# cve.now: Go packages

The newest entries affecting Go packages (up to 200). To check exact package versions, use the MCP check_stack tool or /stack.

- [CVE-2026-118658](https://cve.now/CVE-2026-118658.md): Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto (CVSS 4.7, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118657](https://cve.now/CVE-2026-118657.md): Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118656](https://cve.now/CVE-2026-118656.md): Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118655](https://cve.now/CVE-2026-118655.md): Echo: Static Middleware Double-Unescape Path Traversal (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118654](https://cve.now/CVE-2026-118654.md): Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-54162](https://cve.now/CVE-2026-54162.md): Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI (CVSS 4.7, alexandre-daubois ember · github.com/alexandre-daubois/ember)
- [CVE-2026-118653](https://cve.now/CVE-2026-118653.md): Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118652](https://cve.now/CVE-2026-118652.md): Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVSS 6.1, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118651](https://cve.now/CVE-2026-118651.md): Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118650](https://cve.now/CVE-2026-118650.md): Echo: middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118266](https://cve.now/CVE-2026-118266.md): Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118265](https://cve.now/CVE-2026-118265.md): Echo: X-Real-IP extractor trusts the header value instead of the sending peer (CVSS 5.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-118264](https://cve.now/CVE-2026-118264.md): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-118263](https://cve.now/CVE-2026-118263.md): Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests (CVSS 6.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-118262](https://cve.now/CVE-2026-118262.md): Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-118261](https://cve.now/CVE-2026-118261.md): Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2, labstack echo · github.com/labstack/echo/v4)
- [CVE-2026-118260](https://cve.now/CVE-2026-118260.md): Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2, labstack echo · github.com/labstack/echo/v4)
- [CVE-2026-97045](https://cve.now/CVE-2026-97045.md): Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net (no CVSS, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-78661](https://cve.now/CVE-2026-78661.md): Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net (no CVSS, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-116683](https://cve.now/CVE-2026-116683.md): CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values (CVSS 7.1, ctfer-io terraform-provider-ctfd · github.com/ctfer-io/t… +1)
- [CVE-2026-116682](https://cve.now/CVE-2026-116682.md): FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory (CVSS 8.6, gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…)
- [CVE-2026-116679](https://cve.now/CVE-2026-116679.md): Neko: Authorization bypass in legacy WebRTC input handling (CVSS 5.4, m1k1o neko · github.com/m1k1o/neko/server)
- [CVE-2026-116676](https://cve.now/CVE-2026-116676.md): Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan (CVSS 8.8, runatlantis atlantis · github.com/runatlantis/atlantis)
- [CVE-2026-54462](https://cve.now/CVE-2026-54462.md): knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion (CVSS 6.5, knative pkg · knative.dev/pkg)
- [CVE-2026-116591](https://cve.now/CVE-2026-116591.md): compress zstd: Panic on two-block frames (CVSS 8.7, klauspost compress · github.com/klauspost/compress/zstd)
- [CVE-2026-116587](https://cve.now/CVE-2026-116587.md): Go JOSE: DoS when parsing JWKs that contain RSA keys (CVSS 7.5, go-jose · github.com/go-jose/go-jose/v4 +1)
- [CVE-2026-116586](https://cve.now/CVE-2026-116586.md): Go JOSE: Panics in JSON parsing (CVSS 6.9, go-jose · github.com/go-jose/go-jose/v4 +1)
- [CVE-2026-116585](https://cve.now/CVE-2026-116585.md): Go JOSE: Panic during CBC-HMAC processing (CVSS 6.9, go-jose · github.com/go-jose/go-jose/v4 +1)
- [CVE-2026-57208](https://cve.now/CVE-2026-57208.md): Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind (CVSS 6.2, entireio cli · github.com/entireio/cli)
- [CVE-2026-57210](https://cve.now/CVE-2026-57210.md): Heimdall: IP Spoofing via Unvalidated Forwarding Headers (CVSS 7.0, dadrus heimdall · https://github.com/dadrus/heimdall +1)
- [CVE-2026-57209](https://cve.now/CVE-2026-57209.md): Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode (CVSS 7.0, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2022-51026](https://cve.now/CVE-2022-51026.md): Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login (CVSS 9.3, bytebase · github.com/bytebase/bytebase)
- [CVE-2026-114665](https://cve.now/CVE-2026-114665.md): Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare (CVSS 7.1, zhenorzz goploy · github.com/zhenorzz/goploy)
- [CVE-2026-114437](https://cve.now/CVE-2026-114437.md): Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For (CVSS 4.8, go-chi chi · github.com/go-chi/chi/v5)
- [CVE-2026-111943](https://cve.now/CVE-2026-111943.md): Distrust compromised intermediate certificates in crypto/x509 (no CVSS, Go standard library crypto/x509 · stdlib +3)
- [CVE-2026-114101](https://cve.now/CVE-2026-114101.md): Coraza before 3.8.1 Multipart filename\* Charset Handling FILES Rule Bypass (CVSS 6.3, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-114100](https://cve.now/CVE-2026-114100.md): Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type (CVSS 6.9, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-114099](https://cve.now/CVE-2026-114099.md): Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision (CVSS 6.9, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-113729](https://cve.now/CVE-2026-113729.md): Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization (CVSS 7.5, moov-io signedxml · github.com/moov-io/signedxml)
- [CVE-2026-113727](https://cve.now/CVE-2026-113727.md): OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs (CVSS 7.4, openchoreo · github.com/openchoreo/openchoreo)
- [CVE-2026-111933](https://cve.now/CVE-2026-111933.md): Coder before 2.34.2 User Enumeration via Login Placeholder Hash (CVSS 6.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-111932](https://cve.now/CVE-2026-111932.md): Coder before 2.34.2 Stored HTML Injection via Appearance Settings (CVSS 4.8, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-111922](https://cve.now/CVE-2026-111922.md): Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins (CVSS 7.2, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111921](https://cve.now/CVE-2026-111921.md): Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111920](https://cve.now/CVE-2026-111920.md): Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111919](https://cve.now/CVE-2026-111919.md): Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111918](https://cve.now/CVE-2026-111918.md): Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111917](https://cve.now/CVE-2026-111917.md): Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2025-71435](https://cve.now/CVE-2025-71435.md): Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token (CVSS 2.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2024-58398](https://cve.now/CVE-2024-58398.md): Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter (CVSS 5.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-96627](https://cve.now/CVE-2026-96627.md): Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) (CVSS 8.8, getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1)
- [CVE-2026-96628](https://cve.now/CVE-2026-96628.md): Arcane: Environment access token bypasses the admin-required authorization gate on \`/api/debug/pprof\` (CVSS 4.3, getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1)
- [CVE-2026-102941](https://cve.now/CVE-2026-102941.md): gomarkdown/markdown IsSafeURL panics on short URLs (CVSS 7.5, gomarkdown markdown · github.com/gomarkdown/markdown)
- [CVE-2026-100353](https://cve.now/CVE-2026-100353.md): kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100354](https://cve.now/CVE-2026-100354.md): kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100352](https://cve.now/CVE-2026-100352.md): kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100351](https://cve.now/CVE-2026-100351.md): kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion (CVSS 7.4, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100349](https://cve.now/CVE-2026-100349.md): kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100350](https://cve.now/CVE-2026-100350.md): kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression (CVSS 5.3, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100347](https://cve.now/CVE-2026-100347.md): kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path (CVSS 5.3, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100348](https://cve.now/CVE-2026-100348.md): kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) (CVSS 5.3, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-97394](https://cve.now/CVE-2026-97394.md): kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2023-32198](https://cve.now/CVE-2023-32198.md): Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks (CVSS 8.0, SUSE steve · github.com/rancher/steve)
- [CVE-2024-22031](https://cve.now/CVE-2024-22031.md): Rancher users who can create Projects can gain access to arbitrary projects (CVSS 8.5, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-23390](https://cve.now/CVE-2025-23390.md): Fleet doesn’t validate a server’s certificate when connecting through SSH (CVSS 6.3, SUSE fleet · github.com/rancher/fleet)
- [CVE-2026-53999](https://cve.now/CVE-2026-53999.md): Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) (CVSS 7.7, radius-project radius · github.com/radius-project/radius)
- [CVE-2026-102748](https://cve.now/CVE-2026-102748.md): Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service (CVSS 9.2, dgraph-io dgraph · github.com/dgraph-io/dgraph/v25)
- [CVE-2026-77524](https://cve.now/CVE-2026-77524.md): KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication (CVSS 9.9, kedacore keda · github.com/kedacore/keda +1)
- [CVE-2026-77564](https://cve.now/CVE-2026-77564.md): Talos Linux: Support bundle does not redact registry credentials (CVSS 3.3, siderolabs talos · github.com/siderolabs/talos)
- [CVE-2026-100394](https://cve.now/CVE-2026-100394.md): Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-73802](https://cve.now/CVE-2026-73802.md): Gitea Runner host isolation bypass through container options (CVSS 8.8, Gitea Runner · gitea.com/gitea/runner)
- [CVE-2026-59766](https://cve.now/CVE-2026-59766.md): Gitea private repository metadata disclosure after access revocation (CVSS 4.3, Gitea · code.gitea.io/gitea +1)
- [CVE-2026-104252](https://cve.now/CVE-2026-104252.md): Vitess vttablet /twopcz reflected XSS (CVSS 9.8, vitessio vitess · vitess.io/vitess)
- [CVE-2026-85747](https://cve.now/CVE-2026-85747.md): Distribution: Client \`manifests.Get()\` does not verify returned content against requested digest (CVSS 6.8, distribution · github.com/docker/distribution +1)
- [CVE-2026-94603](https://cve.now/CVE-2026-94603.md): Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation (CVSS 10.0, podman-container-tools podman · github.com/containers/po… +5)
- [CVE-2026-77459](https://cve.now/CVE-2026-77459.md): Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks (CVSS 9.9, argoproj argo-cd · argo-cd +3)
- [CVE-2026-82416](https://cve.now/CVE-2026-82416.md): FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module (CVSS 7.7, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-103028](https://cve.now/CVE-2026-103028.md): SFTPGo source-side file-pattern filter bypass during copy operations (CVSS 4.3, drakkan sftpgo · github.com/drakkan/sftpgo/v2 +1)
- [CVE-2026-77375](https://cve.now/CVE-2026-77375.md): SFTPGo: Denial of service via malformed SSH channel request (CVSS 6.5, drakkan sftpgo · github.com/drakkan/sftpgo/v2 +1)
- [CVE-2026-102603](https://cve.now/CVE-2026-102603.md): Gotify: Insufficiently Protected Password Change endpoint (CVSS 5.3, gotify server · github.com/gotify/server/v2 +2)
- [CVE-2026-84312](https://cve.now/CVE-2026-84312.md): Nginx UI: Casdoor SSO callback uses a constant \`state\` parameter (login CSRF) (CVSS 7.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84360](https://cve.now/CVE-2026-84360.md): Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools (CVSS 8.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84316](https://cve.now/CVE-2026-84316.md): Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84319](https://cve.now/CVE-2026-84319.md): Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context (CVSS 8.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84317](https://cve.now/CVE-2026-84317.md): Nginx UI: MCP nginx\_config\_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84313](https://cve.now/CVE-2026-84313.md): Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover (CVSS 8.8, 0xJacky nginx-ui · Nginx-UI +1)
- [CVE-2026-84321](https://cve.now/CVE-2026-84321.md): Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable (CVSS 5.4, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84314](https://cve.now/CVE-2026-84314.md): Nginx UI: Account Takeover via Missing \`RequireSecureSession\` on User Management Endpoint (CVSS 8.7, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84320](https://cve.now/CVE-2026-84320.md): Nginx UI: Auto backup name allows path traversal outside validated storage path (CVSS 6.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84318](https://cve.now/CVE-2026-84318.md): Nginx UI: MCP \`nginx\_config\_add\` Bypasses Directive Validation — Authenticated RCE (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84315](https://cve.now/CVE-2026-84315.md): Nginx UI OTP secure-session step-up is missing on sensitive mutation routes (CVSS 8.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-41508](https://cve.now/CVE-2026-41508.md): OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART\_STRICT\_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVSS 5.8, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-41504](https://cve.now/CVE-2026-41504.md): OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields (CVSS 5.8, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-104774](https://cve.now/CVE-2026-104774.md): OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass (CVSS 5.8, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-41510](https://cve.now/CVE-2026-41510.md): OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (CVSS 7.2, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-95838](https://cve.now/CVE-2026-95838.md): containerd: Unpack DoS via repeated opaque whiteouts (CVSS 4.6, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-95837](https://cve.now/CVE-2026-95837.md): containerd CRI plugin: Checkpoint restore bypasses destination security context (CVSS 7.8, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-102663](https://cve.now/CVE-2026-102663.md): OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search (CVSS 4.3, OpenListTeam OpenList · github.com/OpenListTeam/OpenList… +2)
- [CVE-2026-62376](https://cve.now/CVE-2026-62376.md): Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access (CVSS 8.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-62367](https://cve.now/CVE-2026-62367.md): Vikunja: OIDC email-fallback account linking ignores email\_verified, enabling local-account takeover (CVSS 7.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-57458](https://cve.now/CVE-2026-57458.md): Vikunja: Scoped API token can mint unrestricted OAuth session credentials (CVSS 8.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-107840](https://cve.now/CVE-2026-107840.md): yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels (CVSS 7.5, jhaals yopass · github.com/jhaals/yopass)
- [CVE-2026-107839](https://cve.now/CVE-2026-107839.md): ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud \`getFileURL\` Endpoint Leads to Remote Denial of Service (CVSS 7.5, luskaner ageLANServer · github.com/luskaner/ageLANServer/se…)
- [CVE-2026-107835](https://cve.now/CVE-2026-107835.md): OWASP Coraza WAF: Cookie Parser Confusion (CVSS 4.0, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-107834](https://cve.now/CVE-2026-107834.md): OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor (CVSS 5.3, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-107833](https://cve.now/CVE-2026-107833.md): OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion (CVSS 5.9, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-107826](https://cve.now/CVE-2026-107826.md): OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) (CVSS 7.5, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-107825](https://cve.now/CVE-2026-107825.md): OWASP Coraza WAF: ProcessURI silently drops QUERY\_STRING and ARGS\_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations (CVSS 4.0, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-55797](https://cve.now/CVE-2026-55797.md): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (CVSS 8.8, argoproj argo-cd · argo-cd +3)
- [CVE-2026-107813](https://cve.now/CVE-2026-107813.md): Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107812](https://cve.now/CVE-2026-107812.md): Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM (CVSS 7.5, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107811](https://cve.now/CVE-2026-107811.md): 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107810](https://cve.now/CVE-2026-107810.md): Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied (CVSS 8.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107809](https://cve.now/CVE-2026-107809.md): Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107808](https://cve.now/CVE-2026-107808.md): Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) (CVSS 8.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107807](https://cve.now/CVE-2026-107807.md): Nginx UI: Node Secret Credential Exposure via URL Query Parameter (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107806](https://cve.now/CVE-2026-107806.md): Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite (CVSS 9.4, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107805](https://cve.now/CVE-2026-107805.md): Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage (CVSS 7.5, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-107804](https://cve.now/CVE-2026-107804.md): Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout (CVSS 5.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-97032](https://cve.now/CVE-2026-97032.md): HTTP/2 server crash due to HPACK encoder race in net/http (CVSS 7.5, Go standard library net/http · Go standard library net/h… +3)
- [CVE-2026-94439](https://cve.now/CVE-2026-94439.md): HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http (CVSS 7.5, Go standard library net/http · stdlib)
- [CVE-2026-78663](https://cve.now/CVE-2026-78663.md): Double flow control refund on HTTP/2 server streams in net/http (CVSS 9.1, Go standard library net/http · Go standard library net/h… +3)
- [CVE-2026-78669](https://cve.now/CVE-2026-78669.md): Excessive CPU consumption from repeated initial window changes in net/http (CVSS 7.5, Go standard library net/http · Go standard library net/h… +3)
- [CVE-2026-78660](https://cve.now/CVE-2026-78660.md): HTTP/2 transport accepts malformed framing-related headers in net/http (CVSS 7.5, Go standard library net/http · Go standard library net/h… +3)
- [CVE-2026-78667](https://cve.now/CVE-2026-78667.md): Lack of limit on size of parsed Range headers in net/http (CVSS 7.5, Go standard library net/http · stdlib)
- [CVE-2026-94440](https://cve.now/CVE-2026-94440.md): Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart (CVSS 7.5, Go standard library net/textproto · Go standard library… +1)
- [CVE-2026-97031](https://cve.now/CVE-2026-97031.md): Reject malformed ECH outer extension references in crypto/tls (CVSS 7.5, Go standard library crypto/tls · stdlib)
- [CVE-2026-56866](https://cve.now/CVE-2026-56866.md): HTTP/1 client connection desynchronization after CONNECT rejection in net/http (CVSS 7.5, Go standard library net/http · Go standard library net/h… +1)
- [CVE-2026-56857](https://cve.now/CVE-2026-56857.md): Root.Mkdir(All) can follow junctions out of the root on Windows in os (CVSS 9.8, Go standard library os · Go standard library internal/sy… +1)
- [CVE-2026-78659](https://cve.now/CVE-2026-78659.md): HTTP/2 server memory exhaustion due to Trailer headers in net/http (CVSS 7.5, Go standard library net/http · Go standard library net/h… +3)
- [CVE-2026-94447](https://cve.now/CVE-2026-94447.md): Checksum database bypass for golang.org/toolchain in cmd/go (CVSS 7.8, Go toolchain cmd/go · toolchain)
- [CVE-2026-94444](https://cve.now/CVE-2026-94444.md): Checksum bypass for golang.org/fips140 in cmd/go (CVSS 7.8, Go toolchain cmd/go · toolchain)
- [CVE-2026-97030](https://cve.now/CVE-2026-97030.md): Recognize yield as regexp preceder keyword in html/template (CVSS 6.1, Go standard library html/template · stdlib)
- [CVE-2026-94448](https://cve.now/CVE-2026-94448.md): Reset context tracking on consecutive template expressions in html/template (CVSS 6.1, Go standard library html/template · stdlib)
- [CVE-2026-107386](https://cve.now/CVE-2026-107386.md): amqp091-go: Pre-negotiation frame limit is not enforced to 4KB (CVSS 6.3, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-61801](https://cve.now/CVE-2026-61801.md): github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files (CVSS 5.5, moby sys · github.com/moby/sys/user)
- [CVE-2026-107225](https://cve.now/CVE-2026-107225.md): Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107224](https://cve.now/CVE-2026-107224.md): Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107223](https://cve.now/CVE-2026-107223.md): Excelize: Unbounded \<col max\> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (CVSS 7.1, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107222](https://cve.now/CVE-2026-107222.md): Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107221](https://cve.now/CVE-2026-107221.md): Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107220](https://cve.now/CVE-2026-107220.md): Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107219](https://cve.now/CVE-2026-107219.md): Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107218](https://cve.now/CVE-2026-107218.md): Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics (CVSS 5.3, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107217](https://cve.now/CVE-2026-107217.md): Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-107216](https://cve.now/CVE-2026-107216.md): Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107215](https://cve.now/CVE-2026-107215.md): Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-56851](https://cve.now/CVE-2026-56851.md): Panic parsing crafted input in x/text/secure/precis in golang.org/x/text (CVSS 7.5, golang.org/x/text/secure/precis · golang.org/x/text)
