CVE-2026-59161

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the BGP OPEN capability parsing process. An attacker can influence peer AS validation and capability negotiation by sending a specially crafted BGP OPEN message with a malformed capability length, causing the parse...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

GO-2026-5676 HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go

HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go...

GO-2026-5320 Cross-site Scripting (XSS) in github.com/yuin/goldmark

Cross-site Scripting XSS in github.com/yuin/goldmark...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

ROOT-APP-GOBINARY-CVE-2026-53492 CVE-2026-53492 in rootio-github.com/containerd/containerd/v2 - Patched by Root

Root has patched CVE-2026-53492 in the rootio-github.com/containerd/containerd/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-29181 CVE-2026-29181 in rootio-go.opentelemetry.io/otel - Patched by Root

Root has patched CVE-2026-29181 in the rootio-go.opentelemetry.io/otel package for Root:Go. Multiple fixed versions available...

AZL-92112 CVE-2026-54908 affecting package telegraf for versions less than 1.31.0-27

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHEPSK ServerKeyExchange message. This issue has been fixed in version 3.1.4...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

GO-2026-5754 File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection in github.com/filebrowser/filebrowser

File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection in github.com/filebrowser/filebrowser...

GO-2026-5756 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome...

GO-2026-5616 S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy

S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy...

GO-2026-5461 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go

Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go...

GHSA-78MQ-XCR3-XM33 golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

GHSA-9M57-25V3-79X9 golang.org/x/crypto: Invoking pathological inputs can lead to client panic

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used...

GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner

Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Azure Instance Identity Endpoint process. An attacker can access internal resources or sensitive information by sending crafted requests to the affected endpoint without authentication. Remediati...