644 index 0000000..d6e54e3 --- /dev/null +++ b/data/reports/GO-2026-5105.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-5105 +modules: + - module: github.com/go-git/go-git/v5 + versions: + - fixed: 5.18.0 + vulnerable_at: 5.17.2 + packages: + - package: github.com/go-git/go-git/v5/plumbing/transport/http + symbols: + - NewClient +summary: |- + Go-git: Credential leak via cross-host redirect in smart HTTP transport in + github.com/go-git/go-git +cves: + - CVE-2026-41506 +ghsas: + - GHSA-3xc5-wrhm-f963 +references: + - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963 + - web: https://github.com/go-git/go-git/releases/tag/v5.18.0 +source: + id: GHSA-3xc5-wrhm-f963 + created: 2026-07-23T19:30:57.550805-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5158.yaml b/data/reports/GO-2026-5158.yaml new file mode 100644 index 0000000..245c164 --- /dev/null +++ b/data/reports/GO-2026-5158.yaml
@@ -0,0 +1,29 @@ +id: GO-2026-5158 +modules: + - module: go.opentelemetry.io/otel + versions: + - introduced: 1.41.0 + - fixed: 1.42.0 + - introduced: 1.43.0 + - fixed: 1.44.0 + vulnerable_at: 1.43.0 + packages: + - package: go.opentelemetry.io/otel/baggage + symbols: + - Parse + - New + - package: go.opentelemetry.io/otel/propagation + symbols: + - Baggage.Extract +summary: Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel +cves: + - CVE-2026-41178 +ghsas: + - GHSA-5wrp-cwcj-q835 +references: + - advisory: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835 + - web: https://github.com/open-telemetry/opentelemetry-go/pull/7880 +source: + id: GHSA-5wrp-cwcj-q835 + created: 2026-07-23T19:30:30.094441-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5198.yaml b/data/reports/GO-2026-5198.yaml new file mode 100644 index 0000000..7dab408 --- /dev/null +++ b/data/reports/GO-2026-5198.yaml
@@ -0,0 +1,28 @@ +id: GO-2026-5198 +modules: + - module: github.com/osrg/gobgp/v4 + versions: + - introduced: 4.3.0 + - fixed: 4.4.0 + vulnerable_at: 4.3.0 + packages: + - package: github.com/osrg/gobgp/v4/pkg/server + symbols: + - BgpServer.AddPeer + derived_symbols: + - NewBgpServer + - server.AddPeer +summary: |- + GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path + Attribute in github.com/osrg/gobgp +cves: + - CVE-2026-41642 +ghsas: + - GHSA-7235-89m6-f4px +references: + - advisory: https://github.com/osrg/gobgp/security/advisories/GHSA-7235-89m6-f4px + - web: https://github.com/osrg/gobgp/releases/tag/v4.4.0 +source: + id: GHSA-7235-89m6-f4px + created: 2026-07-23T19:30:24.072986-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5208.yaml b/data/reports/GO-2026-5208.yaml new file mode 100644 index 0000000..2a2b461 --- /dev/null +++ b/data/reports/GO-2026-5208.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-5208 +modules: + - module: github.com/gomarkdown/markdown + versions: + - fixed: 0.0.0-20260411013819-759bbc3e3207 + vulnerable_at: 0.0.0-20260217112301-37c66b85d6ab + packages: + - package: github.com/gomarkdown/markdown/html + symbols: + - NewRenderer +summary: |- + Go Markdown has an out-of-bounds read in SmartypantsRenderer in + github.com/gomarkdown/markdown +cves: + - CVE-2026-40890 +ghsas: + - GHSA-77fj-vx54-gvh7 +references: + - advisory: https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7 + - fix: https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778 +source: + id: GHSA-77fj-vx54-gvh7 + created: 2026-07-23T19:30:17.17185-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5266.yaml b/data/reports/GO-2026-5266.yaml new file mode 100644 index 0000000..b5d875d --- /dev/null +++ b/data/reports/GO-2026-5266.yaml
@@ -0,0 +1,27 @@ +id: GO-2026-5266 +modules: + - module: github.com/osrg/gobgp/v4 + versions: + - fixed: 4.3.0 + vulnerable_at: 4.2.0 + packages: + - package: github.com/osrg/gobgp/v4/pkg/server + symbols: + - BgpServer.AddPeer + derived_symbols: + - NewBgpServer + - server.AddPeer +summary: |- + GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via + Malformed BGP UPDATE in github.com/osrg/gobgp +cves: + - CVE-2026-41643 +ghsas: + - GHSA-8rxh-r2p6-7f2q +references: + - advisory: https://github.com/osrg/gobgp/security/advisories/GHSA-8rxh-r2p6-7f2q + - web: https://github.com/osrg/gobgp/releases/tag/v4.3.0 +source: + id: GHSA-8rxh-r2p6-7f2q + created: 2026-07-23T19:30:08.433423-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5309.yaml b/data/reports/GO-2026-5309.yaml new file mode 100644 index 0000000..509f5c8 --- /dev/null +++ b/data/reports/GO-2026-5309.yaml
@@ -0,0 +1,21 @@ +id: GO-2026-5309 +modules: + - module: github.com/gohugoio/hugo + versions: + - introduced: 0.123.0 + - fixed: 0.163.1 + vulnerable_at: 0.163.0 + packages: + - package: github.com/gohugoio/hugo/tpl/os + symbols: + - Namespace.ReadFile +summary: 'Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo' +ghsas: + - GHSA-c3wq-j5vh-68rc +references: + - advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc + - web: https://github.com/gohugoio/hugo/releases/tag/v0.163.1 +source: + id: GHSA-c3wq-j5vh-68rc + created: 2026-07-23T19:29:21.33694-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5327.yaml b/data/reports/GO-2026-5327.yaml new file mode 100644 index 0000000..25afe7f --- /dev/null +++ b/data/reports/GO-2026-5327.yaml
@@ -0,0 +1,32 @@ +id: GO-2026-5327 +modules: + - module: go.mongodb.org/mongo-driver + versions: + - fixed: 1.17.7 + vulnerable_at: 1.17.6 + packages: + - package: go.mongodb.org/mongo-driver/mongo + symbols: + - Connect + - module: go.mongodb.org/mongo-driver/v2 + versions: + - fixed: 2.4.2 + vulnerable_at: 2.4.1 + packages: + - package: go.mongodb.org/mongo-driver/v2/mongo + symbols: + - Connect +summary: |- + Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in + go.mongodb.org/mongo-driver +cves: + - CVE-2026-2303 +ghsas: + - GHSA-cp6g-7hqx-qxhp +references: + - advisory: https://github.com/advisories/GHSA-cp6g-7hqx-qxhp + - web: https://jira.mongodb.org/browse/GODRIVER-3770 +source: + id: GHSA-cp6g-7hqx-qxhp + created: 2026-07-23T19:29:16.832041-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5336.yaml b/data/reports/GO-2026-5336.yaml new file mode 100644 index 0000000..9402130 --- /dev/null +++ b/data/reports/GO-2026-5336.yaml
@@ -0,0 +1,35 @@ +id: GO-2026-5336 +modules: + - module: github.com/go-git/go-git/v5 + versions: + - fixed: 5.19.1 + vulnerable_at: 5.19.0 + packages: + - package: github.com/go-git/go-git/v5 + symbols: + - Worktree.Checkout + derived_symbols: + - Clone + - CloneContext + - PlainClone + - PlainCloneContext + - Submodule.Update + - Submodule.UpdateContext + - Submodules.Update + - Submodules.UpdateContext + - Worktree.Pull + - Worktree.PullContext +summary: |- + Go-git: Crafted repositories may modify main and submodule .git directories in + github.com/go-git/go-git +cves: + - CVE-2026-45571 +ghsas: + - GHSA-crhj-59gh-8x96 +references: + - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96 + - web: https://github.com/go-git/go-git/releases/tag/v5.19.1 +source: + id: GHSA-crhj-59gh-8x96 + created: 2026-07-23T19:29:05.593873-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5346.yaml b/data/reports/GO-2026-5346.yaml new file mode 100644 index 0000000..2921b2a --- /dev/null +++ b/data/reports/GO-2026-5346.yaml
