GO-2026-5903 Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon...

GO-2026-5895 Casdoor has an authentication bypass in github.com/casdoor/casdoor

Casdoor has an authentication bypass in github.com/casdoor/casdoor...

GO-2026-5866 Concourse login flow has an open redirect issue in github.com/concourse/concourse

Concourse login flow has an open redirect issue in github.com/concourse/concourse...

GO-2026-5833 Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github

Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github...

GO-2026-5847 Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi

Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi...

GO-2026-5850 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission...

GO-2026-5844 omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf...

GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

GO-2026-5832 Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API in github.com/nezhahq/nezha

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2026-5839 Mattermost allows authenticated users to gain access to private repositories in github.com/mattermost/mattermost-plugin-github

Mattermost allows authenticated users to gain access to private repositories in github.com/mattermost/mattermost-plugin-github...

GO-2026-5837 DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language DQL injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to brea...

GO-2026-5819 Authelia has an Edge Case Access Control Rule Mismatch in github.com/authelia/authelia

Authelia has an Edge Case Access Control Rule Mismatch in github.com/authelia/authelia...

GO-2026-5805 Apptainer has incorrect path matching for 'limit container paths' directive in github.com/apptainer/apptainer

Apptainer has incorrect path matching for 'limit container paths' directive in github.com/apptainer/apptainer...

CVE-2026-40187

creationtimestamp| type| source ---|---|--- 2026-07-07 14:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2s2h3gp32g 2026-07-07 14:35:10+00:00| published-proof-of-concept| https://github.com/EGroupware/egroupware/security/advisories/GHSA-8737-2x9g-xjj7...

PYSEC-2026-1966 code injection vulnerability exists in the huggingface/text-generation-inference repository

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in rootio-langsmith - Patched by Root

Root has patched GHSA-f4xh-w4cj-qxq8 in the rootio-langsmith package for Root:PyPI. Multiple fixed versions available...

PYSEC-2026-907 Cross-site Scripting in pyload-ng

Cross-site Scripting XSS - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42...

PYSEC-2026-979 TensorFlow vulnerable to `CHECK` fail in `TensorListFromTensor`

Impact When TensorListFromTensor receives an elementshape of a rank greater than one, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg0=tf.random.uniformshape=6, 6, 2, dtype=tf.bfloat16, maxval=None arg1=tf.random.uniformshape=6, 9, 1, 3,...

CVE-2026-34170

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...