Go package vulnerabilities
The newest vulnerabilities affecting Go packages, up to 200. Subscribe by RSS.
- CVE-2026-118658Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Protolabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118657Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headerslabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118656Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURIlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118655Echo: Static Middleware Double-Unescape Path Traversallabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversallabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-54162Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUIalexandre-daubois ember · github.com/alexandre-daubois/ember
- CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configurationlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBloblabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Defaultlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Methodlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peerlabstack echo · github.com/labstack/echo/v5
- CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlslabstack echo · github.com/labstack/echo/v4 +1
- CVE-2026-118263Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestslabstack echo · github.com/labstack/echo/v5
- CVE-2026-118262Echo: WebSocket proxy can retain connections and handlers after client disconnectlabstack echo · github.com/labstack/echo/v4 +1
- CVE-2026-118261Echo: Decompress permits unbounded gzip expansion in v4labstack echo · github.com/labstack/echo/v4
- CVE-2026-118260Echo: BodyDump captures request and response bodies without size limits in v4labstack echo · github.com/labstack/echo/v4
- CVE-2026-97045Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2026-116683CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesctfer-io terraform-provider-ctfd · github.com/ctfer-io/t… +1
- CVE-2026-116682FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directorygtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-116679Neko: Authorization bypass in legacy WebRTC input handlingm1k1o neko · github.com/m1k1o/neko/server
- CVE-2026-116676Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planrunatlantis atlantis · github.com/runatlantis/atlantis
- CVE-2026-54462knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionknative pkg · knative.dev/pkg
- CVE-2026-116591compress zstd: Panic on two-block framesklauspost compress · github.com/klauspost/compress/zstd
- CVE-2026-116587Go JOSE: DoS when parsing JWKs that contain RSA keysgo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116586Go JOSE: Panics in JSON parsinggo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116585Go JOSE: Panic during CBC-HMAC processinggo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-57208Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindentireio cli · github.com/entireio/cli
- CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding Headersdadrus heimdall · https://github.com/dadrus/heimdall +1
- CVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Modedadrus heimdall · github.com/dadrus/heimdall
- CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Loginbytebase · github.com/bytebase/bytebase
- CVE-2026-114665Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileComparezhenorzz goploy · github.com/zhenorzz/goploy
- CVE-2026-114437Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-Forgo-chi chi · github.com/go-chi/chi/v5
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509 · stdlib +3
- CVE-2026-114101Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypasscorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114100Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Typecorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114099Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collisioncorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-113729Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationmoov-io signedxml · github.com/moov-io/signedxml
- CVE-2026-113727OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsopenchoreo · github.com/openchoreo/openchoreo
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder Hashcoder · github.com/coder/coder/v2 +1
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance Settingscoder · github.com/coder/coder/v2 +1
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Originsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project Permissionsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooksgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · github.com/coder/coder/v2 +1
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parametercoder · github.com/coder/coder/v2 +1
- CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1
- CVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1
- CVE-2026-102941gomarkdown/markdown IsSafeURL panics on short URLsgomarkdown markdown · github.com/gomarkdown/markdown
- CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filtergetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100354kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crashgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100352kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Pathgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100351kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusiongetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100349kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100350kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressiongetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100347kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100348kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)getkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-97394kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2023-32198Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacksSUSE steve · github.com/rancher/steve
- CVE-2024-22031Rancher users who can create Projects can gain access to arbitrary projectsSUSE rancher · github.com/rancher/rancher
- CVE-2025-23390Fleet doesn’t validate a server’s certificate when connecting through SSHSUSE fleet · github.com/rancher/fleet
- CVE-2026-53999Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)radius-project radius · github.com/radius-project/radius
- CVE-2026-102748Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Servicedgraph-io dgraph · github.com/dgraph-io/dgraph/v25
- CVE-2026-77524KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationkedacore keda · github.com/kedacore/keda +1
- CVE-2026-77564Talos Linux: Support bundle does not redact registry credentialssiderolabs talos · github.com/siderolabs/talos
- CVE-2026-100394Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-73802Gitea Runner host isolation bypass through container optionsGitea Runner · gitea.com/gitea/runner
- CVE-2026-59766Gitea private repository metadata disclosure after access revocationGitea · code.gitea.io/gitea +1
- CVE-2026-104252Vitess vttablet /twopcz reflected XSSvitessio vitess · vitess.io/vitess
- CVE-2026-85747Distribution: Client `manifests.Get()` does not verify returned content against requested digestdistribution · github.com/docker/distribution +1
- CVE-2026-94603Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationpodman-container-tools podman · github.com/containers/po… +5
- CVE-2026-77459Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksargoproj argo-cd · argo-cd +3
- CVE-2026-82416FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared modulefrankenphp · github.com/dunglas/frankenphp
- CVE-2026-103028SFTPGo source-side file-pattern filter bypass during copy operationsdrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2026-77375SFTPGo: Denial of service via malformed SSH channel requestdrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2026-102603Gotify: Insufficiently Protected Password Change endpointgotify server · github.com/gotify/server/v2 +2
- CVE-2026-84312Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84360Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84316Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84319Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84317Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84313Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover0xJacky nginx-ui · Nginx-UI +1
- CVE-2026-84321Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84314Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84320Nginx UI: Auto backup name allows path traversal outside validated storage path0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84318Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-84315Nginx UI OTP secure-session step-up is missing on sensitive mutation routes0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-41508OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingcorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-41504OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldscorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-104774OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypasscorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-41510OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingcorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-95838containerd: Unpack DoS via repeated opaque whiteoutscontainerd · github.com/containerd/containerd/v2 +1
- CVE-2026-95837containerd CRI plugin: Checkpoint restore bypasses destination security contextcontainerd · github.com/containerd/containerd/v2 +1
- CVE-2026-102663OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchOpenListTeam OpenList · github.com/OpenListTeam/OpenList… +2
- CVE-2026-62376Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-62367Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeovergo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-57458Vikunja: Scoped API token can mint unrestricted OAuth session credentialsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-107840yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labelsjhaals yopass · github.com/jhaals/yopass
- CVE-2026-107839ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Serviceluskaner ageLANServer · github.com/luskaner/ageLANServer/se…
- CVE-2026-107835OWASP Coraza WAF: Cookie Parser Confusioncorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-107834OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processorcorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-107833OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustioncorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-107826OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)corazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-107825OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationscorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-55797Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLargoproj argo-cd · argo-cd +3
- CVE-2026-107813Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107812Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-1078110xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107810Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107809Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107808Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107807Nginx UI: Node Secret Credential Exposure via URL Query Parameter0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107806Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107805Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-107804Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/httpGo standard library net/http · Go standard library net/h… +3
- CVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpGo standard library net/http · stdlib
- CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/httpGo standard library net/http · Go standard library net/h… +3
- CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/httpGo standard library net/http · Go standard library net/h… +3
- CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/httpGo standard library net/http · Go standard library net/h… +3
- CVE-2026-78667Lack of limit on size of parsed Range headers in net/httpGo standard library net/http · stdlib
- CVE-2026-94440Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartGo standard library net/textproto · Go standard library… +1
- CVE-2026-97031Reject malformed ECH outer extension references in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2026-56866HTTP/1 client connection desynchronization after CONNECT rejection in net/httpGo standard library net/http · Go standard library net/h… +1
- CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in osGo standard library os · Go standard library internal/sy… +1
- CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/httpGo standard library net/http · Go standard library net/h… +3
- CVE-2026-94447Checksum database bypass for golang.org/toolchain in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-94444Checksum bypass for golang.org/fips140 in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97030Recognize yield as regexp preceder keyword in html/templateGo standard library html/template · stdlib
- CVE-2026-94448Reset context tracking on consecutive template expressions in html/templateGo standard library html/template · stdlib
- CVE-2026-107386amqp091-go: Pre-negotiation frame limit is not enforced to 4KBrabbitmq amqp091-go · github.com/rabbitmq/amqp091-go
- CVE-2026-61801github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesmoby sys · github.com/moby/sys/user
- CVE-2026-107225Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107224Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107223Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107222Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107221Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APIqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107220Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107219Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107218Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107217Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-107216Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107215Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-56851Panic parsing crafted input in x/text/secure/precis in golang.org/x/textgolang.org/x/text/secure/precis · golang.org/x/text
- CVE-2026-107214Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-107213Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107212Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-107211Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-62252Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Loginsipcapture homer · github.com/sipcapture/homer-app
- CVE-2026-62253Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)sipcapture homer · github.com/sipcapture/homer-app
- CVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/querysipcapture homer · github.com/sipcapture/homer-app
- CVE-2026-26287External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationexternal-secrets · github.com/external-secrets/external-sec…
- CVE-2026-105163crossplane crossplane-runtime ImageConfig client.go Get toctoucrossplane-runtime · github.com/crossplane/crossplane-runti…
- CVE-2026-55252OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirectopenrundev openrun · github.com/openrundev/openrun
- CVE-2026-63209Integer Overflow or Wraparound and Out-of-bounds Write in compressklauspost compress · github.com/klauspost/compress
- CVE-2026-101090Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_urinezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-101084obot before v0.21.1 Authorization Bypass via /mcp-connectobot-platform obot · github.com/obot-platform/obot
- CVE-2026-101064Obot before v0.23.0 Server-Side Request Forgery via MCPobot-platform obot · github.com/obot-platform/obot
- CVE-2026-101063Obot before v0.23.0 Authentication Bypass via Registry APIobot-platform obot · github.com/obot-platform/obot
- CVE-2026-101062Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registrationobot-platform obot · github.com/obot-platform/obot
- CVE-2026-101056Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hintcloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-101051Cloudreve before 4.16.1 Path Traversal via Remote Downloadcloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-101048Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scopecloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-101047Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-101046Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpointsfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-100837Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matchingedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100836Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContaineredgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100839Contrast before 1.18.0 AML Injection Remote Code Executionedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100838Contrast before 1.19.1 CopyFile Policy Symlink Subversionedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71426Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recoveryedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71425Contrast before 1.8.1 Information Disclosure via Loggingedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71424Edgeless Systems Contrast before 1.9.1 Insecure Volume Mountedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71423Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosureedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71422Contrast before 1.12.1 Insecure LUKS2 Persistent Storageedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-53493Containerd has image-pull DoS via crafted OCI index graph amplificationcontainerd · github.com/containerd/containerd/v2 +1
- CVE-2026-62286Dozzle label filters do not restrict container event and statistics streamsamir20 dozzle · github.com/amir20/dozzle
- CVE-2026-61604ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassixofoundation ixo-blockchain · github.com/ixofoundation/… +6
- CVE-2026-85056ZITADEL: MFA bypass via session reuse in Login V2zitadel · github.com/zitadel/zitadel
- CVE-2026-85057ZITADEL: Actions V1 sandbox escape: host file read via require()zitadel · github.com/zitadel/zitadel
- CVE-2026-82405Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-82409Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-82407Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-86065Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)klever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-86064Klever-Go: /log controls global node loggingklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-82406Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-63132OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attackopenbao · github.com/openbao/openbao
- CVE-2026-63131OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)openbao · github.com/openbao/openbao
- CVE-2026-77285OpenBao Agent Writes Secrets to Stdoutopenbao · github.com/openbao/openbao
- CVE-2026-62204SiYuan before v3.7.4 Plugin Overwrite via Bazaar Installsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-60083SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73054SiYuan before v3.7.4 Authentication Bypass via WebSocketsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73630SiYuan before v3.7.4 Information Disclosure via authFilePublishAccesssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73049SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinkssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- GHSA-RJWR-M7QX-3FJRoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Codegithub.com/oapi-codegen/oapi-codegen/v2
- CVE-2026-62290cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialscert-manager · github.com/cert-manager/cert-manager
- CVE-2025-26625Git LFS may write to arbitrary files via crafted symlinksgit-lfs · github.com/git-lfs/git-lfs +1