@@ -0,0 +1,41 @@ +id: GO-2026-5346 +modules: + - module: github.com/caddyserver/caddy/v2 + versions: + - fixed: 2.11.4 + vulnerable_at: 2.11.3 + packages: + - package: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy/fastcgi + symbols: + - Transport.RoundTrip + derived_symbols: + - Transport.Provision + - Transport.UnmarshalCaddyfile + - client.Do + - client.Get + - client.Head + - client.Options + - client.Post + - client.PostFile + - client.PostForm + - client.Request + - clientCloser.Close + - record.Read + - streamReader.Read + - streamWriter.Flush + - streamWriter.FlushStream + - streamWriter.Write +summary: |- + Caddy: FastCGI header normalization bypass in forward_auth copy_headers in + github.com/caddyserver/caddy +cves: + - CVE-2026-52845 +ghsas: + - GHSA-f59h-q822-g45g +references: + - advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g + - fix: https://github.com/caddyserver/caddy/pull/7633 +source: + id: GHSA-f59h-q822-g45g + created: 2026-07-23T19:28:57.710855-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5408.yaml b/data/reports/GO-2026-5408.yaml new file mode 100644 index 0000000..ee3131e --- /dev/null +++ b/data/reports/GO-2026-5408.yaml
@@ -0,0 +1,31 @@ +id: GO-2026-5408 +modules: + - module: github.com/caddyserver/caddy/v2 + versions: + - fixed: 2.11.3 + vulnerable_at: 2.11.2 + packages: + - package: github.com/caddyserver/caddy/v2/modules/caddypki + symbols: + - PKI.CaddyModule + derived_symbols: + - CA.NewAuthority + - CA.Provision + - CA.RootKey + - KeyPair.Load + - PKI.GetCA + - PKI.Provision + - PKI.ProvisionDefaultCA + - PKI.Start + - adminAPI.Provision +summary: |- + Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path + Matching in github.com/caddyserver/caddy +ghsas: + - GHSA-gx7w-56w6-g48x +references: + - advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-gx7w-56w6-g48x +source: + id: GHSA-gx7w-56w6-g48x + created: 2026-07-23T19:28:49.253121-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5426.yaml b/data/reports/GO-2026-5426.yaml new file mode 100644 index 0000000..583b9a4 --- /dev/null +++ b/data/reports/GO-2026-5426.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5426 +modules: + - module: go.opentelemetry.io/otel/sdk + versions: + - introduced: 1.15.0 + - fixed: 1.43.0 + vulnerable_at: 1.42.0 + packages: + - package: go.opentelemetry.io/otel/sdk/resource + symbols: + - New +summary: |- + Opentelemetry-go: BSD kenv command not using absolute path enables PATH + hijacking in go.opentelemetry.io/otel/sdk +cves: + - CVE-2026-39883 +ghsas: + - GHSA-hfvc-g4fc-pqhx +references: + - advisory: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx + - web: http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0 +source: + id: GHSA-hfvc-g4fc-pqhx + created: 2026-07-23T19:28:44.838444-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5435.yaml b/data/reports/GO-2026-5435.yaml new file mode 100644 index 0000000..e1740ea --- /dev/null +++ b/data/reports/GO-2026-5435.yaml
@@ -0,0 +1,27 @@ +id: GO-2026-5435 +modules: + - module: helm.sh/helm/v3 + versions: + - fixed: 3.20.2 + vulnerable_at: 3.20.1 + packages: + - package: helm.sh/helm/v3/pkg/chartutil + symbols: + - Expand + derived_symbols: + - ExpandFile +summary: |- + Helm Chart extraction output directory collapse via Chart.yaml name + dot-segment in helm.sh/helm +cves: + - CVE-2026-35206 +ghsas: + - GHSA-hr2v-4r36-88hr +references: + - advisory: https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr + - fix: https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436 + - web: https://github.com/helm/helm/releases/tag/v4.1.4 +source: + id: GHSA-hr2v-4r36-88hr + created: 2026-07-23T19:28:38.561456-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5452.yaml b/data/reports/GO-2026-5452.yaml new file mode 100644 index 0000000..95bf6e6 --- /dev/null +++ b/data/reports/GO-2026-5452.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5452 +modules: + - module: github.com/MontFerret/ferret/v2 + versions: + - fixed: 2.0.0-alpha.4 + vulnerable_at: 2.0.0-alpha.3 + packages: + - package: github.com/MontFerret/ferret/v2/pkg/stdlib/io/fs + symbols: + - Write + - Read +summary: |- + Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write in + github.com/MontFerret/ferret +cves: + - CVE-2026-34783 +ghsas: + - GHSA-j6v5-g24h-vg4j +references: + - advisory: https://github.com/MontFerret/ferret/security/advisories/GHSA-j6v5-g24h-vg4j + - fix: https://github.com/MontFerret/ferret/commit/160ebad6bd50f153453e120f6d909f5b83322917 +source: + id: GHSA-j6v5-g24h-vg4j + created: 2026-07-23T19:28:21.854289-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5463.yaml b/data/reports/GO-2026-5463.yaml new file mode 100644 index 0000000..c624f0d --- /dev/null +++ b/data/reports/GO-2026-5463.yaml
@@ -0,0 +1,29 @@ +id: GO-2026-5463 +modules: + - module: github.com/bettercap/bettercap/v2 + versions: + - fixed: 2.41.7 + vulnerable_at: 2.41.5 + packages: + - package: github.com/bettercap/bettercap/v2/modules/mysql_server + symbols: + - MySQLServer.Start + derived_symbols: + - MySQLServer.Stop +summary: |- + Bettercap has an integer coercion error in modules/mysql_server/mysql_server.go + in github.com/bettercap/bettercap +cves: + - CVE-2026-8276 +ghsas: + - GHSA-jcqv-2g3v-gm88 +references: + - advisory: https://github.com/advisories/GHSA-jcqv-2g3v-gm88 + - fix: https://github.com/bettercap/bettercap/commit/0eaa375c5e5446bfba94a290eff92967a5deac9e + - fix: https://github.com/bettercap/bettercap/pull/1266 + - report: https://github.com/bettercap/bettercap/issues/1265 + - web: https://github.com/bettercap/bettercap/releases/tag/v2.41.7 +source: + id: GHSA-jcqv-2g3v-gm88 + created: 2026-07-23T19:28:10.498887-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5471.yaml b/data/reports/GO-2026-5471.yaml new file mode 100644 index 0000000..b015ad8 --- /dev/null +++ b/data/reports/GO-2026-5471.yaml
@@ -0,0 +1,21 @@ +id: GO-2026-5471 +modules: + - module: github.com/go-kratos/kratos/v2 + vulnerable_at: 2.9.2 + packages: + - package: github.com/go-kratos/kratos/v2/transport/http + symbols: + - Server.ServeHTTP +summary: Kratos has a Confused Deputy issue in github.com/go-kratos/kratos +cves: + - CVE-2026-6993 +ghsas: + - GHSA-jj45-xvq5-rhh9 +references: + - advisory: https://github.com/advisories/GHSA-jj45-xvq5-rhh9 + - fix: https://github.com/go-kratos/kratos/pull/3814 + - report: https://github.com/go-kratos/kratos/issues/3810 +source: + id: GHSA-jj45-xvq5-rhh9 + created: 2026-07-23T19:27:54.14872-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5490.yaml b/data/reports/GO-2026-5490.yaml new file mode 100644 index 0000000..b1a64b7 --- /dev/null +++ b/data/reports/GO-2026-5490.yaml
@@ -0,0 +1,30 @@ +id: GO-2026-5490 +modules: + - module: github.com/go-git/go-billy/v5 + versions: + - fixed: 5.9.0 + vulnerable_at: 5.8.0 + packages: + - package: github.com/go-git/go-billy/v5/util + symbols: + - Walk + - package: github.com/go-git/go-billy/v5/helper/chroot + symbols: + - New + derived_symbols: + - ChrootHelper.Chroot +summary: |- + Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in + github.com/go-git/go-billy +cves: + - CVE-2026-44740 +ghsas: + - GHSA-m3xc-h892-ggx6 +references: + - advisory: https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6 + - fix: https://github.com/go-git/go-billy/pull/203 + - web: https://github.com/go-git/go-billy/releases/tag/v5.9.0 +source: + id: GHSA-m3xc-h892-ggx6 + created: 2026-07-23T19:27:47.7047-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5492.yaml b/data/reports/GO-2026-5492.yaml new file mode 100644 index 0000000..579282c --- /dev/null +++ b/data/reports/GO-2026-5492.yaml
@@ -0,0 +1,44 @@ +id: GO-2026-5492 +modules: + - module: github.com/caddyserver/caddy/v2 + versions: + - introduced: 2.7.0 + - fixed: 2.11.3 + vulnerable_at: 2.11.2 + packages: + - package: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy/fastcgi + symbols: + - Transport.RoundTrip + derived_symbols: + - Transport.Provision + - Transport.UnmarshalCaddyfile + - client.Do + - client.Get + - client.Head + - client.Options + - client.Post + - client.PostFile + - client.PostForm + - client.Request + - clientCloser.Close + - record.Read + - streamReader.Read + - streamWriter.Flush + - streamWriter.FlushStream + - streamWriter.Write +summary: |- + Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP + Files in github.com/caddyserver/caddy +cves: + - CVE-2026-45135 +ghsas: + - GHSA-m675-2p33-xv9g +references: + - advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g + - fix: https://github.com/caddyserver/caddy/pull/7629 + - web: https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm + - web: https://github.com/php/frankenphp/security/advisories/GHSA-g966-83w7-6w38 +source: + id: GHSA-m675-2p33-xv9g + created: 2026-07-23T19:27:41.497912-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5506.yaml b/data/reports/GO-2026-5506.yaml new file mode 100644 index 0000000..2fff936 --- /dev/null +++ b/data/reports/GO-2026-5506.yaml
@@ -0,0 +1,45 @@ +id: GO-2026-5506 +modules: + - module: go.opentelemetry.io/otel + versions: + - introduced: 1.36.0 + - fixed: 1.41.0 + vulnerable_at: 1.40.0 + packages: + - package: go.opentelemetry.io/otel/internal/global + symbols: + - ErrDelegator.Handle + - SetErrorHandler + - GetErrorHandler + derived_symbols: + - Debug + - Error + - Info + - SetMeterProvider + - SetTextMapPropagator + - SetTracerProvider + - Warn + - textMapPropagator.SetDelegate + - package: go.opentelemetry.io/otel/baggage + symbols: + - Parse + - New + - package: go.opentelemetry.io/otel/propagation + symbols: + - Baggage.Extract +summary: |- + OpenTelemetry-Go: Multi-value baggage header extraction causes excessive + allocations in go.opentelemetry.io/otel +cves: + - CVE-2026-29181 +ghsas: + - GHSA-mh2q-q3fh-2475 +references: + - advisory: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475 + - fix: https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f + - web: https://github.com/open-telemetry/opentelemetry-go/pull/7880 + - web: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0 +source: + id: GHSA-mh2q-q3fh-2475 + created: 2026-07-23T19:27:33.22405-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5525.yaml b/data/reports/GO-2026-5525.yaml new file mode 100644 index 0000000..1343d6b --- /dev/null +++ b/data/reports/GO-2026-5525.yaml
@@ -0,0 +1,29 @@ +id: GO-2026-5525 +modules: + - module: github.com/osrg/gobgp/v4 + versions: + - introduced: 4.4.0 + - fixed: 4.5.0 + vulnerable_at: 4.4.0 + packages: + - package: github.com/osrg/gobgp/v4/pkg/server + symbols: + - BgpServer.AddPeer + derived_symbols: + - NewBgpServer + - server.AddPeer +summary: |- + GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer + Dereference) in github.com/osrg/gobgp +cves: + - CVE-2026-42285 +ghsas: + - GHSA-p3w2-64xm-833j +references: + - advisory: https://github.com/osrg/gobgp/security/advisories/GHSA-p3w2-64xm-833j + - fix: https://github.com/osrg/gobgp/commit/d2d2be3e4e7915d407e662e5d388d9f8ae8a8f7b + - web: https://github.com/osrg/gobgp/releases/tag/v4.5.0 +source: + id: GHSA-p3w2-64xm-833j + created: 2026-07-23T19:27:19.18362-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5543.yaml b/data/reports/GO-2026-5543.yaml new file mode 100644 index 0000000..f0d22be --- /dev/null +++ b/data/reports/GO-2026-5543.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5543 +modules: + - module: github.com/Azure/go-ntlmssp + versions: + - fixed: 0.1.1 + vulnerable_at: 0.1.0 + packages: + - package: github.com/Azure/go-ntlmssp + symbols: + - ProcessChallenge +summary: Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp +cves: + - CVE-2026-32952 +ghsas: + - GHSA-pjcq-xvwq-hhpj +references: + - advisory: https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj + - fix: https://github.com/Azure/go-ntlmssp/commit/bd8579c18d41bf5d91a5f74b1117c958f635b866 + - web: https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1 +source: + id: GHSA-pjcq-xvwq-hhpj + created: 2026-07-23T19:03:48.90255-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5548.yaml b/data/reports/GO-2026-5548.yaml new file mode 100644 index 0000000..065d67c --- /dev/null +++ b/data/reports/GO-2026-5548.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-5548 +modules: + - module: github.com/pocketbase/pocketbase + versions: + - fixed: 0.22.42 + - introduced: 0.30.0 + - fixed: 0.37.4 + vulnerable_at: 0.37.3 + packages: + - package: github.com/pocketbase/pocketbase/apis + symbols: + - Serve +summary: |- + PocketBase: Account pre-hijacking via OAuth2 autolinking upgrade in + github.com/pocketbase/pocketbase +cves: + - CVE-2026-44166 +ghsas: + - GHSA-pq7p-mc74-g65w +references: + - advisory: https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w + - fix: https://github.com/pocketbase/pocketbase/commit/44bf55097af90c4c9dc240a8ea0d81923763a60e +source: + id: GHSA-pq7p-mc74-g65w + created: 2026-07-23T19:03:31.09473-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5566.yaml b/data/reports/GO-2026-5566.yaml new file mode 100644 index 0000000..abf99ca --- /dev/null +++ b/data/reports/GO-2026-5566.yaml
@@ -0,0 +1,27 @@ +id: GO-2026-5566 +modules: + - module: helm.sh/helm/v4 + versions: + - introduced: 4.0.0 + - fixed: 4.1.4 + vulnerable_at: 4.1.3 + packages: + - package: helm.sh/helm/v4/pkg/cmd + symbols: + - NewRootCmd +summary: |- + Helm's plugin verification fails open when .prov is missing, allowing unsigned + plugin install in helm.sh/helm +cves: + - CVE-2026-35205 +ghsas: + - GHSA-q5jf-9vfq-h4h7 +references: + - advisory: https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 + - fix: https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f + - web: https://github.com/helm/helm/releases/tag/v4.1.4 + - web: https://helm.sh/docs/topics/provenance/#the-provenance-file +source: + id: GHSA-q5jf-9vfq-h4h7 + created: 2026-07-23T19:03:24.726751-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5569.yaml b/data/reports/GO-2026-5569.yaml new file mode 100644 index 0000000..f3d1698 --- /dev/null +++ b/data/reports/GO-2026-5569.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-5569 +modules: + - module: github.com/gohugoio/hugo + versions: + - introduced: 0.60.0 + - fixed: 0.163.3 + vulnerable_at: 0.163.2 + packages: + - package: github.com/gohugoio/hugo/markup/highlight + symbols: + - WritePreStart + derived_symbols: + - chromaHighlighter.Highlight + - chromaHighlighter.HighlightCodeBlock + - chromaHighlighter.RenderCodeblock + - preWrapper.Start +summary: 'Hugo: XSS via unescaped code-fence language in default code block renderer in github.com/gohugoio/hugo' +ghsas: + - GHSA-q76j-gcg9-vxc6 +references: + - advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6 + - fix: https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d +source: + id: GHSA-q76j-gcg9-vxc6 + created: 2026-07-23T19:03:22.324954-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5585.yaml b/data/reports/GO-2026-5585.yaml new file mode 100644 index 0000000..56e42f1 --- /dev/null +++ b/data/reports/GO-2026-5585.yaml
@@ -0,0 +1,31 @@ +id: GO-2026-5585 +modules: + - module: github.com/gofiber/fiber/v2 + versions: + - fixed: 2.52.13 + vulnerable_at: 2.52.12 + packages: + - package: github.com/gofiber/fiber/v2 + symbols: + - Ctx.Format + - module: github.com/gofiber/fiber/v3 + versions: + - fixed: 3.2.0 + vulnerable_at: 3.1.0 + packages: + - package: github.com/gofiber/fiber/v3 + symbols: + - DefaultRes.AutoFormat +summary: |- + Fiber vulnerable to XSS in AutoFormat Content Negotiation in + github.com/gofiber/fiber +cves: + - CVE-2026-42554 +ghsas: + - GHSA-qjv7-627w-8qjv +references: + - advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-qjv7-627w-8qjv +source: + id: GHSA-qjv7-627w-8qjv + created: 2026-07-23T19:03:11.497237-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5593.yaml b/data/reports/GO-2026-5593.yaml new file mode 100644 index 0000000..8be69f6 --- /dev/null +++ b/data/reports/GO-2026-5593.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5593 +modules: + - module: github.com/go-acme/lego/v4 + versions: + - fixed: 4.34.0 + vulnerable_at: 4.33.0 + packages: + - package: github.com/go-acme/lego/v4/providers/http/webroot + symbols: + - HTTPProvider.Present +summary: |- + ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider + in github.com/go-acme/lego +cves: + - CVE-2026-40611 +ghsas: + - GHSA-qqx8-2xmm-jrv8 +references: + - advisory: https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8 +source: + id: GHSA-qqx8-2xmm-jrv8 + created: 2026-07-23T19:03:01.363294-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5595.yaml b/data/reports/GO-2026-5595.yaml new file mode 100644 index 0000000..c5b0253 --- /dev/null +++ b/data/reports/GO-2026-5595.yaml
@@ -0,0 +1,180 @@ +id: GO-2026-5595 +modules: + - module: github.com/caddyserver/caddy/v2 + versions: + - fixed: 2.11.4 + vulnerable_at: 2.11.3 + packages: + - package: github.com/caddyserver/caddy/v2/modules/caddyhttp/fileserver + symbols: + - FileServer.ServeHTTP + derived_symbols: + - FileServer.Provision + - FileServer.UnmarshalCaddyfile + - MatchFile.Match + - MatchFile.MatchWithError + - MatchFile.Provision + - MatchFile.UnmarshalCaddyfile + - MatchFile.Validate + - browseTemplateContext.HumanTotalFileSize + - browseTemplateContext.HumanTotalFileSizeFollowingSymlinks + - fileInfo.HasExt + - fileInfo.HumanModTime + - fileInfo.HumanSize + - statusOverrideResponseWriter.WriteHeader + - package: github.com/caddyserver/caddy/v2/modules/caddyhttp + symbols: + - MatchPath.Match + derived_symbols: + - App.Cleanup + - App.Provision + - App.Start + - App.Stop + - App.Validate + - CELMatcherImpl + - CELValueToMapStrList + - CIDRExpressionToPrefix + - Error + - HandlerError.Error + - HandlerFunc.ServeHTTP + - Invoke.ServeHTTP + - LoggableHTTPRequest.MarshalLogObject + - LoggableTLSConnState.MarshalLogObject + - MatchClientIP.CELLibrary + - MatchClientIP.Match + - MatchClientIP.MatchWithError + - MatchClientIP.Provision + - MatchClientIP.UnmarshalCaddyfile + - MatchExpression.MarshalJSON + - MatchExpression.Match + - MatchExpression.MatchWithError + - MatchExpression.Provision + - MatchExpression.UnmarshalCaddyfile + - MatchExpression.UnmarshalJSON + - MatchHeader.CELLibrary + - MatchHeader.Match + - MatchHeader.MatchWithError + - MatchHeader.UnmarshalCaddyfile + - MatchHeaderRE.CELLibrary + - MatchHeaderRE.Match + - MatchHeaderRE.MatchWithError + - MatchHeaderRE.Provision + - MatchHeaderRE.UnmarshalCaddyfile + - MatchHeaderRE.Validate + - MatchHost.CELLibrary + - MatchHost.Match + - MatchHost.MatchWithError + - MatchHost.Provision + - MatchHost.UnmarshalCaddyfile + - MatchMethod.CELLibrary + - MatchMethod.UnmarshalCaddyfile + - MatchNot.MarshalJSON + - MatchNot.Match + - MatchNot.MatchWithError + - MatchNot.Provision + - MatchNot.UnmarshalCaddyfile + - MatchNot.UnmarshalJSON + - MatchPath.CELLibrary + - MatchPath.MatchWithError + - MatchPath.UnmarshalCaddyfile + - MatchPathRE.CELLibrary + - MatchPathRE.Match + - MatchPathRE.MatchWithError + - MatchProtocol.CELLibrary + - MatchProtocol.Match + - MatchProtocol.MatchWithError + - MatchProtocol.UnmarshalCaddyfile + - MatchQuery.CELLibrary + - MatchQuery.Match + - MatchQuery.MatchWithError + - MatchQuery.UnmarshalCaddyfile + - MatchRegexp.Match + - MatchRegexp.Provision + - MatchRegexp.UnmarshalCaddyfile + - MatchRegexp.Validate + - MatchRemoteIP.CELLibrary + - MatchRemoteIP.Match + - MatchRemoteIP.MatchWithError + - MatchRemoteIP.Provision + - MatchRemoteIP.UnmarshalCaddyfile + - MatchTLS.UnmarshalCaddyfile + - MatchVarsRE.CELLibrary + - MatchVarsRE.Match + - MatchVarsRE.MatchWithError + - MatchVarsRE.Provision + - MatchVarsRE.UnmarshalCaddyfile + - MatchVarsRE.Validate + - MatcherSet.Match + - MatcherSet.MatchWithError + - MatcherSets.AnyMatch + - MatcherSets.AnyMatchWithError + - MatcherSets.FromInterface + - MatcherSets.String + - ParseCaddyfileNestedMatcherSet + - ParseNamedResponseMatcher + - PrepareRequest + - ResponseHandler.Provision + - ResponseMatcher.Match + - ResponseWriterWrapper.Push + - ResponseWriterWrapper.ReadFrom + - Route.Provision + - Route.ProvisionHandlers + - Route.ProvisionMatchers + - Route.String + - RouteList.Provision + - RouteList.ProvisionHandlers + - RouteList.ProvisionMatchers + - Server.ServeHTTP + - StaticError.ServeHTTP + - StaticError.UnmarshalCaddyfile + - StaticIPRange.Provision + - StaticResponse.ServeHTTP + - StaticResponse.UnmarshalCaddyfile + - StringArray.UnmarshalJSON + - Subroute.Provision + - Subroute.ServeHTTP + - VarsMatcher.CELLibrary + - VarsMatcher.Match + - VarsMatcher.MatchWithError + - VarsMatcher.UnmarshalCaddyfile + - VarsMiddleware.ServeHTTP + - VarsMiddleware.UnmarshalCaddyfile + - WeakString.MarshalJSON + - WeakString.UnmarshalJSON + - celHTTPRequest.Equal + - celPkixName.ConvertToType + - celPkixName.Equal + - celTypeAdapter.NativeToValue + - extraFieldsSlogHandler.Handle + - extraFieldsSlogHandler.WithAttrs + - hijackedConn.Read + - hijackedConn.ReadFrom + - hijackedConn.Write + - hijackedConn.WriteTo + - http2Conn.Read + - http2Listener.Accept + - httpRedirectConn.Read + - httpRedirectListener.Accept + - lengthReader.Close + - lengthReader.Read + - metricsInstrumentedRoute.ServeHTTP + - requestID.String + - responseRecorder.FlushError + - responseRecorder.Hijack + - responseRecorder.ReadFrom + - responseRecorder.Write + - responseRecorder.WriteHeader + - responseRecorder.WriteResponse +summary: |- + Caddy: Windows file server path authorization bypass via encoded backslash in + github.com/caddyserver/caddy +cves: + - CVE-2026-52844 +ghsas: + - GHSA-qrp7-cvwr-j2c6 +references: + - advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6 +source: + id: GHSA-qrp7-cvwr-j2c6 + created: 2026-07-23T19:02:56.304978-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5597.yaml b/data/reports/GO-2026-5597.yaml new file mode 100644 index 0000000..3dba0d1 --- /dev/null +++ b/data/reports/GO-2026-5597.yaml
@@ -0,0 +1,30 @@ +id: GO-2026-5597 +modules: + - module: github.com/go-git/go-billy/v5 + versions: + - fixed: 5.9.0 + vulnerable_at: 5.8.0 + packages: + - package: github.com/go-git/go-billy/v5/osfs + symbols: + - New + derived_symbols: + - BoundOS.Chroot + - package: github.com/go-git/go-billy/v5/helper/chroot + symbols: + - New + derived_symbols: + - ChrootHelper.Chroot +summary: Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy +cves: + - CVE-2026-44973 +ghsas: + - GHSA-qw64-3x98-g7q2 +references: + - advisory: https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2 + - fix: https://github.com/go-git/go-billy/pull/205 + - web: https://github.com/go-git/go-billy/releases/tag/v5.9.0 +source: + id: GHSA-qw64-3x98-g7q2 + created: 2026-07-23T19:02:34.36793-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5606.yaml b/data/reports/GO-2026-5606.yaml new file mode 100644 index 0000000..05ed82d --- /dev/null +++ b/data/reports/GO-2026-5606.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5606 +modules: + - module: github.com/gohugoio/hugo + versions: + - introduced: 0.162.0 + - fixed: 0.163.1 + vulnerable_at: 0.163.0 + packages: + - package: github.com/gohugoio/hugo/tpl/os + symbols: + - Namespace.Stat + - Namespace.FileExists + - package: github.com/gohugoio/hugo/config/security + symbols: + - Config.CheckAllowedHTTPURL +summary: 'Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo' +ghsas: + - GHSA-r46f-3rpw-hxrv +references: + - advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv + - fix: https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372 +source: + id: GHSA-r46f-3rpw-hxrv + created: 2026-07-23T19:02:31.501095-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5660.yaml b/data/reports/GO-2026-5660.yaml new file mode 100644 index 0000000..67f913d --- /dev/null +++ b/data/reports/GO-2026-5660.yaml
@@ -0,0 +1,29 @@ +id: GO-2026-5660 +modules: + - module: github.com/caddyserver/caddy/v2 + versions: + - fixed: 2.11.4 + vulnerable_at: 2.11.3 + packages: + - package: github.com/caddyserver/caddy/v2/modules/caddyhttp/templates + symbols: + - Templates.ServeHTTP + derived_symbols: + - TemplateContext.Cookie + - TemplateContext.NewTemplate + - Templates.Provision + - Templates.Validate + - WrappedHeader.Add + - WrappedHeader.Del + - WrappedHeader.Set +summary: 'Caddy: stripHTML template function bypass in github.com/caddyserver/caddy' +cves: + - CVE-2026-52846 +ghsas: + - GHSA-vcc4-2c75-vc9v +references: + - advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v +source: + id: GHSA-vcc4-2c75-vc9v + created: 2026-07-23T19:02:21.606423-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5666.yaml b/data/reports/GO-2026-5666.yaml new file mode 100644 index 0000000..b650a00 --- /dev/null +++ b/data/reports/GO-2026-5666.yaml
@@ -0,0 +1,35 @@ +id: GO-2026-5666 +modules: + - module: helm.sh/helm/v4 + versions: + - introduced: 4.0.0 + - fixed: 4.1.4 + vulnerable_at: 4.1.3 + packages: + - package: helm.sh/helm/v4/internal/plugin + symbols: + - Metadata.Validate + - MetadataLegacy.Validate + - MetadataV1.Validate + derived_symbols: + - ExtractTgzPluginMetadata + - FindPlugin + - FindPlugins + - LoadAll + - LoadDir + - SignPlugin +summary: |- + Helm path traversal in plugin metadata version enables arbitrary file write + outside Helm plugin directory in helm.sh/helm +cves: + - CVE-2026-35204 +ghsas: + - GHSA-vmx8-mqv2-9gmg +references: + - advisory: https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg + - fix: https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027 + - web: https://github.com/helm/helm/releases/tag/v4.1.4 +source: + id: GHSA-vmx8-mqv2-9gmg + created: 2026-07-23T19:02:12.84094-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5684.yaml b/data/reports/GO-2026-5684.yaml new file mode 100644 index 0000000..54a73ff --- /dev/null +++ b/data/reports/GO-2026-5684.yaml
@@ -0,0 +1,27 @@ +id: GO-2026-5684 +modules: + - module: github.com/ipld/go-ipld-prime + versions: + - fixed: 0.23.0 + vulnerable_at: 0.22.0 + packages: + - package: github.com/ipld/go-ipld-prime/codec/dagcbor + symbols: + - Decode + - package: github.com/ipld/go-ipld-prime/codec/dagjson + symbols: + - Decode +summary: |- + Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in + github.com/ipld/go-ipld-prime +cves: + - CVE-2026-42328 +ghsas: + - GHSA-w239-58x2-q8p5 +references: + - advisory: https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5 + - fix: https://github.com/ipld/go-ipld-prime/pull/625 +source: + id: GHSA-w239-58x2-q8p5 + created: 2026-07-23T19:02:07.668592-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5693.yaml b/data/reports/GO-2026-5693.yaml new file mode 100644 index 0000000..0f02944 --- /dev/null +++ b/data/reports/GO-2026-5693.yaml
@@ -0,0 +1,33 @@ +id: GO-2026-5693 +modules: + - module: github.com/go-git/go-git/v5 + versions: + - fixed: 5.19.1 + vulnerable_at: 5.19.0 + packages: + - package: github.com/go-git/go-git/v5/plumbing/format/packfile + symbols: + - Parser.Parse + derived_symbols: + - UpdateObjectStorage + - module: github.com/go-git/go-git/v6 + versions: + - fixed: 6.0.0-alpha.4 + vulnerable_at: 6.0.0-alpha.3 + packages: + - package: github.com/go-git/go-git/v6/plumbing/format/packfile + symbols: + - Parser.Parse + derived_symbols: + - UpdateObjectStorage +summary: |- + Go-git: Malformed Git object data may cause panics or resource exhaustion in + github.com/go-git/go-git +ghsas: + - GHSA-w5pp-99ch-qj29 +references: + - advisory: https://github.com/go-git/go-git/security/advisories/GHSA-w5pp-99ch-qj29 +source: + id: GHSA-w5pp-99ch-qj29 + created: 2026-07-23T19:01:58.776179-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5730.yaml b/data/reports/GO-2026-5730.yaml new file mode 100644 index 0000000..08531fe --- /dev/null +++ b/data/reports/GO-2026-5730.yaml
@@ -0,0 +1,162 @@ +id: GO-2026-5730 +modules: + - module: github.com/caddyserver/caddy/v2 + versions: + - introduced: 2.11.0 + - fixed: 2.11.3 + vulnerable_at: 2.11.2 + packages: + - package: github.com/caddyserver/caddy/v2/modules/caddyhttp + symbols: + - VarsMiddleware.ServeHTTP + derived_symbols: + - App.Cleanup + - App.Provision + - App.Start + - App.Stop + - App.Validate + - CELMatcherImpl + - CELValueToMapStrList + - CIDRExpressionToPrefix + - Error + - HandlerError.Error + - HandlerFunc.ServeHTTP + - Invoke.ServeHTTP + - LoggableHTTPHeader.MarshalLogObject + - LoggableHTTPRequest.MarshalLogObject + - LoggableTLSConnState.MarshalLogObject + - MatchClientIP.CELLibrary + - MatchClientIP.Match + - MatchClientIP.MatchWithError + - MatchClientIP.Provision + - MatchClientIP.UnmarshalCaddyfile + - MatchExpression.MarshalJSON + - MatchExpression.Match + - MatchExpression.MatchWithError + - MatchExpression.Provision + - MatchExpression.UnmarshalCaddyfile + - MatchExpression.UnmarshalJSON + - MatchHeader.CELLibrary + - MatchHeader.Match + - MatchHeader.MatchWithError + - MatchHeader.UnmarshalCaddyfile + - MatchHeaderRE.CELLibrary + - MatchHeaderRE.Match + - MatchHeaderRE.MatchWithError + - MatchHeaderRE.Provision + - MatchHeaderRE.UnmarshalCaddyfile + - MatchHeaderRE.Validate + - MatchHost.CELLibrary + - MatchHost.Match + - MatchHost.MatchWithError + - MatchHost.Provision + - MatchHost.UnmarshalCaddyfile + - MatchMethod.CELLibrary + - MatchMethod.UnmarshalCaddyfile + - MatchNot.MarshalJSON + - MatchNot.Match + - MatchNot.MatchWithError + - MatchNot.Provision + - MatchNot.UnmarshalCaddyfile + - MatchNot.UnmarshalJSON + - MatchPath.CELLibrary + - MatchPath.Match + - MatchPath.MatchWithError + - MatchPath.UnmarshalCaddyfile + - MatchPathRE.CELLibrary + - MatchPathRE.Match + - MatchPathRE.MatchWithError + - MatchProtocol.CELLibrary + - MatchProtocol.Match + - MatchProtocol.MatchWithError + - MatchProtocol.UnmarshalCaddyfile + - MatchQuery.CELLibrary + - MatchQuery.Match + - MatchQuery.MatchWithError + - MatchQuery.UnmarshalCaddyfile + - MatchRegexp.Match + - MatchRegexp.Provision + - MatchRegexp.UnmarshalCaddyfile + - MatchRegexp.Validate + - MatchRemoteIP.CELLibrary + - MatchRemoteIP.Match + - MatchRemoteIP.MatchWithError + - MatchRemoteIP.Provision + - MatchRemoteIP.UnmarshalCaddyfile + - MatchTLS.UnmarshalCaddyfile + - MatchVarsRE.CELLibrary + - MatchVarsRE.Match + - MatchVarsRE.MatchWithError + - MatchVarsRE.Provision + - MatchVarsRE.UnmarshalCaddyfile + - MatchVarsRE.Validate + - MatcherSet.Match + - MatcherSet.MatchWithError + - MatcherSets.AnyMatch + - MatcherSets.AnyMatchWithError + - MatcherSets.FromInterface + - MatcherSets.String + - ParseCaddyfileNestedMatcherSet + - ParseNamedResponseMatcher + - PrepareRequest + - ResponseHandler.Provision + - ResponseMatcher.Match + - ResponseWriterWrapper.Push + - ResponseWriterWrapper.ReadFrom + - Route.Provision + - Route.ProvisionHandlers + - Route.ProvisionMatchers + - Route.String + - RouteList.Provision + - RouteList.ProvisionHandlers + - RouteList.ProvisionMatchers + - Server.ServeHTTP + - StaticError.ServeHTTP + - StaticError.UnmarshalCaddyfile + - StaticIPRange.Provision + - StaticResponse.ServeHTTP + - StaticResponse.UnmarshalCaddyfile + - StringArray.UnmarshalJSON + - Subroute.Provision + - Subroute.ServeHTTP + - VarsMatcher.CELLibrary + - VarsMatcher.Match + - VarsMatcher.MatchWithError + - VarsMatcher.UnmarshalCaddyfile + - VarsMiddleware.UnmarshalCaddyfile + - WeakString.MarshalJSON + - WeakString.UnmarshalJSON + - celHTTPRequest.Equal + - celPkixName.ConvertToType + - celPkixName.Equal + - celTypeAdapter.NativeToValue + - extraFieldsSlogHandler.Handle + - extraFieldsSlogHandler.WithAttrs + - hijackedConn.Read + - hijackedConn.ReadFrom + - hijackedConn.Write + - hijackedConn.WriteTo + - http2Conn.Read + - http2Listener.Accept + - httpRedirectConn.Read + - httpRedirectListener.Accept + - lengthReader.Close + - lengthReader.Read + - metricsInstrumentedRoute.ServeHTTP + - requestID.String + - responseRecorder.FlushError + - responseRecorder.Hijack + - responseRecorder.ReadFrom + - responseRecorder.Write + - responseRecorder.WriteHeader + - responseRecorder.WriteResponse +summary: Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy +ghsas: + - GHSA-wwhq-w58m-w29c +references: + - advisory: https://github.com/caddyserver/caddy/security/advisories/GHSA-wwhq-w58m-w29c + - fix: https://github.com/caddyserver/caddy/pull/7629 +source: + id: GHSA-wwhq-w58m-w29c + created: 2026-07-23T19:01:57.551182-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5736.yaml b/data/reports/GO-2026-5736.yaml new file mode 100644 index 0000000..177d6af --- /dev/null +++ b/data/reports/GO-2026-5736.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-5736 +modules: + - module: go.etcd.io/etcd/server/v3 + versions: + - introduced: 3.5.0 + - fixed: 3.5.30 + - introduced: 3.6.0 + - fixed: 3.6.11 + non_go_versions: + - fixed: 3.4.44 + vulnerable_at: 3.6.10 + packages: + - package: go.etcd.io/etcd/server/v3/etcdserver + symbols: + - EtcdServer.Txn +summary: Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server +cves: + - CVE-2026-44283 +ghsas: + - GHSA-x35m-3gp4-4fh5 +references: + - advisory: https://github.com/etcd-io/etcd/security/advisories/GHSA-x35m-3gp4-4fh5 +source: + id: GHSA-x35m-3gp4-4fh5 + created: 2026-07-23T19:01:40.095942-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5740.yaml b/data/reports/GO-2026-5740.yaml new file mode 100644 index 0000000..8cd8830 --- /dev/null +++ b/data/reports/GO-2026-5740.yaml
@@ -0,0 +1,44 @@ +id: GO-2026-5740 +modules: + - module: github.com/gohugoio/hugo + versions: + - fixed: 0.161.0 + non_go_versions: + - introduced: 0.43.0 + vulnerable_at: 0.160.1 + packages: + - package: github.com/gohugoio/hugo/config/security + symbols: + - DecodeConfig + - package: github.com/gohugoio/hugo/common/hexec + symbols: + - New + - Exec.Npx + - package: github.com/gohugoio/hugo/resources/resource_transformers/babel + symbols: + - New + derived_symbols: + - DecodeOptions + - babelTransformation.Transform + - package: github.com/gohugoio/hugo/common/hugo + symbols: + - GetExecEnviron + - package: github.com/gohugoio/hugo/deps + symbols: + - Deps.Init + derived_symbols: + - Deps.Clone +summary: |- + Hugo's Node tool execution allows file system access outside the project + directory in github.com/gohugoio/hugo +cves: + - CVE-2026-44301 +ghsas: + - GHSA-x597-9fr4-5857 +references: + - advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-x597-9fr4-5857 + - fix: https://github.com/gohugoio/hugo/commit/a54c398b93821865547a9e21c73aad8a1d7f7bc1 +source: + id: GHSA-x597-9fr4-5857 + created: 2026-07-23T19:01:33.653898-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5774.yaml b/data/reports/GO-2026-5774.yaml new file mode 100644 index 0000000..7cfebad --- /dev/null +++ b/data/reports/GO-2026-5774.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5774 +modules: + - module: github.com/go-chi/chi/v5 + versions: + - introduced: 5.2.1 + - fixed: 5.3.0 + vulnerable_at: 5.2.5 + packages: + - package: github.com/go-chi/chi/v5/middleware + symbols: + - RealIP +summary: |- + Chi has an IP spoofing vulnerability in middleware.RealIP in + github.com/go-chi/chi +ghsas: + - GHSA-3fxj-6jh8-hvhx +references: + - advisory: https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx + - fix: https://github.com/go-chi/chi/pull/967 +source: + id: GHSA-3fxj-6jh8-hvhx + created: 2026-07-23T19:00:23.852225-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5775.yaml b/data/reports/GO-2026-5775.yaml new file mode 100644 index 0000000..8859a8d --- /dev/null +++ b/data/reports/GO-2026-5775.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5775 +modules: + - module: github.com/go-chi/chi/v5 + versions: + - fixed: 5.3.0 + vulnerable_at: 5.2.5 + packages: + - package: github.com/go-chi/chi/v5/middleware + symbols: + - RealIP +summary: |- + Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in + github.com/go-chi/chi +ghsas: + - GHSA-9g5q-2w5x-hmxf +references: + - advisory: https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf + - fix: https://github.com/go-chi/chi/pull/967 + - web: https://github.com/go-chi/chi/releases/tag/v5.3.0 +source: + id: GHSA-9g5q-2w5x-hmxf + created: 2026-07-23T19:00:22.301737-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5777.yaml b/data/reports/GO-2026-5777.yaml new file mode 100644 index 0000000..7279802 --- /dev/null +++ b/data/reports/GO-2026-5777.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5777 +modules: + - module: github.com/go-chi/chi/v5 + versions: + - fixed: 5.3.0 + vulnerable_at: 5.2.5 + packages: + - package: github.com/go-chi/chi/v5/middleware + symbols: + - RealIP +summary: |- + Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For + header in github.com/go-chi/chi +ghsas: + - GHSA-rjr7-jggh-pgcp +references: + - advisory: https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp + - fix: https://github.com/go-chi/chi/pull/967 + - web: https://github.com/go-chi/chi/releases/tag/v5.3.0 +source: + id: GHSA-rjr7-jggh-pgcp + created: 2026-07-23T19:00:16.426726-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5879.yaml b/data/reports/GO-2026-5879.yaml new file mode 100644 index 0000000..bb1dbfd --- /dev/null +++ b/data/reports/GO-2026-5879.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5879 +modules: + - module: oras.land/oras-go/v2 + versions: + - fixed: 2.6.1 + vulnerable_at: 2.6.0 + packages: + - package: oras.land/oras-go/v2/content/file + symbols: + - New + - Store.Add +summary: |- + Oras-go: File store write outside workingDir via symlink traversal in + oras.land/oras-go +cves: + - CVE-2026-50162 +ghsas: + - GHSA-8xwf-rjm4-xvhv +references: + - advisory: https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv + - fix: https://github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5 +source: + id: GHSA-8xwf-rjm4-xvhv + created: 2026-07-23T19:00:04.313104-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5880.yaml b/data/reports/GO-2026-5880.yaml new file mode 100644 index 0000000..c6eee9a --- /dev/null +++ b/data/reports/GO-2026-5880.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5880 +modules: + - module: oras.land/oras-go/v2 + versions: + - fixed: 2.6.2 + vulnerable_at: 2.6.1 + packages: + - package: oras.land/oras-go/v2/content/file + symbols: + - New + - Store.Add +summary: Hardlink path traversal during tar extraction in oras.land/oras-go +cves: + - CVE-2026-50163 +ghsas: + - GHSA-fxhp-mv3v-67qp +references: + - advisory: https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp + - fix: https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406 +source: + id: GHSA-fxhp-mv3v-67qp + created: 2026-07-23T18:59:55.246268-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5882.yaml b/data/reports/GO-2026-5882.yaml new file mode 100644 index 0000000..f7bd3af --- /dev/null +++ b/data/reports/GO-2026-5882.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-5882 +modules: + - module: oras.land/oras-go/v2 + versions: + - fixed: 2.6.1 + vulnerable_at: 2.6.0 + packages: + - package: oras.land/oras-go/v2/registry/remote + symbols: + - Repository.Push +summary: |- + Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location + header in oras.land/oras-go +cves: + - CVE-2026-50151 +ghsas: + - GHSA-jxpm-75mh-9fp7 +references: + - advisory: https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7 + - fix: https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991 + - fix: https://github.com/oras-project/oras-go/pull/1152 + - web: https://github.com/oras-project/oras-go/releases/tag/v2.6.1 +source: + id: GHSA-jxpm-75mh-9fp7 + created: 2026-07-23T18:59:48.989162-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5884.yaml b/data/reports/GO-2026-5884.yaml new file mode 100644 index 0000000..6ab5856 --- /dev/null +++ b/data/reports/GO-2026-5884.yaml
@@ -0,0 +1,23 @@ +id: GO-2026-5884 +modules: + - module: oras.land/oras-go/v2 + versions: + - fixed: 2.6.1 + vulnerable_at: 2.6.0 + packages: + - package: oras.land/oras-go/v2/registry/remote/auth + symbols: + - Client.Do +summary: |- + ORAS Go forwards registry credentials across registry redirects in + oras.land/oras-go +ghsas: + - GHSA-vh4v-2xq2-g5cg +references: + - advisory: https://github.com/oras-project/oras-go/security/advisories/GHSA-vh4v-2xq2-g5cg + - fix: https://github.com/oras-project/oras-go/commit/3c2e884e12ea52b6bff60c97f1edb7df7d0e0909 + - web: https://github.com/oras-project/oras-go/releases/tag/v2.6.1 +source: + id: GHSA-vh4v-2xq2-g5cg + created: 2026-07-23T18:59:46.191242-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5885.yaml b/data/reports/GO-2026-5885.yaml new file mode 100644 index 0000000..4f3dd06 --- /dev/null +++ b/data/reports/GO-2026-5885.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5885 +modules: + - module: oras.land/oras-go/v2 + versions: + - fixed: 2.6.1 + vulnerable_at: 2.6.0 + packages: + - package: oras.land/oras-go/v2/registry/remote/auth + symbols: + - Client.Do +summary: |- + Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate + credentials and refresh tokens in oras.land/oras-go +cves: + - CVE-2026-48978 +ghsas: + - GHSA-xf85-363p-868w +references: + - advisory: https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w + - fix: https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764 + - web: https://github.com/oras-project/oras-go/releases/tag/v2.6.1 +source: + id: GHSA-xf85-363p-868w + created: 2026-07-23T18:59:41.521255-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5886.yaml b/data/reports/GO-2026-5886.yaml new file mode 100644 index 0000000..2cdbd0a --- /dev/null +++ b/data/reports/GO-2026-5886.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-5886 +modules: + - module: github.com/gofiber/fiber/v3 + versions: + - fixed: 3.3.0 + vulnerable_at: 3.2.0 + packages: + - package: github.com/gofiber/fiber/v3/middleware/basicauth + symbols: + - New +summary: |- + GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth + Default Authorizer in github.com/gofiber/fiber +cves: + - CVE-2026-44332 +ghsas: + - GHSA-g5vh-55hw-rxm8 +references: + - advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8 + - fix: https://github.com/gofiber/fiber/pull/4245 +source: + id: GHSA-g5vh-55hw-rxm8 + created: 2026-07-23T18:59:36.29971-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5887.yaml b/data/reports/GO-2026-5887.yaml new file mode 100644 index 0000000..78113e2 --- /dev/null +++ b/data/reports/GO-2026-5887.yaml
@@ -0,0 +1,25 @@ +id: GO-2026-5887 +modules: + - module: github.com/gofiber/fiber/v3 + versions: + - fixed: 3.3.0 + vulnerable_at: 3.2.0 + packages: + - package: github.com/gofiber/fiber/v3/middleware/proxy + symbols: + - BalancerForward + - Balancer +summary: |- + GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward in + github.com/gofiber/fiber +cves: + - CVE-2026-45045 +ghsas: + - GHSA-gcfq-8gqf-4876 +references: + - advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-gcfq-8gqf-4876 + - fix: https://github.com/gofiber/fiber/pull/4260 +source: + id: GHSA-gcfq-8gqf-4876 + created: 2026-07-23T18:59:31.20324-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5912.yaml b/data/reports/GO-2026-5912.yaml new file mode 100644 index 0000000..ead7236 --- /dev/null +++ b/data/reports/GO-2026-5912.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-5912 +modules: + - module: github.com/gofiber/fiber/v3 + versions: + - fixed: 3.4.0 + vulnerable_at: 3.3.0 + packages: + - package: github.com/gofiber/fiber/v3/middleware/helmet + symbols: + - New +summary: |- + GoFiber never set HSTS header in helmet middleware due to incorrect protocol + check in github.com/gofiber/fiber +cves: + - CVE-2026-53624 +ghsas: + - GHSA-gv83-gqw6-9j2c +references: + - advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c + - fix: https://github.com/gofiber/fiber/pull/4389 +source: + id: GHSA-gv83-gqw6-9j2c + created: 2026-07-23T18:59:26.130614-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5954.yaml b/data/reports/GO-2026-5954.yaml new file mode 100644 index 0000000..fd09bfe --- /dev/null +++ b/data/reports/GO-2026-5954.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-5954 +modules: + - module: github.com/osrg/gobgp/v4 + versions: + - fixed: 4.7.0 + vulnerable_at: 4.6.0 + packages: + - package: github.com/osrg/gobgp/v4/pkg/packet/bgp + symbols: + - ValidateAttribute + derived_symbols: + - ValidateUpdateMsg +summary: |- + GoBGP confederation validation panics on empty AS_PATH attribute in + github.com/osrg/gobgp +cves: + - CVE-2026-49838 +ghsas: + - GHSA-frrj-87jh-2772 +references: + - advisory: https://github.com/osrg/gobgp/security/advisories/GHSA-frrj-87jh-2772 + - fix: https://github.com/osrg/gobgp/commit/4a319a6c25630fb3cdbda3e9ccfe56e702bdaaa0 +source: + id: GHSA-frrj-87jh-2772 + created: 2026-07-23T18:59:21.117374-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5955.yaml b/data/reports/GO-2026-5955.yaml new file mode 100644 index 0000000..4eb180f --- /dev/null +++ b/data/reports/GO-2026-5955.yaml
@@ -0,0 +1,34 @@ +id: GO-2026-5955 +modules: + - module: github.com/osrg/gobgp/v4 + versions: + - fixed: 4.6.0 + vulnerable_at: 4.5.0 + packages: + - package: github.com/osrg/gobgp/v4/pkg/packet/bgp + symbols: + - CapFourOctetASNumber.DecodeFromBytes + - CapGracefulRestart.DecodeFromBytes + - CapMultiProtocol.DecodeFromBytes + - CapFQDN.DecodeFromBytes + - CapSoftwareVersion.DecodeFromBytes + derived_symbols: + - BGPOpen.DecodeFromBytes + - DecodeCapability + - OptionParameterCapability.DecodeFromBytes + - ParseBGPBody + - ParseBGPMessage +summary: |- + GoBGP: BGP OPEN capability parser may read capability values outside declared + CapLen boundaries in github.com/osrg/gobgp +cves: + - CVE-2026-49837 +ghsas: + - GHSA-gjrg-jjr3-56cm +references: + - advisory: https://github.com/osrg/gobgp/security/advisories/GHSA-gjrg-jjr3-56cm + - fix: https://github.com/osrg/gobgp/commit/f02ca397821f6ca182ef4eb492c3cbc459552d7c +source: + id: GHSA-gjrg-jjr3-56cm + created: 2026-07-23T18:59:16.147389-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-5971.yaml b/data/reports/GO-2026-5971.yaml new file mode 100644 index 0000000..e053056 --- /dev/null +++ b/data/reports/GO-2026-5971.yaml
@@ -0,0 +1,28 @@ +id: GO-2026-5971 +modules: + - module: github.com/osrg/gobgp/v4 + versions: + - fixed: 4.4.0 + vulnerable_at: 4.3.0 + packages: + - package: github.com/osrg/gobgp/v4/pkg/packet/bgp + symbols: + - BGPUpdate.DecodeFromBytes + derived_symbols: + - ParseBGPBody + - ParseBGPMessage +summary: |- + GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function in + github.com/osrg/gobgp +cves: + - CVE-2026-37462 +ghsas: + - GHSA-pw7p-7fqv-hpj8 +references: + - advisory: https://github.com/advisories/GHSA-pw7p-7fqv-hpj8 + - fix: https://github.com/osrg/gobgp/commit/9ce8936672ebc07df524da77fa4c6ae26d92be6d + - web: https://github.com/osrg/gobgp/blob/v4.3.0/pkg/packet/bgp/bgp.go +source: + id: GHSA-pw7p-7fqv-hpj8 + created: 2026-07-23T18:58:55.147181-04:00 +review_status: REVIEWED