data/reports: add 18 reports - data/reports/GO-2026-6444.yaml - data/reports/GO-2026-6445.yaml - data/reports/GO-2026-6446.yaml - data/reports/GO-2026-6447.yaml - data/reports/GO-2026-6448.yaml - data/reports/GO-2026-6449.yaml - data/reports/GO-2026-6450.yaml - data/reports/GO-2026-6451.yaml - data/reports/GO-2026-6454.yaml - data/reports/GO-2026-6455.yaml - data/reports/GO-2026-6465.yaml - data/reports/GO-2026-6466.yaml - data/reports/GO-2026-6467.yaml - data/reports/GO-2026-6468.yaml - data/reports/GO-2026-6469.yaml - data/reports/GO-2026-6470.yaml - data/reports/GO-2026-6473.yaml - data/reports/GO-2026-6474.yaml Fixes golang/vulndb#6444 Fixes golang/vulndb#6445 Fixes golang/vulndb#6446 Fixes golang/vulndb#6447 Fixes golang/vulndb#6448 Fixes golang/vulndb#6449 Fixes golang/vulndb#6450 Fixes golang/vulndb#6451 Fixes golang/vulndb#6454 Fixes golang/vulndb#6455 Fixes golang/vulndb#6465 Fixes golang/vulndb#6466 Fixes golang/vulndb#6467 Fixes golang/vulndb#6468 Fixes golang/vulndb#6469 Fixes golang/vulndb#6470 Fixes golang/vulndb#6473 Fixes golang/vulndb#6474 Change-Id: I52ba102d20941a4438538887faec85764c4a1168 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/832904 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <nealpatel@google.com> Auto-Submit: Ian Alexander <jitsu@google.com>
diff --git a/data/osv/GO-2026-6444.json b/data/osv/GO-2026-6444.json new file mode 100644 index 0000000..a81f0aa --- /dev/null +++ b/data/osv/GO-2026-6444.json
@@ -0,0 +1,92 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6444", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-53495", + "GHSA-7jxh-36q5-gcqv" + ], + "summary": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd", + "details": "containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd", + "affected": [ + { + "package": { + "name": "github.com/containerd/containerd", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.7.35" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/containerd/containerd/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.12" + }, + { + "introduced": "2.2.0" + }, + { + "fixed": "2.2.8" + }, + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv" + }, + { + "type": "WEB", + "url": "https://github.com/containerd/containerd/releases/tag/v1.7.35" + }, + { + "type": "WEB", + "url": "https://github.com/containerd/containerd/releases/tag/v2.0.12" + }, + { + "type": "WEB", + "url": "https://github.com/containerd/containerd/releases/tag/v2.2.8" + }, + { + "type": "WEB", + "url": "https://github.com/containerd/containerd/releases/tag/v2.3.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6444", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6445.json b/data/osv/GO-2026-6445.json new file mode 100644 index 0000000..d7c6e6c --- /dev/null +++ b/data/osv/GO-2026-6445.json
@@ -0,0 +1,65 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6445", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2025-58363", + "GHSA-c23q-fw86-9h5x" + ], + "summary": "LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper", + "details": "LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper", + "affected": [ + { + "package": { + "name": "github.com/lf-edge/ekuiper", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/lf-edge/ekuiper/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.1" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-c23q-fw86-9h5x" + }, + { + "type": "WEB", + "url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.4.1" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6445", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6446.json b/data/osv/GO-2026-6446.json new file mode 100644 index 0000000..f481c92 --- /dev/null +++ b/data/osv/GO-2026-6446.json
@@ -0,0 +1,65 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6446", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2025-24978", + "GHSA-g8rh-fjm6-h2h9" + ], + "summary": "LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper", + "details": "LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper", + "affected": [ + { + "package": { + "name": "github.com/lf-edge/ekuiper", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/lf-edge/ekuiper/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.0" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-g8rh-fjm6-h2h9" + }, + { + "type": "WEB", + "url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.4.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6446", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6447.json b/data/osv/GO-2026-6447.json new file mode 100644 index 0000000..b9af53e --- /dev/null +++ b/data/osv/GO-2026-6447.json
@@ -0,0 +1,65 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6447", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2025-24979", + "GHSA-pqqc-8v73-9gg2" + ], + "summary": "LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper", + "details": "LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper", + "affected": [ + { + "package": { + "name": "github.com/lf-edge/ekuiper", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/lf-edge/ekuiper/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.0" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-pqqc-8v73-9gg2" + }, + { + "type": "WEB", + "url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.4.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6447", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6448.json b/data/osv/GO-2026-6448.json new file mode 100644 index 0000000..b03be94 --- /dev/null +++ b/data/osv/GO-2026-6448.json
@@ -0,0 +1,52 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6448", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-59185", + "GHSA-cp3j-m783-3ph5" + ], + "summary": "Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail", + "details": "Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail", + "affected": [ + { + "package": { + "name": "github.com/identrail/identrail", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.2" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5" + }, + { + "type": "FIX", + "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7" + }, + { + "type": "WEB", + "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6448", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6449.json b/data/osv/GO-2026-6449.json new file mode 100644 index 0000000..8b73b69 --- /dev/null +++ b/data/osv/GO-2026-6449.json
@@ -0,0 +1,47 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6449", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "GHSA-hxjg-93wc-h8p8" + ], + "summary": "Komari: Management Interface CSRF in github.com/komari-monitor/komari", + "details": "Komari: Management Interface CSRF in github.com/komari-monitor/komari", + "affected": [ + { + "package": { + "name": "github.com/komari-monitor/komari", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20260609084633-98122fa4d110" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/komari-monitor/komari/security/advisories/GHSA-hxjg-93wc-h8p8" + }, + { + "type": "WEB", + "url": "https://github.com/komari-monitor/komari/releases/tag/1.2.2" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6449", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6450.json b/data/osv/GO-2026-6450.json new file mode 100644 index 0000000..556a3ec --- /dev/null +++ b/data/osv/GO-2026-6450.json
@@ -0,0 +1,44 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6450", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-59172", + "GHSA-m835-3cm9-rggg" + ], + "summary": "Joker linter executed project-local .jokerd/linter.* files during linting in github.com/candid82/joker", + "details": "Joker linter executed project-local .jokerd/linter.* files during linting in github.com/candid82/joker", + "affected": [ + { + "package": { + "name": "github.com/candid82/joker", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.8.2" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6450", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6451.json b/data/osv/GO-2026-6451.json new file mode 100644 index 0000000..f20e63d --- /dev/null +++ b/data/osv/GO-2026-6451.json
@@ -0,0 +1,48 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6451", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-59157", + "GHSA-v25g-mvwr-f5fp" + ], + "summary": "webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd", + "details": "webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd", + "affected": [ + { + "package": { + "name": "github.com/ncarlier/webhookd", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.22.0" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp" + }, + { + "type": "WEB", + "url": "https://github.com/ncarlier/webhookd/releases/tag/v1.22.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6451", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6454.json b/data/osv/GO-2026-6454.json new file mode 100644 index 0000000..a85d221 --- /dev/null +++ b/data/osv/GO-2026-6454.json
@@ -0,0 +1,101 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6454", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-88012", + "GHSA-7ghq-v6jf-g56c" + ], + "summary": "Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik", + "details": "Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik", + "affected": [ + { + "package": { + "name": "github.com/traefik/traefik", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.8.2" + }, + { + "fixed": "2.11.56" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.7.12" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88012" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/pull/13717" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.56" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.7.12" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6454", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6455.json b/data/osv/GO-2026-6455.json new file mode 100644 index 0000000..c392121 --- /dev/null +++ b/data/osv/GO-2026-6455.json
@@ -0,0 +1,101 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6455", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-88011", + "GHSA-rf44-j88r-hh8c" + ], + "summary": "Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik", + "details": "Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik", + "affected": [ + { + "package": { + "name": "github.com/traefik/traefik", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.56" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.7.12" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88011" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/pull/13720" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.56" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.7.12" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6455", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6465.json b/data/osv/GO-2026-6465.json new file mode 100644 index 0000000..ce6bf47 --- /dev/null +++ b/data/osv/GO-2026-6465.json
@@ -0,0 +1,101 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6465", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-88009", + "GHSA-f52w-8j3h-j724" + ], + "summary": "Traefik: Rootless HTTP/1 request-target routes as \"/\" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik", + "details": "Traefik: Rootless HTTP/1 request-target routes as \"/\" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik", + "affected": [ + { + "package": { + "name": "github.com/traefik/traefik", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.57" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.7.13" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88009" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/pull/13796" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.57" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.7.13" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6465", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6466.json b/data/osv/GO-2026-6466.json new file mode 100644 index 0000000..790f091 --- /dev/null +++ b/data/osv/GO-2026-6466.json
@@ -0,0 +1,101 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6466", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-88007", + "GHSA-qqjf-53cj-pwvv" + ], + "summary": "Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik", + "details": "Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik", + "affected": [ + { + "package": { + "name": "github.com/traefik/traefik", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.11.57" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.7.13" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88007" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/commit/ff39c47d7459dec9cd8de63c1a4e7aa7315bdc1c" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/pull/13812" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.57" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.7.13" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6466", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6467.json b/data/osv/GO-2026-6467.json new file mode 100644 index 0000000..5c2d9a6 --- /dev/null +++ b/data/osv/GO-2026-6467.json
@@ -0,0 +1,94 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6467", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-88004", + "GHSA-v67p-phpq-fc8x" + ], + "summary": "Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik", + "details": "Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik", + "affected": [ + { + "package": { + "name": "github.com/traefik/traefik", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.2.0" + }, + { + "fixed": "3.7.13" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88004" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/pull/13822" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.7.13" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6467", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6468.json b/data/osv/GO-2026-6468.json new file mode 100644 index 0000000..114ef19 --- /dev/null +++ b/data/osv/GO-2026-6468.json
@@ -0,0 +1,101 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6468", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-88008", + "GHSA-w4v4-9rw7-5326" + ], + "summary": "Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik", + "details": "Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik", + "affected": [ + { + "package": { + "name": "github.com/traefik/traefik", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.11.26" + }, + { + "fixed": "2.11.57" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/traefik/traefik/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "3.4.2" + }, + { + "fixed": "3.7.13" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88008" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3" + }, + { + "type": "FIX", + "url": "https://github.com/traefik/traefik/pull/13797" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.57" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.7.13" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6468", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6469.json b/data/osv/GO-2026-6469.json new file mode 100644 index 0000000..f218c32 --- /dev/null +++ b/data/osv/GO-2026-6469.json
@@ -0,0 +1,81 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6469", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-56665", + "GHSA-v77h-2w3m-94hx" + ], + "summary": "ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel", + "details": "ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v3.4.12, from v4.0.0-rc.1 before v4.15.2.", + "affected": [ + { + "package": { + "name": "github.com/zitadel/zitadel", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.12" + }, + { + "introduced": "4.0.0-rc.1" + }, + { + "fixed": "4.15.2" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56665" + }, + { + "type": "FIX", + "url": "https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8" + }, + { + "type": "FIX", + "url": "https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac" + }, + { + "type": "WEB", + "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.12" + }, + { + "type": "WEB", + "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.2" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6469", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6470.json b/data/osv/GO-2026-6470.json new file mode 100644 index 0000000..32e976d --- /dev/null +++ b/data/osv/GO-2026-6470.json
@@ -0,0 +1,67 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6470", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-56666", + "GHSA-992q-9gwp-7r79" + ], + "summary": "ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel", + "details": "ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v4.15.3.", + "affected": [ + { + "package": { + "name": "github.com/zitadel/zitadel", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.15.3" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56666" + }, + { + "type": "FIX", + "url": "https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f" + }, + { + "type": "WEB", + "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6470", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6473.json b/data/osv/GO-2026-6473.json new file mode 100644 index 0000000..b432823 --- /dev/null +++ b/data/osv/GO-2026-6473.json
@@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6473", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-76081", + "GHSA-v859-c572-qh5p" + ], + "summary": "ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel", + "details": "ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v4.16.0.", + "affected": [ + { + "package": { + "name": "github.com/zitadel/zitadel", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.16.0" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p" + }, + { + "type": "FIX", + "url": "https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59" + }, + { + "type": "WEB", + "url": "https://github.com/zitadel/zitadel/releases/tag/v4.16.0" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6473", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6474.json b/data/osv/GO-2026-6474.json new file mode 100644 index 0000000..68ee0fc --- /dev/null +++ b/data/osv/GO-2026-6474.json
@@ -0,0 +1,67 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6474", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-56668", + "GHSA-vrh8-c9cm-wh8v" + ], + "summary": "ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange in github.com/zitadel/zitadel", + "details": "ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v4.15.3.", + "affected": [ + { + "package": { + "name": "github.com/zitadel/zitadel", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.15.3" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56668" + }, + { + "type": "FIX", + "url": "https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc" + }, + { + "type": "WEB", + "url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.3" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6474", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/reports/GO-2026-6444.yaml b/data/reports/GO-2026-6444.yaml new file mode 100644 index 0000000..e9377ba --- /dev/null +++ b/data/reports/GO-2026-6444.yaml
@@ -0,0 +1,29 @@ +id: GO-2026-6444 +modules: + - module: github.com/containerd/containerd + versions: + - fixed: 1.7.35 + vulnerable_at: 1.7.34 + - module: github.com/containerd/containerd/v2 + versions: + - fixed: 2.0.12 + - introduced: 2.2.0 + - fixed: 2.2.8 + - introduced: 2.3.0 + - fixed: 2.3.5 + vulnerable_at: 2.3.4 +summary: 'containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd' +cves: + - CVE-2026-53495 +ghsas: + - GHSA-7jxh-36q5-gcqv +references: + - advisory: https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv + - web: https://github.com/containerd/containerd/releases/tag/v1.7.35 + - web: https://github.com/containerd/containerd/releases/tag/v2.0.12 + - web: https://github.com/containerd/containerd/releases/tag/v2.2.8 + - web: https://github.com/containerd/containerd/releases/tag/v2.3.5 +source: + id: GHSA-7jxh-36q5-gcqv + created: 2026-09-15T11:22:10.636227-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6445.yaml b/data/reports/GO-2026-6445.yaml new file mode 100644 index 0000000..198eeb3 --- /dev/null +++ b/data/reports/GO-2026-6445.yaml
@@ -0,0 +1,22 @@ +id: GO-2026-6445 +modules: + - module: github.com/lf-edge/ekuiper + vulnerable_at: 1.14.7 + - module: github.com/lf-edge/ekuiper/v2 + versions: + - fixed: 2.4.1 + vulnerable_at: 2.4.0 +summary: |- + LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in + Plugin Installation Endpoint in github.com/lf-edge/ekuiper +cves: + - CVE-2025-58363 +ghsas: + - GHSA-c23q-fw86-9h5x +references: + - advisory: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-c23q-fw86-9h5x + - web: https://github.com/lf-edge/ekuiper/releases/tag/v2.4.1 +source: + id: GHSA-c23q-fw86-9h5x + created: 2026-09-15T11:22:03.639299-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6446.yaml b/data/reports/GO-2026-6446.yaml new file mode 100644 index 0000000..a435c5c --- /dev/null +++ b/data/reports/GO-2026-6446.yaml
@@ -0,0 +1,20 @@ +id: GO-2026-6446 +modules: + - module: github.com/lf-edge/ekuiper + vulnerable_at: 1.14.7 + - module: github.com/lf-edge/ekuiper/v2 + versions: + - fixed: 2.4.0 + vulnerable_at: 2.4.0-beta.10 +summary: 'LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper' +cves: + - CVE-2025-24978 +ghsas: + - GHSA-g8rh-fjm6-h2h9 +references: + - advisory: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-g8rh-fjm6-h2h9 + - web: https://github.com/lf-edge/ekuiper/releases/tag/v2.4.0 +source: + id: GHSA-g8rh-fjm6-h2h9 + created: 2026-09-15T11:21:57.450675-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6447.yaml b/data/reports/GO-2026-6447.yaml new file mode 100644 index 0000000..82dd925 --- /dev/null +++ b/data/reports/GO-2026-6447.yaml
@@ -0,0 +1,20 @@ +id: GO-2026-6447 +modules: + - module: github.com/lf-edge/ekuiper + vulnerable_at: 1.14.7 + - module: github.com/lf-edge/ekuiper/v2 + versions: + - fixed: 2.4.0 + vulnerable_at: 2.4.0-beta.10 +summary: 'LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper' +cves: + - CVE-2025-24979 +ghsas: + - GHSA-pqqc-8v73-9gg2 +references: + - advisory: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-pqqc-8v73-9gg2 + - web: https://github.com/lf-edge/ekuiper/releases/tag/v2.4.0 +source: + id: GHSA-pqqc-8v73-9gg2 + created: 2026-09-15T11:21:49.862486-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6448.yaml b/data/reports/GO-2026-6448.yaml new file mode 100644 index 0000000..aa0d037 --- /dev/null +++ b/data/reports/GO-2026-6448.yaml
@@ -0,0 +1,21 @@ +id: GO-2026-6448 +modules: + - module: github.com/identrail/identrail + versions: + - fixed: 1.0.2 + vulnerable_at: 1.0.1 +summary: |- + Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound + to the caller's workspace without ownership verification in github.com/identrail/identrail +cves: + - CVE-2026-59185 +ghsas: + - GHSA-cp3j-m783-3ph5 +references: + - advisory: https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5 + - fix: https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7 + - web: https://github.com/identrail/identrail/releases/tag/v1.0.2 +source: + id: GHSA-cp3j-m783-3ph5 + created: 2026-09-15T11:21:40.880942-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6449.yaml b/data/reports/GO-2026-6449.yaml new file mode 100644 index 0000000..f1defe6 --- /dev/null +++ b/data/reports/GO-2026-6449.yaml
@@ -0,0 +1,17 @@ +id: GO-2026-6449 +modules: + - module: github.com/komari-monitor/komari + versions: + - fixed: 0.0.0-20260609084633-98122fa4d110 +summary: 'Komari: Management Interface CSRF in github.com/komari-monitor/komari' +ghsas: + - GHSA-hxjg-93wc-h8p8 +references: + - advisory: https://github.com/komari-monitor/komari/security/advisories/GHSA-hxjg-93wc-h8p8 + - web: https://github.com/komari-monitor/komari/releases/tag/1.2.2 +notes: + - fix: 'github.com/komari-monitor/komari: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version' +source: + id: GHSA-hxjg-93wc-h8p8 + created: 2026-09-15T11:21:36.196295-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6450.yaml b/data/reports/GO-2026-6450.yaml new file mode 100644 index 0000000..d00c051 --- /dev/null +++ b/data/reports/GO-2026-6450.yaml
@@ -0,0 +1,17 @@ +id: GO-2026-6450 +modules: + - module: github.com/candid82/joker + versions: + - fixed: 1.8.2 + vulnerable_at: 1.8.1 +summary: Joker linter executed project-local .jokerd/linter.* files during linting in github.com/candid82/joker +cves: + - CVE-2026-59172 +ghsas: + - GHSA-m835-3cm9-rggg +references: + - advisory: https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg +source: + id: GHSA-m835-3cm9-rggg + created: 2026-09-15T11:21:31.579306-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6451.yaml b/data/reports/GO-2026-6451.yaml new file mode 100644 index 0000000..2bc8dbe --- /dev/null +++ b/data/reports/GO-2026-6451.yaml
@@ -0,0 +1,18 @@ +id: GO-2026-6451 +modules: + - module: github.com/ncarlier/webhookd + versions: + - fixed: 1.22.0 + vulnerable_at: 1.21.0 +summary: 'webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd' +cves: + - CVE-2026-59157 +ghsas: + - GHSA-v25g-mvwr-f5fp +references: + - advisory: https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp + - web: https://github.com/ncarlier/webhookd/releases/tag/v1.22.0 +source: + id: GHSA-v25g-mvwr-f5fp + created: 2026-09-15T11:21:21.663333-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6454.yaml b/data/reports/GO-2026-6454.yaml new file mode 100644 index 0000000..58f978b --- /dev/null +++ b/data/reports/GO-2026-6454.yaml
@@ -0,0 +1,32 @@ +id: GO-2026-6454 +modules: + - module: github.com/traefik/traefik + vulnerable_at: 1.7.34 + - module: github.com/traefik/traefik/v2 + versions: + - introduced: 2.8.2 + - fixed: 2.11.56 + vulnerable_at: 2.11.55 + - module: github.com/traefik/traefik/v3 + versions: + - introduced: 3.0.0 + - fixed: 3.7.12 + vulnerable_at: 3.7.11 +summary: |- + Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving + slow-body uploads unbounded in github.com/traefik/traefik +cves: + - CVE-2026-88012 +ghsas: + - GHSA-7ghq-v6jf-g56c +references: + - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-88012 + - fix: https://github.com/traefik/traefik/commit/a8d0bc425859dde7481a6c9a324e610b81d754d0 + - fix: https://github.com/traefik/traefik/pull/13717 + - web: https://github.com/traefik/traefik/releases/tag/v2.11.56 + - web: https://github.com/traefik/traefik/releases/tag/v3.7.12 +source: + id: GHSA-7ghq-v6jf-g56c + created: 2026-09-15T11:20:52.382025-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6455.yaml b/data/reports/GO-2026-6455.yaml new file mode 100644 index 0000000..9269d0d --- /dev/null +++ b/data/reports/GO-2026-6455.yaml
@@ -0,0 +1,29 @@ +id: GO-2026-6455 +modules: + - module: github.com/traefik/traefik + vulnerable_at: 1.7.34 + - module: github.com/traefik/traefik/v2 + versions: + - fixed: 2.11.56 + vulnerable_at: 2.11.55 + - module: github.com/traefik/traefik/v3 + versions: + - introduced: 3.0.0 + - fixed: 3.7.12 + vulnerable_at: 3.7.11 +summary: 'Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik' +cves: + - CVE-2026-88011 +ghsas: + - GHSA-rf44-j88r-hh8c +references: + - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-88011 + - fix: https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8 + - fix: https://github.com/traefik/traefik/pull/13720 + - web: https://github.com/traefik/traefik/releases/tag/v2.11.56 + - web: https://github.com/traefik/traefik/releases/tag/v3.7.12 +source: + id: GHSA-rf44-j88r-hh8c + created: 2026-09-15T11:20:42.770326-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6465.yaml b/data/reports/GO-2026-6465.yaml new file mode 100644 index 0000000..d1360db --- /dev/null +++ b/data/reports/GO-2026-6465.yaml
@@ -0,0 +1,31 @@ +id: GO-2026-6465 +modules: + - module: github.com/traefik/traefik + vulnerable_at: 1.7.34 + - module: github.com/traefik/traefik/v2 + versions: + - fixed: 2.11.57 + vulnerable_at: 2.11.56 + - module: github.com/traefik/traefik/v3 + versions: + - introduced: 3.0.0 + - fixed: 3.7.13 + vulnerable_at: 3.7.12 +summary: |- + Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, + bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik +cves: + - CVE-2026-88009 +ghsas: + - GHSA-f52w-8j3h-j724 +references: + - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724 + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-88009 + - fix: https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9 + - fix: https://github.com/traefik/traefik/pull/13796 + - web: https://github.com/traefik/traefik/releases/tag/v2.11.57 + - web: https://github.com/traefik/traefik/releases/tag/v3.7.13 +source: + id: GHSA-f52w-8j3h-j724 + created: 2026-09-15T11:10:28.888092-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6466.yaml b/data/reports/GO-2026-6466.yaml new file mode 100644 index 0000000..ce75c33 --- /dev/null +++ b/data/reports/GO-2026-6466.yaml
@@ -0,0 +1,30 @@ +id: GO-2026-6466 +modules: + - module: github.com/traefik/traefik + vulnerable_at: 1.7.34 + - module: github.com/traefik/traefik/v2 + versions: + - introduced: 2.11.0 + - fixed: 2.11.57 + vulnerable_at: 2.11.56 + - module: github.com/traefik/traefik/v3 + versions: + - introduced: 3.0.0 + - fixed: 3.7.13 + vulnerable_at: 3.7.12 +summary: Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik +cves: + - CVE-2026-88007 +ghsas: + - GHSA-qqjf-53cj-pwvv +references: + - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-88007 + - fix: https://github.com/traefik/traefik/commit/ff39c47d7459dec9cd8de63c1a4e7aa7315bdc1c + - fix: https://github.com/traefik/traefik/pull/13812 + - web: https://github.com/traefik/traefik/releases/tag/v2.11.57 + - web: https://github.com/traefik/traefik/releases/tag/v3.7.13 +source: + id: GHSA-qqjf-53cj-pwvv + created: 2026-09-15T11:10:19.455611-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6467.yaml b/data/reports/GO-2026-6467.yaml new file mode 100644 index 0000000..6c6026c --- /dev/null +++ b/data/reports/GO-2026-6467.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-6467 +modules: + - module: github.com/traefik/traefik + vulnerable_at: 1.7.34 + - module: github.com/traefik/traefik/v2 + vulnerable_at: 2.11.57 + - module: github.com/traefik/traefik/v3 + versions: + - introduced: 3.2.0 + - fixed: 3.7.13 + vulnerable_at: 3.7.12 +summary: Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik +cves: + - CVE-2026-88004 +ghsas: + - GHSA-v67p-phpq-fc8x +references: + - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-88004 + - fix: https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7 + - fix: https://github.com/traefik/traefik/pull/13822 + - web: https://github.com/traefik/traefik/releases/tag/v3.7.13 +source: + id: GHSA-v67p-phpq-fc8x + created: 2026-09-15T11:10:10.461355-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6468.yaml b/data/reports/GO-2026-6468.yaml new file mode 100644 index 0000000..88071ec --- /dev/null +++ b/data/reports/GO-2026-6468.yaml
@@ -0,0 +1,32 @@ +id: GO-2026-6468 +modules: + - module: github.com/traefik/traefik + vulnerable_at: 1.7.34 + - module: github.com/traefik/traefik/v2 + versions: + - introduced: 2.11.26 + - fixed: 2.11.57 + vulnerable_at: 2.11.56 + - module: github.com/traefik/traefik/v3 + versions: + - introduced: 3.4.2 + - fixed: 3.7.13 + vulnerable_at: 3.7.12 +summary: |- + Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response + Smuggling') and Incorrect Authorization in github.com/traefik/traefik +cves: + - CVE-2026-88008 +ghsas: + - GHSA-w4v4-9rw7-5326 +references: + - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326 + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-88008 + - fix: https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3 + - fix: https://github.com/traefik/traefik/pull/13797 + - web: https://github.com/traefik/traefik/releases/tag/v2.11.57 + - web: https://github.com/traefik/traefik/releases/tag/v3.7.13 +source: + id: GHSA-w4v4-9rw7-5326 + created: 2026-09-15T11:09:59.941462-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6469.yaml b/data/reports/GO-2026-6469.yaml new file mode 100644 index 0000000..fdb9be6 --- /dev/null +++ b/data/reports/GO-2026-6469.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6469 +modules: + - module: github.com/zitadel/zitadel + non_go_versions: + - fixed: 3.4.12 + - introduced: 4.0.0-rc.1 + - fixed: 4.15.2 + vulnerable_at: 1.87.5 +summary: 'ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel' +cves: + - CVE-2026-56665 +ghsas: + - GHSA-v77h-2w3m-94hx +references: + - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56665 + - fix: https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8 + - fix: https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac + - web: https://github.com/zitadel/zitadel/releases/tag/v3.4.12 + - web: https://github.com/zitadel/zitadel/releases/tag/v4.15.2 +source: + id: GHSA-v77h-2w3m-94hx + created: 2026-09-15T11:09:39.988953-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6470.yaml b/data/reports/GO-2026-6470.yaml new file mode 100644 index 0000000..f89f2c6 --- /dev/null +++ b/data/reports/GO-2026-6470.yaml
@@ -0,0 +1,20 @@ +id: GO-2026-6470 +modules: + - module: github.com/zitadel/zitadel + non_go_versions: + - fixed: 4.15.3 + vulnerable_at: 1.87.5 +summary: 'ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel' +cves: + - CVE-2026-56666 +ghsas: + - GHSA-992q-9gwp-7r79 +references: + - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-992q-9gwp-7r79 + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56666 + - fix: https://github.com/zitadel/zitadel/commit/c97012f0c5dc2fe960ae6e940cbea23229f0557f + - web: https://github.com/zitadel/zitadel/releases/tag/v4.15.3 +source: + id: GHSA-992q-9gwp-7r79 + created: 2026-09-15T11:09:32.550108-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6473.yaml b/data/reports/GO-2026-6473.yaml new file mode 100644 index 0000000..e1faa50 --- /dev/null +++ b/data/reports/GO-2026-6473.yaml
@@ -0,0 +1,21 @@ +id: GO-2026-6473 +modules: + - module: github.com/zitadel/zitadel + non_go_versions: + - fixed: 4.16.0 + vulnerable_at: 1.87.5 +summary: |- + ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role + Deletions in github.com/zitadel/zitadel +cves: + - CVE-2026-76081 +ghsas: + - GHSA-v859-c572-qh5p +references: + - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-v859-c572-qh5p + - fix: https://github.com/zitadel/zitadel/commit/9d60e83d6faa5e7e7a5339e031cdb26e0efe4d59 + - web: https://github.com/zitadel/zitadel/releases/tag/v4.16.0 +source: + id: GHSA-v859-c572-qh5p + created: 2026-09-15T11:09:23.470936-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6474.yaml b/data/reports/GO-2026-6474.yaml new file mode 100644 index 0000000..f96d198 --- /dev/null +++ b/data/reports/GO-2026-6474.yaml
@@ -0,0 +1,20 @@ +id: GO-2026-6474 +modules: + - module: github.com/zitadel/zitadel + non_go_versions: + - fixed: 4.15.3 + vulnerable_at: 1.87.5 +summary: 'ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange in github.com/zitadel/zitadel' +cves: + - CVE-2026-56668 +ghsas: + - GHSA-vrh8-c9cm-wh8v +references: + - advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56668 + - fix: https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc + - web: https://github.com/zitadel/zitadel/releases/tag/v4.15.3 +source: + id: GHSA-vrh8-c9cm-wh8v + created: 2026-09-15T11:08:58.093285-04:00 +review_status: UNREVIEWED