GO-2026-6841 Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo...

GO-2026-6842 Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo...

GO-2026-6839 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo...

GO-2026-6840 Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo...

GO-2026-6838 Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo...

GO-2026-6826 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization in github.com/moov-io/signedxml

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization in github.com/moov-io/signedxml...

GO-2026-6825 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo...

GO-2026-6778 Distribution: Client does not verify returned content against requested digest in github.com/distribution/distribution

Distribution: Client does not verify returned content against requested digest in github.com/distribution/distribution...

GO-2026-6800 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter in github.com/getkin/kin-openapi

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter in github.com/getkin/kin-openapi...

GO-2026-6787 kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression in github.com/getkin/kin-openapi

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression in github.com/getkin/kin-openapi...

GO-2026-6795 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi...

GO-2026-6790 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items in github.com/getkin/kin-openapi

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items in github.com/getkin/kin-openapi...

GO-2026-6785 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash in github.com/getkin/kin-openapi

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash in github.com/getkin/kin-openapi...

GO-2026-6769 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi...

GO-2026-6789 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) in github.com/getkin/kin-openapi

kin-openapi spec loader panics on a self-referential additionalProperties $ref nil-pointer DoS in github.com/getkin/kin-openapi...

GO-2026-6804 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content in github.com/getkin/kin-openapi

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content in github.com/getkin/kin-openapi...

GO-2026-6798 Vitess vttablet /twopcz reflected XSS in vitess.io/vitess

Vitess vttablet /twopcz reflected XSS in vitess.io/vitess...

GO-2026-6783 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi

kin-openapi: Unauthenticated panic DoS in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi...

GO-2026-6866 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

GO-2026-6860 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

GO-2026-6809 Distrust compromised intermediate certificates in crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...

GO-2026-6672 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6673 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty Default in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-6671 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6668 Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza...

GO-2026-6669 Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza...

GO-2026-6667 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets...

GO-2026-6670 Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza

Coraza: Truncated multipart body bypasses MULTIPARTSTRICTERROR rule 200003 via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza...

GO-2026-6651 Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core...

GO-2026-6786 TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI...

GO-2026-6767 GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli...

GO-2026-6768 Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt

Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt...

GO-2026-6776 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...

GO-2026-6799 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI...

GO-2026-6801 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI...

GO-2026-6779 Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

Nginx UI: MCP nginxconfigadd skips config directive validation → authenticated nginx directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...

GO-2026-6774 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI...

GO-2026-6770 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman

Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman...

GO-2026-6788 Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI

Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI...

GO-2026-6777 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...

GO-2026-6782 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI

Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image in github.com/0xJacky/Nginx-UI...

GO-2026-6775 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI...

GO-2026-6784 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd...

GO-2026-6765 GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli

GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli...

GO-2026-6732 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...

GO-2026-6745 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...

GO-2026-6750 Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api

Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-6731 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6758 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

Vikunja: OIDC email-fallback account linking ignores emailverified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6739 Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...