GO-2026-5938 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy...

GO-2026-5933 netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil

netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil...

GO-2026-5990 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Local File Read LFR via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5988 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Server-Side Request Forgery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

GO-2026-5937 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff

oasdiff does not enforce --allow-external-refs=false on the git-revision load path SSRF / local file read in github.com/oasdiff/oasdiff...

GO-2026-5981 Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0

Ech0: ParseAcceptLanguage separator bypass enables 70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0...

GO-2026-5935 netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil

netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil...

GO-2026-5979 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery

Anyquery: Arbitrary File Write AFW which could lead to Remote Code Execution RCE via Unrestricted ATTACH DATABASE in Server Mode in github.com/julien040/anyquery...

GO-2026-5958 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon in github.com/siyuan-note/siyuan/kernel...

GO-2026-5976 Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation in go.woodpecker-ci.org/woodpecker

Woodpecker gRPC agentid metadata can be spoofed- cross-tenant agent impersonation in go.woodpecker-ci.org/woodpecker...

GO-2026-5977 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly...

GO-2026-5991 nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh

nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh...

GO-2026-5968 melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko...

GO-2026-5963 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() in github.com/siyuan-note/siyuan/kernel

SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet in github.com/siyuan-note/siyuan/kernel...

GO-2026-6009 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway...

GO-2026-5992 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker

Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker...

GO-2026-5978 MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion in github.com/StacklokLabs/mkp

MKP: Unbounded Pod Log Read via Attacker-Controlled limitBytes/tailLines Causes Memory Exhaustion in github.com/StacklokLabs/mkp...

GO-2026-5962 File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) in github.com/filebrowser/filebrowser

File Browser: Command Injection via Authentication Hook Shell Substitution Pre-Authentication RCE in github.com/filebrowser/filebrowser...

GO-2026-5996 ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

ToolHive: SSRF guard misses IPv6 NAT64 ranges 64:ff9b::/96, 64:ff9b:1::/48, allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive...

GO-2026-6002 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

ToolHive: SSRF in remote MCP server authentication discovery host-side, bypasses container isolation in github.com/stacklok/toolhive...

GO-2026-6005 Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway...

GO-2026-6003 Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway...

GO-2026-6011 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway...

GO-2026-6014 ZPan Uses Hard-Coded Password in github.com/saltbo/zpan

ZPan Uses Hard-Coded Password in github.com/saltbo/zpan...

GO-2026-5966 File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser

File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser...

GO-2026-5980 yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu

yutu: Arbitrary File Write via MCP caption-download Tool in github.com/eat-pray-ai/yutu...

GO-2026-5945 Casdoor: Arbitrary file write possible through Local File System storage provider in github.com/casdoor/casdoor

Casdoor: Arbitrary file write possible through Local File System storage provider in github.com/casdoor/casdoor...

GO-2026-6004 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE in github.com/nuclio/nuclio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

GO-2026-5969 TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy...

GO-2026-5953 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-5951 GoClaw has a Command Injection issue in github.com/nextlevelbuilder/goclaw

GoClaw has a Command Injection issue in github.com/nextlevelbuilder/goclaw...

GO-2026-5950 nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh...

GO-2026-5946 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE in github.com/nuclio/nuclio

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE in github.com/nuclio/nuclio...

GO-2026-6012 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-5984 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh...

GO-2026-5939 Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore

Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints in github.com/quay/claircore...

GO-2026-5970 Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GO-2026-5942 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintaine...

GO-2026-4970 Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

GO-2026-5764 DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream...

GO-2026-5761 Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc

Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc...

GO-2026-5743 Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy

Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy...

GO-2026-5504 Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo

Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo...

GO-2026-5676 HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go

HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go...

GO-2026-5320 Cross-site Scripting (XSS) in github.com/yuin/goldmark

Cross-site Scripting XSS in github.com/yuin/goldmark...

GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo

Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...

GO-2026-5073 DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime

DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime...