GO-2026-5199 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault...

GO-2026-5283 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource in github.com/aiven/aiven-operator

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource in github.com/aiven/aiven-operator...

GO-2026-5204 Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches DoS in github.com/klever-io/klever-go...

GO-2026-5115 Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki

Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki...

GO-2026-5083 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services in github.com/traefik/traefik

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services in github.com/traefik/traefik...

GO-2026-5072 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows...

GO-2026-5150 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser

File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser...

GO-2026-5147 OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode in github.com/oauth2-proxy/oauth2-proxy

OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in authrequest Mode in github.com/oauth2-proxy/oauth2-proxy...

GO-2026-5169 Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder...

GO-2026-5081 Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea

Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea...

GO-2026-5086 Caddy Defender trusted proxy client IP bypass in pkg.jsn.cam/caddy-defender

Caddy Defender trusted proxy client IP bypass in pkg.jsn.cam/caddy-defender...

GO-2026-5113 ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub

ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub...

GO-2026-5120 Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers in github.com/openclaw/crabbox

Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers in github.com/openclaw/crabbox...

GO-2026-5126 opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter

opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter...

GO-2026-5131 free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) in github.com/free5gc/udr

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists nil pointer dereference in github.com/free5gc/udr...

GO-2026-5093 free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef...

GO-2026-5103 Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs

Gogs's Unauthenticated Jupyter Notebook ipynb Sanitizer allows arbitrary data: URIs leading to XSS in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GO-2026-5063 Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli...

GO-2026-5059 ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components in github.com/zitadel/zitadel

ZITADEL: Server-Side Request Forgery SSRF and Denylist Bypass in Outgoing HTTP Components in github.com/zitadel/zitadel...

GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation...

GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all...

GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close, resulting in a resource leak per connection. Unsolicited global responses are now discarded...

GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

The Verify method for FIDO/U2F security key types [email protected], [email protected] did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior,...

GO-2026-5014 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError...

GO-2026-4871 Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

GO-2026-4882 Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus

Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus...

GO-2026-4885 Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus

Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus...

GO-2026-4886 Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus

Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus...

GO-2026-4772 CVE-2026-33816 in github.com/jackc/pgx

Memory-safety vulnerability in github.com/jackc/pgx/v5...

GO-2026-4771 CVE-2026-33815 in github.com/jackc/pgx

Memory-safety vulnerability in github.com/jackc/pgx/v5...

GO-2026-4875 Ella Core panics when processing a crafted NGAP LocationReport message in github.com/ellanetworks/core

Ella Core panics when processing a crafted NGAP LocationReport message in github.com/ellanetworks/core...

GO-2026-4899 Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted in github.com/bishopfox/sliver

Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel rportfwd close is attempted in github.com/bishopfox/sliver...

GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker...

GO-2026-4855 Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api

Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...

GO-2026-4851 Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api

Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

GO-2026-4829 NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server

NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server...

GO-2026-4838 Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint in github.com/lin-snow/ech0

Ech0 authenticated user-list exposed data via public /api/allusers endpoint in github.com/lin-snow/ech0...

GO-2026-4818 Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting in github.com/authelia/authelia

Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting in github.com/authelia/authelia...

GO-2026-4826 NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server

NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server...

GO-2026-4701 github.com/ctfer-io/monitoring Vulnerable to Improper Access Control

github.com/ctfer-io/monitoring Vulnerable to Improper Access Control...

GO-2026-4715 Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/fullchain

Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/fullchain...

GO-2026-4807 Ory Hydra has a SQL injection via forged pagination tokens in github.com/ory/hydra

Ory Hydra has a SQL injection via forged pagination tokens in github.com/ory/hydra...

GO-2026-4800 Ory Keto has a SQL injection via forged pagination tokens in github.com/ory/keto

Ory Keto has a SQL injection via forged pagination tokens in github.com/ory/keto...

GO-2026-4773 Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk

Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk...

GO-2026-4751 Zitadel is missing enforcement of organization scopes in github.com/zitadel/zitadel

Zitadel is missing enforcement of organization scopes in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-4730 Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline

Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline...

GO-2026-4693 Dagu: Path Traversal via `dagRunId` in Inline DAG Execution in github.com/dagu-org/dagu

Dagu: Path Traversal via dagRunId in Inline DAG Execution in github.com/dagu-org/dagu...

GO-2026-4672 Quill has DoS via unbounded read of HTTP response body during notarization in github.com/anchore/quill

Quill has DoS via unbounded read of HTTP response body during notarization in github.com/anchore/quill...

GO-2026-4683 OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream in github.com/OliveTin/OliveTin

OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream in github.com/OliveTin/OliveTin. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...

GO-2026-4670 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files in github.com/OliveTin/OliveTin

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files in github.com/OliveTin/OliveTin...