- [CVE-2026-107214](https://cve.now/CVE-2026-107214.md): Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-107213](https://cve.now/CVE-2026-107213.md): Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element (CVSS 8.7, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107212](https://cve.now/CVE-2026-107212.md): Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-107211](https://cve.now/CVE-2026-107211.md): Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic (CVSS 8.7, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-62252](https://cve.now/CVE-2026-62252.md): Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login (CVSS 9.8, sipcapture homer · github.com/sipcapture/homer-app)
- [CVE-2026-62253](https://cve.now/CVE-2026-62253.md): Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) (CVSS 9.8, sipcapture homer · github.com/sipcapture/homer-app)
- [CVE-2026-62251](https://cve.now/CVE-2026-62251.md): Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query (CVSS 8.1, sipcapture homer · github.com/sipcapture/homer-app)
- [CVE-2026-26287](https://cve.now/CVE-2026-26287.md): External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration (CVSS 7.1, external-secrets · github.com/external-secrets/external-sec…)
- [CVE-2026-105163](https://cve.now/CVE-2026-105163.md): crossplane crossplane-runtime ImageConfig client.go Get toctou (CVSS 6.9, crossplane-runtime · github.com/crossplane/crossplane-runti…)
- [CVE-2026-55252](https://cve.now/CVE-2026-55252.md): OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect (CVSS 5.1, openrundev openrun · github.com/openrundev/openrun)
- [CVE-2026-63209](https://cve.now/CVE-2026-63209.md): Integer Overflow or Wraparound and Out-of-bounds Write in compress (CVSS 7.5, klauspost compress · github.com/klauspost/compress)
- [CVE-2026-101090](https://cve.now/CVE-2026-101090.md): Nezha through 2.2.3 Host Header Injection via OAuth2 redirect\_uri (CVSS 9.3, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-101084](https://cve.now/CVE-2026-101084.md): obot before v0.21.1 Authorization Bypass via /mcp-connect (CVSS 9.3, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101064](https://cve.now/CVE-2026-101064.md): Obot before v0.23.0 Server-Side Request Forgery via MCP (CVSS 8.3, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101063](https://cve.now/CVE-2026-101063.md): Obot before v0.23.0 Authentication Bypass via Registry API (CVSS 6.9, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101062](https://cve.now/CVE-2026-101062.md): Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration (CVSS 8.7, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101056](https://cve.now/CVE-2026-101056.md): Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint (CVSS 6.9, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-101051](https://cve.now/CVE-2026-101051.md): Cloudreve before 4.16.1 Path Traversal via Remote Download (CVSS 2.3, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-101048](https://cve.now/CVE-2026-101048.md): Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope (CVSS 5.3, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-101047](https://cve.now/CVE-2026-101047.md): Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs (CVSS 6.9, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-101046](https://cve.now/CVE-2026-101046.md): Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints (CVSS 2.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-100837](https://cve.now/CVE-2026-100837.md): Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching (CVSS 6.3, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100836](https://cve.now/CVE-2026-100836.md): Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer (CVSS 5.3, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100839](https://cve.now/CVE-2026-100839.md): Contrast before 1.18.0 AML Injection Remote Code Execution (CVSS 8.4, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100838](https://cve.now/CVE-2026-100838.md): Contrast before 1.19.1 CopyFile Policy Symlink Subversion (CVSS 8.6, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71426](https://cve.now/CVE-2025-71426.md): Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery (CVSS 7.1, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71425](https://cve.now/CVE-2025-71425.md): Contrast before 1.8.1 Information Disclosure via Logging (CVSS 8.5, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71424](https://cve.now/CVE-2025-71424.md): Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount (CVSS 5.1, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71423](https://cve.now/CVE-2025-71423.md): Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure (CVSS 8.5, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71422](https://cve.now/CVE-2025-71422.md): Contrast before 1.12.1 Insecure LUKS2 Persistent Storage (CVSS 6.9, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-53493](https://cve.now/CVE-2026-53493.md): Containerd has image-pull DoS via crafted OCI index graph amplification (CVSS 6.9, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-62286](https://cve.now/CVE-2026-62286.md): Dozzle label filters do not restrict container event and statistics streams (CVSS 4.3, amir20 dozzle · github.com/amir20/dozzle)
- [CVE-2026-61604](https://cve.now/CVE-2026-61604.md): ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass (CVSS 9.3, ixofoundation ixo-blockchain · github.com/ixofoundation/… +6)
- [CVE-2026-85056](https://cve.now/CVE-2026-85056.md): ZITADEL: MFA bypass via session reuse in Login V2 (CVSS 8.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-85057](https://cve.now/CVE-2026-85057.md): ZITADEL: Actions V1 sandbox escape: host file read via require() (CVSS 8.7, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-82405](https://cve.now/CVE-2026-82405.md): Klever-Go Account takeover: \`kleverUpdateAccountPermission\` authorizes on attacker-controlled \`RecipientAddr\` instead of the authenticated caller (CVSS 8.7, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82409](https://cve.now/CVE-2026-82409.md): Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -\> explorer/indexer data forgery (CVSS 8.4, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82407](https://cve.now/CVE-2026-82407.md): Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS (CVSS 7.0, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-86065](https://cve.now/CVE-2026-86065.md): Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -\> remote node memory/goroutine exhaustion (DoS) (CVSS 7.5, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-86064](https://cve.now/CVE-2026-86064.md): Klever-Go: /log controls global node logging (CVSS 8.6, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82406](https://cve.now/CVE-2026-82406.md): Klever-Go: Zombie-order theft: \`Buy\` missing \`IsClaimed\` guard in native marketplace (CVSS 7.1, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-63132](https://cve.now/CVE-2026-63132.md): OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack (CVSS 9.2, openbao · github.com/openbao/openbao)
- [CVE-2026-63131](https://cve.now/CVE-2026-63131.md): OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix) (CVSS 6.0, openbao · github.com/openbao/openbao)
- [CVE-2026-77285](https://cve.now/CVE-2026-77285.md): OpenBao Agent Writes Secrets to Stdout (CVSS 2.4, openbao · github.com/openbao/openbao)
- [CVE-2026-62204](https://cve.now/CVE-2026-62204.md): SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install (CVSS 5.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-60083](https://cve.now/CVE-2026-60083.md): SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73054](https://cve.now/CVE-2026-73054.md): SiYuan before v3.7.4 Authentication Bypass via WebSocket (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73630](https://cve.now/CVE-2026-73630.md): SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73049](https://cve.now/CVE-2026-73049.md): SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [GHSA-RJWR-M7QX-3FJR](https://cve.now/GHSA-RJWR-M7QX-3FJR.md): oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code (low (no CVSS), github.com/oapi-codegen/oapi-codegen/v2)
- [CVE-2026-62290](https://cve.now/CVE-2026-62290.md): cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials (CVSS 7.3, cert-manager · github.com/cert-manager/cert-manager)
- [CVE-2025-26625](https://cve.now/CVE-2025-26625.md): Git LFS may write to arbitrary files via crafted symlinks (CVSS 8.6, git-lfs · github.com/git-lfs/git-lfs +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/ecosystem/go
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.