GO-2026-6261 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing databa...

GO-2026-6272 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit...

GO-2026-6280 Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server

Mattermost doesn't require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server...

GO-2026-6279 Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server...

GO-2026-6273 Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis...

GO-2026-6195 Authorization bypass in serve restic in github.com/rclone/rclone

Authorization bypass in serve restic in github.com/rclone/rclone...

GO-2026-6166 WITHDRAWN: GSS authentication completes without mutual proof in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS...

GO-2026-6160 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...

GO-2026-6123 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server...

GO-2026-6144 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output in github.com/OliveTin/OliveTin

OliveTin: StartActionAndWait Endpoints Bypass logs Permission and Return Action Output in github.com/OliveTin/OliveTin...

GO-2026-6136 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs...

GO-2026-6179 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

GO-2026-6000 Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go

Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go...

GO-2026-6078 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) in gitea.dev

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009 in gitea.dev...

GO-2026-5435 Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in helm.sh/helm...

GO-2026-6049 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads in gitea.dev

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads in gitea.dev...

GO-2026-6035 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

GO-2026-5944 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper...

GO-2026-5956 OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect in github.com/openrundev/openrun

OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun...

GO-2026-6008 Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header in github.com/envoyproxy/gateway

Envoy Gateway: OCI layer extraction allocates makebyte, h.Size from untrusted tar header in github.com/envoyproxy/gateway...

GO-2026-5905 Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium...

GO-2026-5817 Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server

Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server...

GO-2026-5848 KubeVirt has a Link Following vulnerability in kubevirt.io/kubevirt

KubeVirt has a Link Following vulnerability in kubevirt.io/kubevirt...

GO-2026-5711 Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline

Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline...

GO-2026-5678 Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

Obot has an authorization bypass in /mcp-connect/id that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot...

GO-2026-5631 k8sGPT has Prompt Injection through its k8sGPT-Operator in github.com/k8sgpt-ai/k8sgpt

k8sGPT has Prompt Injection through its k8sGPT-Operator in github.com/k8sgpt-ai/k8sgpt...

GO-2026-5619 gohttp is vulnerable to directory traversal via a crafted request in github.com/itang/gohttp

gohttp is vulnerable to directory traversal via a crafted request in github.com/itang/gohttp...

GO-2026-5481 File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser

File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser...

GO-2026-5417 CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns

CoreDNS' transfer stanza selection uses lexicographic compare subzone ACL bypass in github.com/coredns/coredns...

GO-2026-5180 Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync in github.com/traefik/traefik

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync in github.com/traefik/traefik...

GO-2026-5168 Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus

Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus...

GO-2026-5127 Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus

Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus...

GO-2026-4841 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in github.com/nats-io/nats-server...

GO-2026-4725 Mattermost fails to properly validate User-Agent header tokens in github.com/mattermost/mattermost-server

Mattermost fails to properly validate User-Agent header tokens in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-4719 Romeo is vulnerable to Archive Slip due to missing checks in sanitization in github.com/ctfer-io/romeo/webserver

Romeo is vulnerable to Archive Slip due to missing checks in sanitization in github.com/ctfer-io/romeo/webserver...

GO-2026-4709 SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure in github.com/siyuan-note/siyuan/kernel

SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure in github.com/siyuan-note/siyuan/kernel...

GO-2026-4802 Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal in github.com/siyuan-note/siyuan/kernel

Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal in github.com/siyuan-note/siyuan/kernel...

GO-2026-4785 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu

Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu...

GO-2026-4776 Ella Core panics on malformed ULNASTransport Message without a Request Type in github.com/ellanetworks/core

Ella Core panics on malformed ULNASTransport Message without a Request Type in github.com/ellanetworks/core...

GO-2026-4668 zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) in zotregistry.dev/zot

zot’s create-only policy allows overwrite attempts of existing latest tag update permission not required in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-4680 Anytype Heart's gRPC API client challenge verification can be bypassed on localhost in github.com/anyproto/anytype-cli

Anytype Heart's gRPC API client challenge verification can be bypassed on localhost in github.com/anyproto/anytype-cli...

GO-2026-4661 Linkdave Missing Authentication on REST and WebSocket endpoints in github.com/shi-gg/linkdave

Linkdave Missing Authentication on REST and WebSocket endpoints in github.com/shi-gg/linkdave...

GO-2026-4595 Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd

Non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints in github.com/canonical/lxd...

GO-2026-4627 Gogs: DOM-based XSS via milestone selection in gogs.io/gogs

Gogs: DOM-based XSS via milestone selection in gogs.io/gogs...

GO-2026-4628 WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora

WeKnora is Vulnerable to SSRF via Redirection in github.com/Tencent/WeKnora...

GO-2026-4573 ZITADEL's truncated opaque tokens are still valid in github.com/zitadel/zitadel

ZITADEL's truncated opaque tokens are still valid in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-4577 malcontent: Nested archive extraction failure can drop content from scan inputs in github.com/chainguard-dev/malcontent

malcontent: Nested archive extraction failure can drop content from scan inputs in github.com/chainguard-dev/malcontent...

GO-2026-4587 OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login in github.com/OliveTin/OliveTin

OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login in github.com/OliveTin/OliveTin...

GO-2026-4572 ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel

ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...