GO-2026-6125 grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai

grepai Uses a Broken or Risky Cryptographic Algorithm in github.com/yoanbernabeu/grepai...

GO-2026-6212 Gophish contains a denial of service vulnerability in github.com/gophish/gophish

Gophish contains a denial of service vulnerability in github.com/gophish/gophish...

GO-2026-6126 songquanpeng one-api has an issue that results in business logic errors

songquanpeng one-api has an issue that results in business logic errors. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...

GO-2026-6244 New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api

New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

GO-2026-5306 Type field in restricted TLS certificate allows privilege escalation in github.com/canonical/lxd

Type field in restricted TLS certificate allows privilege escalation in github.com/canonical/lxd...

GO-2026-5119 Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha

Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporte...

GO-2026-5075 Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall

When the trustedproxies option is configured, heimdall extracts client IP addresses from the Forwarded and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary...

GO-2026-5047 Integer overflow in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits,...

GO-2026-6070 Gitea: draft release attachment disclosure via missing web authorization in gitea.dev

Gitea: draft release attachment disclosure via missing web authorization in gitea.dev...

GO-2026-6067 Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev...

GO-2026-5693 Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git

Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git...

GO-2026-5158 Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel...

GO-2026-5463 Bettercap has an integer coercion error in modules/mysql_server/mysql_server.go in github.com/bettercap/bettercap

Bettercap has an integer coercion error in modules/mysqlserver/mysqlserver.go in github.com/bettercap/bettercap...

GO-2026-5543 Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp

Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp...

GO-2026-6054 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in gitea.dev

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in gitea.dev...

GO-2026-6021 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser...

GO-2026-6039 Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev...

GO-2026-6027 Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in gitea.dev...

GO-2026-6044 Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea

Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea...

GO-2026-6015 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper...

GO-2026-6037 Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload in gitea.dev

Gitea: Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload in gitea.dev...

GO-2026-5947 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE in github.com/BishopFox/joro

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE in github.com/BishopFox/joro...

GO-2026-5936 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers in github.com/zhenorzz/goploy

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and projectfile handlers in github.com/zhenorzz/goploy...

GO-2026-5984 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh...

GO-2026-5940 KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping in github.com/kedacore/keda

KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping in github.com/kedacore/keda...

GO-2026-5941 Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite

Kite has an authenticated cluster RBAC bypass in /api/v1/overview in github.com/zxh326/kite...

GO-2026-5988 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Server-Side Request Forgery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

GO-2026-5978 MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion in github.com/StacklokLabs/mkp

MKP: Unbounded Pod Log Read via Attacker-Controlled limitBytes/tailLines Causes Memory Exhaustion in github.com/StacklokLabs/mkp...

GO-2026-6002 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

ToolHive: SSRF in remote MCP server authentication discovery host-side, bypasses container isolation in github.com/stacklok/toolhive...

GO-2026-6011 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway...

GO-2026-5976 Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation in go.woodpecker-ci.org/woodpecker

Woodpecker gRPC agentid metadata can be spoofed- cross-tenant agent impersonation in go.woodpecker-ci.org/woodpecker...

GO-2026-5963 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() in github.com/siyuan-note/siyuan/kernel

SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet in github.com/siyuan-note/siyuan/kernel...

GO-2026-6009 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway...

GO-2026-5937 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff

oasdiff does not enforce --allow-external-refs=false on the git-revision load path SSRF / local file read in github.com/oasdiff/oasdiff...

GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

GO-2026-5798 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus...

GO-2026-5810 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus

Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volumesnapshots.expiresat sibling-field variant of GHSA-r7w7 in github.com/lxc/incus...

GO-2026-5905 Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium...

GO-2026-5817 Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server

Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server...

GO-2026-5820 Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server

Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server...

GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

GO-2026-5759 go-zserio has Unbounded Memory Allocation for All Platforms in github.com/woven-planet/go-zserio

go-zserio has Unbounded Memory Allocation for All Platforms in github.com/woven-planet/go-zserio...

GO-2026-5773 Gogs has an Open Redirect via redirect_to in gogs.io/gogs

Gogs has an Open Redirect via redirectto in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to...

GO-2026-5712 Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-5648 ZITADEL has LDAP Filter Injection in Login Flow in github.com/zitadel/zitadel

ZITADEL has LDAP Filter Injection in Login Flow in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...

GO-2026-5710 Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus...

GO-2026-5685 Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go

Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go...

GO-2026-5697 Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml in github.com/casdoor/casdoor

Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml in github.com/casdoor/casdoor...

GO-2026-5602 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...