# cve.now: Go packages

The newest entries affecting Go packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [CVE-2026-128037](https://cve.now/CVE-2026-128037.md): gittuf authorization bypass in namespace policy verification (CVSS 6.5, github.com/gittuf/gittuf)
- [CVE-2026-128036](https://cve.now/CVE-2026-128036.md): gittuf authorization bypass in policy update verification (CVSS 2.3, github.com/gittuf/gittuf)
- [CVE-2026-128035](https://cve.now/CVE-2026-128035.md): gittuf authorization bypass in propagated controller policy checks (CVSS 5.5, github.com/gittuf/gittuf)
- [CVE-2026-128034](https://cve.now/CVE-2026-128034.md): gittuf authorization bypass in file protection rules (CVSS 5.5, github.com/gittuf/gittuf)
- [CVE-2026-97054](https://cve.now/CVE-2026-97054.md): HTTP/1 server crash due to MaxBytesReader header race in net/http (no CVSS, Go standard library net/http · stdlib)
- [CVE-2026-97033](https://cve.now/CVE-2026-97033.md): Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97034](https://cve.now/CVE-2026-97034.md): Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97035](https://cve.now/CVE-2026-97035.md): Unexpected code execution and arbitrary file write via Clang -gen- and GCC -gnat flags in cgo in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97036](https://cve.now/CVE-2026-97036.md): Arbitrary code execution during build on darwin via "-l to\_library" in cgo in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97037](https://cve.now/CVE-2026-97037.md): Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97038](https://cve.now/CVE-2026-97038.md): Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97039](https://cve.now/CVE-2026-97039.md): Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2026-97040](https://cve.now/CVE-2026-97040.md): Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link (no CVSS, Go toolchain cmd/go · Go toolchain cmd/link +1)
- [CVE-2026-97041](https://cve.now/CVE-2026-97041.md): Host linker flag injection via //go:cgo\_ directives in cmd/compile and cmd/link (no CVSS, Go toolchain cmd/compile · Go toolchain cmd/link +1)
- [CVE-2026-97042](https://cve.now/CVE-2026-97042.md): Linker flag injection via cgo\_import\_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link (no CVSS, Go toolchain cmd/cgo · Go toolchain cmd/compile +2)
- [CVE-2026-97043](https://cve.now/CVE-2026-97043.md): Unexpected code execution via escaped quotes in //go:cgo\_ldflag in cmd/go and cmd/compile (no CVSS, Go toolchain cmd/go · Go toolchain cmd/compile +1)
- [CVE-2026-125328](https://cve.now/CVE-2026-125328.md): pgEdge Go LLM lib provider API key disclosure in LLM proxy health check (CVSS 5.8, pgedge-go-llm-lib · github.com/pgEdge/pgedge-go-llm-lib)
- [CVE-2026-125327](https://cve.now/CVE-2026-125327.md): pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests (CVSS 7.5, pgedge-rag-server · github.com/pgEdge/pgedge-rag-server)
- [CVE-2026-125326](https://cve.now/CVE-2026-125326.md): pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the… (CVSS 5.8, pgedge-rag-server · github.com/pgEdge/pgedge-rag-server)
- [CVE-2026-125325](https://cve.now/CVE-2026-125325.md): pgEdge RAG Server cross-tenant data leak via race in shared keyword index (CVSS 5.9, pgedge-rag-server · github.com/pgEdge/pgedge-rag-server)
- [CVE-2026-125323](https://cve.now/CVE-2026-125323.md): pgEdge Control Plane generates pg\_hba.conf with trust authentication for local and loopback connections (CVSS 7.8, pgEdge control-plane · github.com/pgEdge/control-plane)
- [CVE-2026-87857](https://cve.now/CVE-2026-87857.md): Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow (CVSS 5.3, Temporal Technologies go.temporal.io/server)
- [CVE-2026-123616](https://cve.now/CVE-2026-123616.md): imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader (CVSS 8.7, imgproxy · github.com/imgproxy/imgproxy +3)
- [CVE-2026-123615](https://cve.now/CVE-2026-123615.md): imgproxy out-of-bounds write in ICO loader (CVSS 8.7, imgproxy · github.com/imgproxy/imgproxy +3)
- [CVE-2026-123614](https://cve.now/CVE-2026-123614.md): imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow (CVSS 9.3, imgproxy · github.com/imgproxy/imgproxy/v3 +3)
- [CVE-2026-102657](https://cve.now/CVE-2026-102657.md): esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal (CVSS 7.5, esm-dev esm.sh · github.com/esm-dev/esm.sh/web)
- [CVE-2026-85737](https://cve.now/CVE-2026-85737.md): Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin (CVSS 6.5, Velocidex velociraptor · www.velocidex.com/golang/velocirap…)
- [GHSA-47W9-6R3F-938G](https://cve.now/GHSA-47W9-6R3F-938G.md): LXD has restricted project bypass leading to arbitrary command execution (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-7MR3-28H5-M5VX](https://cve.now/GHSA-7MR3-28H5-M5VX.md): LXD has project restriction bypass for custom volume copy across projects (high (no CVSS), github.com/canonical/lxd)
- [GHSA-QX75-2P3R-PWM5](https://cve.now/GHSA-QX75-2P3R-PWM5.md): LXD has project restriction bypass in instance copy across projects (high (no CVSS), github.com/canonical/lxd)
- [GHSA-PJFF-C2WC-F6JM](https://cve.now/GHSA-PJFF-C2WC-F6JM.md): LXD has arbitrary file write on client due to trusted image hash (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-FMC8-P6Q7-75CC](https://cve.now/GHSA-FMC8-P6Q7-75CC.md): LXD has argument injection in backup compression algorithm leading to AFW and ACE (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-VGHH-5RFX-XHQ8](https://cve.now/GHSA-VGHH-5RFX-XHQ8.md): LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-JPF8-86F3-WP38](https://cve.now/GHSA-JPF8-86F3-WP38.md): LXD has arbitrary file read+write on host via templates/ symlink in malicious image (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-9J25-MM2H-2F76](https://cve.now/GHSA-9J25-MM2H-2F76.md): LXD has arbitrary file write on host via \`exec-output\` symlink in crafted image (critical (no CVSS), github.com/canonical/lxd)
- [CVE-2026-108262](https://cve.now/CVE-2026-108262.md): DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 (CVSS 6.5, ddev · github.com/ddev/ddev)
- [GO-2026-6893](https://cve.now/GO-2026-6893.md): Event type spoofing via UntrustedType in github.com/google/go-eventlog (no CVSS, github.com/google/go-eventlog)
- [GO-2026-6905](https://cve.now/GO-2026-6905.md): Panic on negative member size in Reader.Read in github.com/blakesmith/ar (no CVSS, github.com/blakesmith/ar)
- [GO-2026-6909](https://cve.now/GO-2026-6909.md): Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml (no CVSS, github.com/crewjam/saml)
- [GO-2026-6911](https://cve.now/GO-2026-6911.md): SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go (no CVSS, github.com/mark3labs/mcp-go)
- [GO-2026-6906](https://cve.now/GO-2026-6906.md): Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoil (no CVSS, github.com/tinfoil-factory/netfoil)
- [GO-2026-6907](https://cve.now/GO-2026-6907.md): Arc has unauthenticated application log disclosure via \`/api/v1/logs\` in github.com/basekick-labs/arc (no CVSS, github.com/basekick-labs/arc)
- [GO-2026-6894](https://cve.now/GO-2026-6894.md): anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in… (no CVSS, github.com/anacrolix/torrent)
- [GO-2026-6891](https://cve.now/GO-2026-6891.md): charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users in… (no CVSS, github.com/charmbracelet/soft-serve)
- [GO-2026-6892](https://cve.now/GO-2026-6892.md): charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve (no CVSS, github.com/charmbracelet/soft-serve)
- [GO-2026-6836](https://cve.now/GO-2026-6836.md): SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in… (no CVSS, github.com/siyuan-note/siyuan/kernel)
- [GO-2026-6838](https://cve.now/GO-2026-6838.md): Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4 · github.com/labstack/echo/v5)
- [GO-2026-6839](https://cve.now/GO-2026-6839.md): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4 · github.com/labstack/echo/v5)
- [GO-2026-6840](https://cve.now/GO-2026-6840.md): Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4)
- [GO-2026-6841](https://cve.now/GO-2026-6841.md): Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v5)
- [GO-2026-6842](https://cve.now/GO-2026-6842.md): Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4)
- [CVE-2026-102943](https://cve.now/CVE-2026-102943.md): Dagu MCP DAG specification read bypasses path containment and workspace isolation (CVSS 6.5, dagucloud dagu · github.com/dagu-org/dagu/v2)
- [CVE-2026-88982](https://cve.now/CVE-2026-88982.md): Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook… (CVSS 5.4, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-77596](https://cve.now/CVE-2026-77596.md): Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVSS 9.6, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-88984](https://cve.now/CVE-2026-88984.md): Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines (CVSS 7.2, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-88986](https://cve.now/CVE-2026-88986.md): Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses (CVSS 6.1, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-88985](https://cve.now/CVE-2026-88985.md): Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server (CVSS 6.5, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-88983](https://cve.now/CVE-2026-88983.md): Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation (CVSS 5.0, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-77463](https://cve.now/CVE-2026-77463.md): Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment (CVSS 6.5, umputun remark42 · github.com/umputun/remark42/backend +1)
- [CVE-2026-77622](https://cve.now/CVE-2026-77622.md): Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder (CVSS 8.2, BishopFox sliver · github.com/BishopFox/sliver)
- [CVE-2026-34157](https://cve.now/CVE-2026-34157.md): Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins (CVSS 7.6, wailsapp wails · github.com/wailsapp/wails/v2)
- [CVE-2026-55458](https://cve.now/CVE-2026-55458.md): Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through (CVSS 2.9, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-119345](https://cve.now/CVE-2026-119345.md): Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks (CVSS 7.2, ultravioletrs cocos · github.com/ultravioletrs/cocos)
- [CVE-2026-123012](https://cve.now/CVE-2026-123012.md): In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a… (CVSS 7.1, Gogs · gogs.io/gogs)
- [CVE-2026-115770](https://cve.now/CVE-2026-115770.md): Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVSS 9.6, pocket-id · github.com/pocket-id/pocket-id/backend)
- [CVE-2026-62662](https://cve.now/CVE-2026-62662.md): Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences (CVSS 7.7, pocket-id · github.com/pocket-id/pocket-id/backend)
- [CVE-2026-86041](https://cve.now/CVE-2026-86041.md): ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed \`X-Forwarded-For\` header (CVSS 5.3, mayswind ezbookkeeping · github.com/mayswind/ezbookkeeping)
- [CVE-2026-102340](https://cve.now/CVE-2026-102340.md): Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment… (CVSS 8.5, telepresenceio telepresence · github.com/telepresenceio/tel…)
- [CVE-2026-122132](https://cve.now/CVE-2026-122132.md): go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware (CVSS 5.1, go-chi chi · github.com/go-chi/chi +4)
- [CVE-2026-102339](https://cve.now/CVE-2026-102339.md): Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable (CVSS 8.2, telepresenceio telepresence · github.com/telepresenceio/tel…)
- [CVE-2026-114456](https://cve.now/CVE-2026-114456.md): Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers (CVSS 6.5, snowflake-connector-python · github.com/snowflakedb/gosn… +9)
- [CVE-2026-64672](https://cve.now/CVE-2026-64672.md): Terragrunt catalog predictable temp symlink clobber (CVSS 4.4, gruntwork-io terragrunt · github.com/gruntwork-io/terragrunt)
- [CVE-2026-63198](https://cve.now/CVE-2026-63198.md): traQ: Privilege escalation by OAuth prompt=none request (CVSS 7.3, traPtitech traQ · github.com/traPtitech/traQ)
