GO-2026-6917 LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd

LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd...

GO-2026-6910 Path traversal in API route construction in github.com/mattermost/mattermost/server/public

Path traversal in API route construction in github.com/mattermost/mattermost/server/public...

GO-2026-6893 Event type spoofing via UntrustedType in github.com/google/go-eventlog

In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type fie...

GO-2026-6905 Panic on negative member size in Reader.Read in github.com/blakesmith/ar

Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out ...

GO-2026-6888 Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new...

GO-2026-6909 Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing: 1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional element causes a...

GO-2026-6911 SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go

In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer. If an MCP server responds with a 3xx...

GO-2026-6912 KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption in kubevirt.io/kubevirt

KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption in kubevirt.io/kubevirt...

GO-2026-6913 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc...

GO-2026-6907 Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arc

Arc has unauthenticated application log disclosure via /api/v1/logs in github.com/basekick-labs/arc...

GO-2026-6908 praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) in github.com/mtzanidakis/praktor

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory stored instruction injection in github.com/mtzanidakis/praktor...

GO-2026-6902 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko

kaniko can send the build's Azure Entra ID access token to lookalike ACR registry hosts in github.com/chainguard-dev/kaniko...

GO-2026-6914 KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite in kubevirt.io/kubevirt

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite in kubevirt.io/kubevirt...

GO-2026-6906 Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoil

Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoil...

GO-2026-6896 Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber...

GO-2026-6894 anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in github.com/anacrolix/torrent

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in github.com/anacrolix/torrent...

GO-2026-6889 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials in github.com/cert-manager/cert-manager

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials in github.com/cert-manager/cert-manager...

GO-2026-6900 Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs in github.com/kubeflow/pipelines

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs in github.com/kubeflow/pipelines...

GO-2026-6892 charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve...

GO-2026-6898 imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in github.com/imgproxy/imgproxy

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted datasize field in github.com/imgproxy/imgproxy...

GO-2026-6899 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines...

GO-2026-6895 imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy...

GO-2026-6891 charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve

charmbracelet/soft-serve: Race in SetPrivate leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve...

GO-2026-6897 imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy...

GO-2026-6890 Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware in github.com/daptin/daptin

Daptin: ParseAcceptLanguage separator bypass enables 250x CPU amplification via Accept-Language header in LanguageMiddleware in github.com/daptin/daptin...

GO-2026-6868 CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd...

GO-2026-6870 FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory in github.com/gtsteffaniak/filebrowser/backend

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory in github.com/gtsteffaniak/filebrowser/backend...

GO-2026-6869 Neko: Authorization bypass in legacy WebRTC input handling in github.com/m1k1o/neko/server

Neko: Authorization bypass in legacy WebRTC input handling in github.com/m1k1o/neko/server...

GO-2026-6863 SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel...

GO-2026-6880 Admission webhooks allow unbounded request-body memory exhaustion in knative.dev/pkg

Admission webhooks allow unbounded request-body memory exhaustion in knative.dev/pkg...

GO-2026-6872 Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo...

GO-2026-6862 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails...

GO-2026-6876 Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

Cross-Site Scripting XSS via unsanitized JSONP callback in github.com/labstack/echo...

GO-2026-6875 Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo...

GO-2026-6883 Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo...

GO-2026-6885 Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo...

GO-2026-6878 Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo...

GO-2026-6877 Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo...

GO-2026-6881 Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo...

GO-2026-6874 Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy...

GO-2026-6873 URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo...

GO-2026-6865 Panic on two-block frames in github.com/klauspost/compress

Panic on two-block frames in github.com/klauspost/compress...

GO-2026-6871 OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis

OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis...

GO-2026-6879 Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo...

GO-2026-6833 SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel...

GO-2026-6836 SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in github.com/siyuan-note/siyuan/kernel

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in github.com/siyuan-note/siyuan/kernel...

GO-2026-6831 SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel...

GO-2026-6834 SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel...

GO-2026-6828 SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel...

GO-2026-6844 Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo...