GO-2026-5525 GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp

GoBGP has a panic in AdjRib.Update via malformed BGP Update message Nil Pointer Dereference in github.com/osrg/gobgp...

GO-2026-5912 GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber...

GO-2026-5987 Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token...

GO-2026-6025 File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser

File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser...

GO-2026-6032 Gitea: Local File Inclusion via file:// URI in Migration Restore in gitea.dev

Gitea: Local File Inclusion via file:// URI in Migration Restore in gitea.dev...

GO-2026-5938 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy...

GO-2026-5964 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel

SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel...

GO-2026-5969 TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy...

GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo

Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...

GO-2026-5496 Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git

Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git...

GO-2026-5888 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico

Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...

GO-2026-5903 Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon...

GO-2026-5878 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs...

GO-2026-5899 Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor

Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor...

GO-2026-5811 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions in github.com/tursodatabase/turso-cli

turso-cli persists Turso platform JWT with world-readable 0o644 file permissions in github.com/tursodatabase/turso-cli...

GO-2026-5824 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-5751 Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows

Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows...

GO-2026-5636 Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection in github.com/gotenberg/gotenberg...

GO-2026-5663 Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server

Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server...

GO-2026-5703 OpenMeter: SQL injection through meter creation in github.com/openmeterio/openmeter

OpenMeter: SQL injection through meter creation in github.com/openmeterio/openmeter...

GO-2026-5644 SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client in github.com/siyuan-note/siyuan/kernel

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...

GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...

GO-2026-5594 Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno

Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno...

GO-2026-5416 gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify

gitverify has improper tag signature verification in github.com/supply-chain-tools/gitverify...

GO-2026-5440 Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: in github.com/xyproto/algernon...

GO-2026-5499 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio...

GO-2026-5479 goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs...

GO-2026-5489 Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings

Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings...

GO-2026-5455 Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet

Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet...

GO-2026-5172 Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2026-5378 containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd

containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd...

GO-2026-5396 free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions in github.com/free5gc/udr

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions in github.com/free5gc/udr...

GO-2026-5321 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea

Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea...

GO-2026-5334 Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea

Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea...

GO-2026-5316 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic in github.com/siderolabs/omni

Omni: Operator can traverse image-factory API paths via unsanitized talosversion in CreateSchematic in github.com/siderolabs/omni...

GO-2026-5376 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes in github.com/axllent/mailpit

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes in github.com/axllent/mailpit...

GO-2026-5370 SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode in github.com/siyuan-note/siyuan/kernel

SiYuan has broken access control in /api/search/searchAsset,searchTag,searchWidget,searchTemplate publish-mode in github.com/siyuan-note/siyuan/kernel...

GO-2026-5323 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives in github.com/fission/fission

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives in github.com/fission/fission...

GO-2026-5211 Inspektor Gadget: Command Injection via malicious buildOptions manipulation in github.com/inspektor-gadget/inspektor-gadget

Inspektor Gadget: Command Injection via malicious buildOptions manipulation in github.com/inspektor-gadget/inspektor-gadget...

GO-2026-5278 free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service in github.com/free5gc/pcf

free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service in github.com/free5gc/pcf...

GO-2026-5082 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission

Fission router exposes /fission-function// on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission...

GO-2026-5137 Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy

Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy...

GO-2026-5084 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp...

GO-2026-5163 Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication in github.com/traefik/traefik

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication in github.com/traefik/traefik...

GO-2026-5154 Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher

Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...

GO-2026-5121 Envoy AI Proxy - MCP Message Smuggling Vulnerability in github.com/envoyproxy/ai-gateway

Envoy AI Proxy - MCP Message Smuggling Vulnerability in github.com/envoyproxy/ai-gateway...

GO-2026-5176 Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass in github.com/nhost/nhost

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass in github.com/nhost/nhost...

GO-2026-5037 Inefficient candidate hostname parsing in crypto/x509

x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number...

GO-2026-5031 Panic when reading out of bound palette index in golang.org/x/image/bmp

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image...

GO-2026-4966 monetr: Server-side request forgery in Lunch Flow link creation and refresh in github.com/monetr/monetr

monetr: Server-side request forgery in Lunch Flow link creation and refresh in github.com/monetr/monetr...