- [CVE-2026-63197](https://cve.now/CVE-2026-63197.md): traQ: XSS in the User Uploaded File Retrieval API (CVSS 7.3, traPtitech traQ · github.com/traPtitech/traQ)
- [GHSA-9PPR-WFW9-XVR2](https://cve.now/GHSA-9PPR-WFW9-XVR2.md): Netfoil doesn't decrement TTL (medium (no CVSS), github.com/tinfoil-factory/netfoil)
- [GHSA-M3QR-FVP4-78XJ](https://cve.now/GHSA-M3QR-FVP4-78XJ.md): Arc has unauthenticated application log disclosure via \`/api/v1/logs\` (low (no CVSS), github.com/basekick-labs/arc)
- [CVE-2026-105770](https://cve.now/CVE-2026-105770.md): Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages (CVSS 5.3, github.com/octo-sts/app)
- [CVE-2026-120091](https://cve.now/CVE-2026-120091.md): Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the… (CVSS 8.7, Temporal Technologies go.temporal.io/server)
- [CVE-2026-105769](https://cve.now/CVE-2026-105769.md): kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts (CVSS 9.3, chainguard kaniko · github.com/chainguard-dev/kaniko)
- [GHSA-2WRX-84QJ-4PCG](https://cve.now/GHSA-2WRX-84QJ-4PCG.md): anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS (medium (no CVSS), github.com/anacrolix/torrent)
- [CVE-2026-55098](https://cve.now/CVE-2026-55098.md): Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 (CVSS 6.5, Basekick-Labs arc · github.com/basekick-labs/arc)
- [CVE-2026-62284](https://cve.now/CVE-2026-62284.md): OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy (CVSS 8.6, osac-project osac-operator · github.com/osac-project/osac-o…)
- [CVE-2026-62331](https://cve.now/CVE-2026-62331.md): praktor: Telegram upload traversal permits persistent agent instruction injection (CVSS 8.2, mtzanidakis praktor · github.com/mtzanidakis/praktor)
- [CVE-2026-62160](https://cve.now/CVE-2026-62160.md): Daptin: ParseAcceptLanguage \`\_\` separator bypass enables \>250x CPU amplification via Accept-Language header in LanguageMiddleware (CVSS 8.7, daptin · github.com/daptin/daptin)
- [CVE-2026-119299](https://cve.now/CVE-2026-119299.md): gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments (CVSS 5.9, gopacket · github.com/gopacket/gopacket)
- [CVE-2026-119298](https://cve.now/CVE-2026-119298.md): croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive (CVSS 4.2, schollz croc · github.com/schollz/croc/v11 +5)
- [GHSA-F3FJ-9625-RV3M](https://cve.now/GHSA-F3FJ-9625-RV3M.md): charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users (medium (no CVSS), github.com/charmbracelet/soft-serve)
- [GHSA-FGXM-5HVV-X4VH](https://cve.now/GHSA-FGXM-5HVV-X4VH.md): charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories (medium (no CVSS), github.com/charmbracelet/soft-serve)
- [CVE-2026-119285](https://cve.now/CVE-2026-119285.md): Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads (CVSS 5.9, gofiber fiber · github.com/gofiber/fiber/v2)
- [CVE-2026-118761](https://cve.now/CVE-2026-118761.md): Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory (CVSS 7.5, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-118759](https://cve.now/CVE-2026-118759.md): Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant (CVSS 7.5, kubeflow pipelines · github.com/kubeflow/pipelines)
- [CVE-2026-118658](https://cve.now/CVE-2026-118658.md): Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto (CVSS 4.7, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118657](https://cve.now/CVE-2026-118657.md): Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118656](https://cve.now/CVE-2026-118656.md): Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118655](https://cve.now/CVE-2026-118655.md): Echo: Static Middleware Double-Unescape Path Traversal (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118654](https://cve.now/CVE-2026-118654.md): Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-54162](https://cve.now/CVE-2026-54162.md): Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI (CVSS 4.7, alexandre-daubois ember · github.com/alexandre-daubois/ember)
- [CVE-2026-118653](https://cve.now/CVE-2026-118653.md): Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118652](https://cve.now/CVE-2026-118652.md): Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVSS 6.1, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118651](https://cve.now/CVE-2026-118651.md): Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118650](https://cve.now/CVE-2026-118650.md): Echo: middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118266](https://cve.now/CVE-2026-118266.md): Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118265](https://cve.now/CVE-2026-118265.md): Echo: X-Real-IP extractor trusts the header value instead of the sending peer (CVSS 5.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-118264](https://cve.now/CVE-2026-118264.md): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-118263](https://cve.now/CVE-2026-118263.md): Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests (CVSS 6.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-118262](https://cve.now/CVE-2026-118262.md): Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-118261](https://cve.now/CVE-2026-118261.md): Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2, labstack echo · github.com/labstack/echo/v4)
- [CVE-2026-118260](https://cve.now/CVE-2026-118260.md): Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2, labstack echo · github.com/labstack/echo/v4)
- [CVE-2026-97045](https://cve.now/CVE-2026-97045.md): Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net (CVSS 6.1, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-78661](https://cve.now/CVE-2026-78661.md): Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net (CVSS 7.5, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-116683](https://cve.now/CVE-2026-116683.md): CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values (CVSS 7.1, ctfer-io terraform-provider-ctfd · github.com/ctfer-io/t… +1)
- [CVE-2026-116682](https://cve.now/CVE-2026-116682.md): FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory (CVSS 8.6, gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…)
- [CVE-2026-116679](https://cve.now/CVE-2026-116679.md): Neko: Authorization bypass in legacy WebRTC input handling (CVSS 5.4, m1k1o neko · github.com/m1k1o/neko/server)
- [CVE-2026-116676](https://cve.now/CVE-2026-116676.md): Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan (CVSS 8.8, runatlantis atlantis · github.com/runatlantis/atlantis)
- [CVE-2026-54462](https://cve.now/CVE-2026-54462.md): knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion (CVSS 6.5, knative pkg · knative.dev/pkg)
- [CVE-2026-116591](https://cve.now/CVE-2026-116591.md): compress zstd: Panic on two-block frames (CVSS 8.7, klauspost compress · github.com/klauspost/compress/zstd +1)
- [CVE-2026-116587](https://cve.now/CVE-2026-116587.md): Go JOSE: DoS when parsing JWKs that contain RSA keys (CVSS 7.5, go-jose · github.com/go-jose/go-jose/v4 +1)
- [CVE-2026-116586](https://cve.now/CVE-2026-116586.md): Go JOSE: Panics in JSON parsing (CVSS 6.9, go-jose · github.com/go-jose/go-jose/v4 +1)
- [CVE-2026-116585](https://cve.now/CVE-2026-116585.md): Go JOSE: Panic during CBC-HMAC processing (CVSS 6.9, go-jose · github.com/go-jose/go-jose/v4 +1)
- [CVE-2026-57208](https://cve.now/CVE-2026-57208.md): Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind (CVSS 6.2, entireio cli · github.com/entireio/cli)
- [CVE-2026-57210](https://cve.now/CVE-2026-57210.md): Heimdall: IP Spoofing via Unvalidated Forwarding Headers (CVSS 7.0, dadrus heimdall · https://github.com/dadrus/heimdall +1)
- [CVE-2026-57209](https://cve.now/CVE-2026-57209.md): Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode (CVSS 7.0, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2022-51026](https://cve.now/CVE-2022-51026.md): Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login (CVSS 9.3, bytebase · github.com/bytebase/bytebase)
- [CVE-2026-111497](https://cve.now/CVE-2026-111497.md): Google out-of-bounds write in decompression decoder (CVSS 9.2, KEV, needs attention: Added to CISA KEV Oct 27; federal deadline Nov 10. Scores 82 on the cve.now Index; published Oct 22, Google Brotli · node +7)
- [CVE-2026-114665](https://cve.now/CVE-2026-114665.md): Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare (CVSS 7.1, zhenorzz goploy · github.com/zhenorzz/goploy)
- [CVE-2026-114437](https://cve.now/CVE-2026-114437.md): Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For (CVSS 4.8, go-chi chi · github.com/go-chi/chi/v5)
- [CVE-2026-111943](https://cve.now/CVE-2026-111943.md): Distrust compromised intermediate certificates in crypto/x509 (CVSS 6.8, needs attention: First public exploit on GitHub Nov 5, Go standard library crypto/x509 · stdlib +3)
- [CVE-2026-114101](https://cve.now/CVE-2026-114101.md): Coraza before 3.8.1 Multipart filename\* Charset Handling FILES Rule Bypass (CVSS 6.3, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-114100](https://cve.now/CVE-2026-114100.md): Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type (CVSS 6.9, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-114099](https://cve.now/CVE-2026-114099.md): Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision (CVSS 6.9, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-113729](https://cve.now/CVE-2026-113729.md): Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization (CVSS 7.5, moov-io signedxml · github.com/moov-io/signedxml)
- [CVE-2026-113727](https://cve.now/CVE-2026-113727.md): OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs (CVSS 7.4, openchoreo · github.com/openchoreo/openchoreo)
- [GO-2026-6651](https://cve.now/GO-2026-6651.md): Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core (no CVSS, github.com/xtls/xray-core)
- [CVE-2026-111933](https://cve.now/CVE-2026-111933.md): Coder before 2.34.2 User Enumeration via Login Placeholder Hash (CVSS 6.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-111932](https://cve.now/CVE-2026-111932.md): Coder before 2.34.2 Stored HTML Injection via Appearance Settings (CVSS 4.8, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-111922](https://cve.now/CVE-2026-111922.md): Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins (CVSS 7.2, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111921](https://cve.now/CVE-2026-111921.md): Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111920](https://cve.now/CVE-2026-111920.md): Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111919](https://cve.now/CVE-2026-111919.md): Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111918](https://cve.now/CVE-2026-111918.md): Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111917](https://cve.now/CVE-2026-111917.md): Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2025-71435](https://cve.now/CVE-2025-71435.md): Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token (CVSS 2.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2024-58398](https://cve.now/CVE-2024-58398.md): Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter (CVSS 5.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-96627](https://cve.now/CVE-2026-96627.md): Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) (CVSS 8.8, getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1)
- [CVE-2026-96628](https://cve.now/CVE-2026-96628.md): Arcane: Environment access token bypasses the admin-required authorization gate on \`/api/debug/pprof\` (CVSS 4.3, getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1)
- [CVE-2026-102941](https://cve.now/CVE-2026-102941.md): gomarkdown/markdown IsSafeURL panics on short URLs (CVSS 7.5, gomarkdown markdown · github.com/gomarkdown/markdown)
- [CVE-2026-100353](https://cve.now/CVE-2026-100353.md): kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100354](https://cve.now/CVE-2026-100354.md): kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100352](https://cve.now/CVE-2026-100352.md): kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100351](https://cve.now/CVE-2026-100351.md): kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion (CVSS 7.4, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100349](https://cve.now/CVE-2026-100349.md): kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100350](https://cve.now/CVE-2026-100350.md): kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression (CVSS 5.3, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100347](https://cve.now/CVE-2026-100347.md): kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path (CVSS 5.3, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-100348](https://cve.now/CVE-2026-100348.md): kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) (CVSS 5.3, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2026-97394](https://cve.now/CVE-2026-97394.md): kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2023-32198](https://cve.now/CVE-2023-32198.md): Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks (CVSS 8.0, SUSE steve · github.com/rancher/steve)
- [CVE-2024-22031](https://cve.now/CVE-2024-22031.md): Rancher users who can create Projects can gain access to arbitrary projects (CVSS 8.5, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-23390](https://cve.now/CVE-2025-23390.md): Fleet doesn’t validate a server’s certificate when connecting through SSH (CVSS 6.3, SUSE fleet · github.com/rancher/fleet)
- [CVE-2026-53999](https://cve.now/CVE-2026-53999.md): Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) (CVSS 7.7, radius-project radius · github.com/radius-project/radius)
- [CVE-2026-102748](https://cve.now/CVE-2026-102748.md): Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service (CVSS 9.2, dgraph-io dgraph · github.com/dgraph-io/dgraph/v25)
- [CVE-2026-77524](https://cve.now/CVE-2026-77524.md): KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication (CVSS 9.9, kedacore keda · github.com/kedacore/keda +1)
- [CVE-2026-77564](https://cve.now/CVE-2026-77564.md): Talos Linux: Support bundle does not redact registry credentials (CVSS 3.3, siderolabs talos · github.com/siderolabs/talos)
- [CVE-2026-100394](https://cve.now/CVE-2026-100394.md): Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-73802](https://cve.now/CVE-2026-73802.md): Gitea Runner host isolation bypass through container options (CVSS 8.8, needs attention: First public exploit on GitHub Nov 9, Gitea Runner · gitea.com/gitea/runner)
- [CVE-2026-59766](https://cve.now/CVE-2026-59766.md): Gitea private repository metadata disclosure after access revocation (CVSS 4.3, Gitea · code.gitea.io/gitea +1)
- [CVE-2026-104252](https://cve.now/CVE-2026-104252.md): Vitess vttablet /twopcz reflected XSS (CVSS 9.8, vitessio vitess · vitess.io/vitess)
- [CVE-2026-62367](https://cve.now/CVE-2026-62367.md): Vikunja: OIDC email-fallback account linking ignores email\_verified, enabling local-account takeover (CVSS 7.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-55797](https://cve.now/CVE-2026-55797.md): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (CVSS 8.8, argoproj argo-cd · argo-cd +3)
- [GHSA-9CQF-HHRQ-7V45](https://cve.now/GHSA-9CQF-HHRQ-7V45.md): SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class… (high (no CVSS), github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-60004](https://cve.now/CVE-2026-60004.md): Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. (CVSS 9.8, KEV, needs attention: First public exploit on GitHub Nov 1, Gitea · gitea.dev +1)
- [CVE-2026-54523](https://cve.now/CVE-2026-54523.md): Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any… (CVSS 9.6, needs attention: First public exploit on GitHub Oct 31, kyverno · github.com/kyverno/kyverno)
- [CVE-2026-62204](https://cve.now/CVE-2026-62204.md): SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install (CVSS 5.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-60083](https://cve.now/CVE-2026-60083.md): SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-77763](https://cve.now/CVE-2026-77763.md): JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the… (CVSS 6.5, github.com/juicedata/juicefs)
- [CVE-2026-73054](https://cve.now/CVE-2026-73054.md): SiYuan before v3.7.4 Authentication Bypass via WebSocket (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73630](https://cve.now/CVE-2026-73630.md): SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-73049](https://cve.now/CVE-2026-73049.md): SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-33818](https://cve.now/CVE-2026-33818.md): Enforce maximum recursion depth in encoding/asn1 (CVSS 7.5, Go standard library encoding/asn1)
- [CVE-2026-73608](https://cve.now/CVE-2026-73608.md): SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72791](https://cve.now/CVE-2026-72791.md): SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-65600](https://cve.now/CVE-2026-65600.md): Traefik auth bypass via path traversal in ReplacePathRegex (CVSS 7.8, traefik · github.com/traefik/traefik/v2 +2)
- [GHSA-RJWR-M7QX-3FJR](https://cve.now/GHSA-RJWR-M7QX-3FJR.md): oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code (low (no CVSS), github.com/oapi-codegen/oapi-codegen/v2)
- [CVE-2026-62290](https://cve.now/CVE-2026-62290.md): cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials (CVSS 7.3, cert-manager · github.com/cert-manager/cert-manager)
- [CVE-2026-62361](https://cve.now/CVE-2026-62361.md): listmonk: SQL Injection in \`/api/subscribers/export\` bypasses table access control, leaking admin password hashes and SMTP credentials (CVSS 5.5, knadh listmonk · github.com/knadh/listmonk)
- [GO-2026-5932](https://cve.now/GO-2026-5932.md): The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues (no CVSS, golang.org/x/crypto)
- [CVE-2026-28385](https://cve.now/CVE-2026-28385.md): SSRF via image import from URL allows internal network probing by authenticated users (CVSS 5.0, Canonical lxd · github.com/canonical/lxd)
- [CVE-2026-9639](https://cve.now/CVE-2026-9639.md): Authenticated Denial of Service via Malicious Backup Tarball in LXD (CVSS 6.5, Canonical LXD · github.com/canonical/lxd)
- [CVE-2026-12411](https://cve.now/CVE-2026-12411.md): Broken Access Control in Canonical LXD DevLXD API (CVSS 8.4, Canonical lxd · github.com/canonical/lxd)
- [CVE-2026-13426](https://cve.now/CVE-2026-13426.md): Client4 fails to validate path parameters (CVSS 5.4, github.com/mattermost/mattermost/server/public)
- [CVE-2026-13322](https://cve.now/CVE-2026-13322.md): Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service (CVSS 3.8, Red Hat OpenShift Virtualization · github.com/kubevirt/k… +1)
- [CVE-2026-13318](https://cve.now/CVE-2026-13318.md): Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip (CVSS 6.4, Red Hat OpenShift Virtualization · kubevirt.io/kubevirt)
- [CVE-2026-13218](https://cve.now/CVE-2026-13218.md): Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher (CVSS 4.2, Red Hat OpenShift Virtualization · kubevirt.io/kubevirt)
- [CVE-2026-42504](https://cve.now/CVE-2026-42504.md): Quadratic complexity in WordDecoder.DecodeHeader in mime (CVSS 7.5, Go standard library mime)
- [CVE-2026-7482](https://cve.now/CVE-2026-7482.md): Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers (CVSS 9.1, ollama · github.com/ollama/ollama)
- [CVE-2026-39883](https://cve.now/CVE-2026-39883.md): OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking (CVSS 7.3, open-telemetry opentelemetry-go · go.opentelemetry.io/otel/…)
- [CVE-2026-33344](https://cve.now/CVE-2026-33344.md): Dagu path traversal in locateDAG (CVSS 8.1, dagu-org dagu · github.com/dagu-org/dagu)
- [CVE-2025-8110](https://cve.now/CVE-2025-8110.md): File overwrite in file update API in Gogs (CVSS 8.7, KEV, needs attention: First public exploit on GitHub Nov 2, Gogs · gogs.io/gogs)
- [CVE-2025-26625](https://cve.now/CVE-2025-26625.md): Git LFS may write to arbitrary files via crafted symlinks (CVSS 8.6, git-lfs · github.com/git-lfs/git-lfs +1)
- [CVE-2021-43798](https://cve.now/CVE-2021-43798.md): Grafana path traversal (CVSS 7.5, KEV, grafana · github.com/grafana/grafana)
- [CVE-2020-8927](https://cve.now/CVE-2020-8927.md): Buffer overflow in Brotli library (CVSS 5.3, Google Brotli · brotli +122)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.