21467 matches found
GO-2026-6213 Worktree operations may follow symlinks in github.com/go-git/go-git
Worktree operations may follow symlinks in github.com/go-git/go-git...
OPENSUSE-SU-2026:21590-1 Security update for kubevirt1.8
This update for kubevirt1.8 fixes the following issues: Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification bsc1269093. - CVE-2026-13622: virt-handler...
CVE-2026-72816
A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...
CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
GO-2026-6134 goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs
goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs...
GO-2026-6164 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend...
GO-2026-6126 songquanpeng one-api has an issue that results in business logic errors
songquanpeng one-api has an issue that results in business logic errors. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-6135 openhole-server vulnerable to path traversal via URL-decoded request path in github.com/bablilayoub/openhole
openhole-server vulnerable to path traversal via URL-decoded request path in github.com/bablilayoub/openhole...
GO-2026-6162 sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go
sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go...
GO-2026-6109 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList
OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList...
GO-2026-6137 goshs has a Path Traversal issue in github.com/patrickhener/goshs
goshs has a Path Traversal issue in github.com/patrickhener/goshs...
GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...
GO-2026-6145 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin
OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin...
GO-2026-6152 Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer
Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/answer...
GO-2026-6144 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output in github.com/OliveTin/OliveTin
OliveTin: StartActionAndWait Endpoints Bypass logs Permission and Return Action Output in github.com/OliveTin/OliveTin...