Path Traversal

Overview Affected versions of this package are vulnerable to Path Traversal in the txtar handling in sandbox.go, which writes each archive entry with os.WriteFile to a path taken from the entry name with no containment to the intended directory, and to unrestricted environment inheritance in...

CVE-2026-94445

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-94445 Malicious user input may lead to RCE in golang.org/x/playground

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

EUVD-2026-87201

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-94445 Malicious user input may lead to RCE in golang.org/x/playground

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-94445

Independent deployments of golang.org/x/playground are vulnerable to Remote Code Execution (RCE) due to a combination of two flaws. A malicious txtar can escape its execution context to perform arbitrary writes to the playground host's trusted filesystem. Concurrently, a failure to restrict the e...

ROOT-APP-GOBINARY-CVE-2026-56864 CVE-2026-56864 in golang.org/x/mod - Patched by Root

Root has patched CVE-2026-56864 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-56865 CVE-2026-56865 in golang.org/x/mod - Patched by Root

Root has patched CVE-2026-56865 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available...

BIT-RCLONE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

CLEANSTART-2026-LN60743 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-41178 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-FD89775 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-NI95909 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-NE14632 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

PT-2026-99016

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

PT-2026-98930

Name of the Vulnerable Software and Affected Versions golang.org/x/playground affected versions not specified Description A malicious txtar archive can escape its execution context to force arbitrary writes to the trusted filesystem of the playground host. Additionally, a specific path used to...

CVE-2026-94445: Improper Input Validation

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

Xalgorix Autonomous AI Pentesting Agent 4.6.95

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

The vulnerability of the Go programming language, related to the tracking of symbolic references, allows attackers to escalate their privileges.

The vulnerability of the Go programming language is related to the tracking of symbolic references. Exploiting this vulnerability can allow attackers to enhance their privileges...

openSUSE 16 Security Update : distribution (openSUSE-SU-2026:21898-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21898-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the...