GO-2026-6502 RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go...

GO-2026-6498 RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go...

GO-2026-6503 RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation in github.com/rabbitmq/amqp091-go...

GO-2026-6492 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go...

GO-2026-6505 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace...

GO-2026-6491 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go...

GO-2026-6496 RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr in github.com/rabbitmq/amqp091-go...

GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...

GO-2026-6497 Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go...

GO-2026-6583 Klever-Go: /log controls global node logging in github.com/klever-io/klever-go

Klever-Go: /log controls global node logging in github.com/klever-io/klever-go...

GO-2026-6581 Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin - remote node memory/goroutine exhaustion DoS in github.com/klever-io/klever-go...

GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...

GO-2026-6585 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name - explorer/indexer data forgery in github.com/klever-io/klever-go...

GO-2026-6582 Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go

Klever-Go Account takeover: kleverUpdateAccountPermission authorizes on attacker-controlled RecipientAddr instead of the authenticated caller in github.com/klever-io/klever-go...

GO-2026-6586 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go...

jsluice

jsluice jsluice es un paquete de Go y una herramienta de línea de comandos para extraer URLs, rutas, secretos y otros datos interesantes del código fuente de JavaScript. Si quieres hacer estas cosas de inmediato: mira la herramienta de línea de comandos. Si quieres integrar las capacidades de...

CVE-2026-72815-poc

CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC Versión en inglés Resumen Este repositorio es una Prueba de Concepto PoC local de la vulnerabilidad de IP spoofing CVE-2026-72815 GHSA-3fxj-6jh8-hvhx que existe en middleware.RealIP de go-chi/chi. El middleware RealIP vulnerable confía...

local-log4j-vuln-scanner

Escáner simple de vulnerabilidades log4j locales Escrito en Go porque, ya sabes, "escribe una vez, ejecuta en cualquier lugar". Esta es una herramienta simple que se puede utilizar para encontrar instancias vulnerables de log4j 1.x y 2.x en instalaciones de software Java como aplicaciones web. Se...

cpanelscanner

CpanelScanner CpanelScanner es una herramienta CLI en Go que lee hosts desde stdin, sondea HTTPS en un puerto configurado por defecto 2087 y comprueba si la respuesta contiene una cadena de marcado configurada por ejemplo WHM Login. Su uso previsto es identificar instancias de cPanel/WHM expuesta...

hayduk

Hayduk: Open-source Metasploit GUI and Armitage alternative Hayduk is a free, open-source Metasploit GUI for authorized penetration testing. It brings the Armitage workflow to your browser: map hosts, browse modules, manage Meterpreter and shell sessions, and export campaign reports. Download one...