GO-2026-5476 Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend

Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend...

GO-2026-5434 monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr

monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr...

GHSA-V6W7-GQ3G-FWVM vulnerabilities

Vulnerabilities for packages: qemu...

GHSA-V2J6-3Q6Q-GM3G vulnerabilities

Vulnerabilities for packages: expat...

GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli

GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...

GO-2026-5369 Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox

Crabbox: environment variable exposure vulnerability in github.com/openclaw/crabbox...

GO-2026-5301 Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet

Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet...

GO-2026-5397 Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus

Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus...

GO-2026-5383 FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser...

GO-2026-5361 authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd

authd: Primary group ID is incorrectly set to value of UID in github.com/canonical/authd...

GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

GO-2026-5329 zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok

zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok...

GO-2026-5303 goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs...

GO-2026-5252 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus

Incus has a Nil-Pointer Dereference Panic via Instance Backup Import volume omitted in github.com/lxc/incus...

GO-2026-5187 PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw

PicoClaw has an Injection issue in its Web Launcher Management Plane component in github.com/sipeed/picoclaw...

GO-2026-5273 MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry

MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry...

GO-2026-5271 GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands in github.com/cli/cli...

GO-2026-5222 nhost has Session Persistence After Password Change in github.com/nhost/nhost

nhost has Session Persistence After Password Change in github.com/nhost/nhost...

GO-2026-5261 Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents in github.com/nezhahq/nezha

Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...