GO-2026-5626 Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0

Ech0 comment model's Email field returned on public /api/comments endpoints in github.com/lin-snow/ech0...

GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd...

GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao

OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...

GO-2026-5565 Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui

Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...

GO-2026-5581 Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse in github.com/ellanetworks/core

Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse in github.com/ellanetworks/core...

GO-2026-5433 DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace

DevSpace UI Server WebSocket CheckOrigin does not validate source in github.com/loft-sh/devspace. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5411 File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser...

GO-2026-5409 Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana

Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-5469 goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs

goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs...

GO-2026-5414 listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk

listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the selector lexer process. An attacker can cause a panic and potentially disrupt service availability by providing a quoted string with a trailing backslash. Remediation There is no fixed version...

GO-2026-5486 Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline

Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline...

GO-2026-5421 PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman

PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman...

GO-2026-5434 monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr

monetr: Protected Transactions Deletable via PUT in github.com/monetr/monetr...

GO-2026-5494 Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks

Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks...

GO-2026-5280 Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus

Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus...

GO-2026-5449 Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication in github.com/amir20/dozzle

Dozzle's Cross-Site WebSocket Hijacking CSWSH on exec/attach endpointsbypasses authentication in github.com/amir20/dozzle...

GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf

androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...

GO-2026-5476 Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend

Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend...

GO-2026-5458 File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser

File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser...