PT-2026-105556

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go...

PT-2026-105570

Dasel: Selector lexer panics on trailing whitespace in parseCurRune in github.com/tomwright/dasel...

PT-2026-105600

Klever-Go Account takeover: kleverUpdateAccountPermission authorizes on attacker-controlled RecipientAddr instead of the authenticated caller in github.com/klever-io/klever-go...

PT-2026-105594

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei...

PT-2026-105593

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...

PT-2026-105591

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers NAT64, IPv4-compatible, 6to4 reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve...

ROOT-APP-GOBINARY-CVE-2020-35381 CVE-2020-35381 in github.com/buger/jsonparser - Patched by Root

Root has patched CVE-2020-35381 in the github.com/buger/jsonparser package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-33487 CVE-2026-33487 in github.com/russellhaering/goxmldsig - Patched by Root

Root has patched CVE-2026-33487 in the github.com/russellhaering/goxmldsig package for Root:Go. Multiple fixed versions available...

GO-2026-6516 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this i...

GO-2026-6535 Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet

Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet...

GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

GO-2026-6544 Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6545 Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2026-6538 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit

k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit...

GO-2026-6515 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose...

GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses

Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...

GO-2026-6480 Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler in github.com/mattermost/mattermost-server

Mattermost doesn't enforce administrator authorization on the setDefaultInstance call within the /gitlab connect command handler in github.com/mattermost/mattermost-server...

GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...

GO-2026-6487 emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core

emp3r0r has an unauthenticated HTTP Polling DoS in github.com/jm33-m0/emp3r0r/core...

GO-2026-6521 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule

Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule...