GO-2026-5097 Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall

Heimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall...

GO-2026-5071 esm.sh: Legacy Route Path Traversal Can Lead to RCE in github.com/esm-dev/esm.sh

esm.sh: Legacy Route Path Traversal Can Lead to RCE in github.com/esm-dev/esm.sh...

GO-2026-5129 Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...

GO-2026-5153 Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint in github.com/mattermost/mattermost-plugin-msteams

Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint in github.com/mattermost/mattermost-plugin-msteams...

GO-2026-5157 hjson stack exhaustion vulnerability in github.com/hjson/hjson-go

hjson stack exhaustion vulnerability in github.com/hjson/hjson-go...

GO-2026-5148 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller in github.com/argoproj/argo-workflows...

GO-2026-5115 Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki

Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki...

GO-2026-5130 AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf

AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-5155 Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg

Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL in github.com/gotenberg/gotenberg...

GO-2026-5168 Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus

Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus...

GO-2026-5082 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission

Fission router exposes /fission-function// on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission...

GO-2026-5107 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI in go.opentelemetry.io/obi

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI in go.opentelemetry.io/obi...

GO-2026-5118 zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok

zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok...

GO-2026-5070 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in github.com/hahwul/dalfox...

GO-2026-5159 File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix in github.com/filebrowser/filebrowser

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix in github.com/filebrowser/filebrowser...

GO-2026-5162 Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg

Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move in github.com/gotenberg/gotenberg...

GO-2026-5095 Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana

Grafana public dashboards disclose all direct mode datasources in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-5106 CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE in github.com/cloudnative-pg/cloudnative-pg

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE in github.com/cloudnative-pg/cloudnative-pg...

GO-2026-5137 Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy

Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy...

GO-2026-5110 Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5164 CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns

CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns...

GO-2026-5178 free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistence in github.com/free5gc/udr

free5GC UDR has improper ueId validation in EE subscription handlers that allows arbitrary identifier persistence in github.com/free5gc/udr...

GO-2026-5173 Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server...

GO-2026-5077 Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding in github.com/xddxdd/bird-lg-go

Bird-lg-go has a Fatal Out-of-Memory OOM Denial of Service via Unbounded JSON Decoding in github.com/xddxdd/bird-lg-go...

GO-2026-5098 Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs

Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-5092 Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server

Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server...

GO-2026-5143 Portainer has an endpoint security bypass via Swarm service create/update in github.com/portainer/portainer

Portainer has an endpoint security bypass via Swarm service create/update in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5132 Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook in github.com/gotenberg/gotenberg

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook in github.com/gotenberg/gotenberg...

GO-2026-5127 Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus

Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus...

GO-2026-5091 Gitea has insecure default SSH settings in code.gitea.io/gitea

Gitea has insecure default SSH settings in code.gitea.io/gitea...

GO-2026-5079 Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox

Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox...

GO-2026-5067 Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server...

GO-2026-5096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser...

GO-2026-5165 Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain in github.com/mezo-org/mezod

Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain in github.com/mezo-org/mezod. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-5072 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows...

GO-2026-5078 Velocidex Velociraptor has an authorization bypass vulnerability in www.velocidex.com/golang/velociraptor

Velocidex Velociraptor has an authorization bypass vulnerability in www.velocidex.com/golang/velociraptor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5080 Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes in github.com/gotenberg/gotenberg

Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes in github.com/gotenberg/gotenberg...

GO-2026-5084 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp...

GO-2026-5087 omec-project amf crashes when processing malformed LocationReports in github.com/omec-project/amf

omec-project amf crashes when processing malformed LocationReports in github.com/omec-project/amf...

GO-2026-5088 kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp

kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp...

GO-2026-5089 FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser

FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser...

GO-2026-5093 free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef...

GO-2026-5101 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) in github.com/amir20/dozzle

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook default no-auth deploy in github.com/amir20/dozzle...

GO-2026-5104 AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf

AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5109 free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) in github.com/free5gc/smf

free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools unauthenticated, reachable Fatalf in github.com/free5gc/smf...

GO-2026-5111 Vikunja has HTML Injection via Task Titles in Overdue Email Notifications in code.vikunja.io/api

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5114 Vikunja Missing Authorization on CalDAV Task Read in code.vikunja.io/api

Vikunja Missing Authorization on CalDAV Task Read in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-5124 Gogs has DoS in rendering issue index pattern in gogs.io/gogs

Gogs has DoS in rendering issue index pattern in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edi...

GO-2026-5125 Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall...

GO-2026-5133 SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb...