Skip to content
Security
فارسی
Sign in / Register
Vulnerabilities
Products
Plugins
All products
d7y.io/dragonfly/v2
Go
· Package
15 reports
Vulnerability alerts
Follow
Package, identifier or title
Search
Severity
All
Critical
High
Medium
Low
Unknown
Fix status
All
Fix reported
No fix reported
Sort by
Recently updated
Highest severity
Report
Product
Ecosystem
Severity
Fix status
Last updated
Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
CVE-2026-54637 · GHSA-CHWM-M7G7-685G
Version ranges need review.
d7y.io/dragonfly/v2
Go
Medium
Fix reported
2026-07-07
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
CVE-2026-49254 · GHSA-4Q9J-6299-GXMR
Version ranges need review.
d7y.io/dragonfly/v2
Go
Low
Fix reported
2026-07-07
Dragonfly Manager Job API Unauthenticated Access
CVE-2026-24124 · GHSA-J8HF-CP34-G4J7
Version ranges need review.
d7y.io/dragonfly/v2
Go
High
Fix reported
2026-03-03
DragonFly's tiny file download uses hard coded HTTP protocol
CVE-2025-59410 · GHSA-MCVP-RPGG-9273
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
DragonFly has weak integrity checks for downloaded files
CVE-2025-59354 · GHSA-HX2H-VJW2-8R54
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
DragonFly vulnerable to arbitrary file read and write on a peer machine
CVE-2025-59352 · GHSA-79HX-3FP8-HJ66
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error
CVE-2025-59351 · GHSA-4MHV-8RH3-4GHW
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
CVE-2025-59350 · GHSA-C2FC-9Q9C-5486
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
Dragonfly vulnerable to server-side request forgery
CVE-2025-59346 · GHSA-G2RQ-JV54-WCPR
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
High
Fix reported
2026-03-03
DragonFly's manager generates mTLS certificates for arbitrary IP addresses
CVE-2025-59353 · GHSA-255V-QV84-29P5
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
High
Fix reported
2026-03-03
Dragonfly's directories created via os.MkdirAll are not checked for permissions
CVE-2025-59349 · GHSA-8425-8R2F-MRV6
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Low
Fix reported
2026-03-03
Dragonfly incorrectly handles a task structure’s usedTrac field
CVE-2025-59348 · GHSA-2QGR-GFVJ-QPCR
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
Dragonfly's manager makes requests to external endpoints with disabled TLS authentication
CVE-2025-59347 · GHSA-98X5-JW98-6C97
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
Medium
Fix reported
2026-03-03
Dragonfly doesn't have authentication enabled for some Manager’s endpoints
CVE-2025-59345 · GHSA-89VC-VF32-CH59
Version ranges need review.
d7y.io/dragonfly/v2
github.com/dragonflyoss/dragonfly
Go
High
Fix reported
2026-03-03
Dragonfly2 has hard coded cyptographic key
CVE-2023-27584 · GHSA-HPC8-7WPM-889W
Version ranges need review.
d7y.io/dragonfly/v2
Go
Critical
Fix reported
2026-03-03
