GO-2026-4314 High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum

High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum...

GO-2026-4320 Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE in github.com/getarcaneapp/arcane/backend

Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE in github.com/getarcaneapp/arcane/backend...

GO-2026-4311 Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio

Fulcio is vulnerable to Server-Side Request Forgery SSRF via MetaIssuer Regex Bypass in github.com/sigstore/fulcio...

GO-2026-4273 Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server

Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...

GO-2025-4251 Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama

Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama...

GO-2025-4248 Mattermost has missing redirect URL validation in github.com/mattermost/mattermost

Mattermost has missing redirect URL validation in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-4303 Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable CSV Injection in github.com/mattermost/mattermost-server...

GO-2026-4308 Shiori is vulnerable to authentication bypass via a brute force attack in github.com/go-shiori/shiori

Shiori is vulnerable to authentication bypass via a brute force attack in github.com/go-shiori/shiori...

GO-2026-4298 Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server

Mattermost Server does not safeguard against phishing via error page links in github.com/mattermost/mattermost-server...

GO-2026-4300 Mattermost Server is vulnerable to DoS through maliciously crafted posts in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to DoS through maliciously crafted posts in github.com/mattermost/mattermost-server...

GO-2026-4304 CVE-2017-18901 in github.com/mattermost/mattermost-server

CVE-2017-18901 in github.com/mattermost/mattermost-server...

GO-2026-4302 Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server

Mattermost Server vulnerable to XSS via an uploaded file in github.com/mattermost/mattermost-server...

GO-2026-4309 Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign

Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign...

GO-2026-4301 Mattermost Server mishandles redirect denial action in github.com/mattermost/mattermost-server

Mattermost Server mishandles redirect denial action in github.com/mattermost/mattermost-server...

GO-2026-4295 Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server...

GO-2026-4306 Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider in github.com/mattermost/mattermost-server

Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider in github.com/mattermost/mattermost-server...

GO-2026-4296 Mattermost Server is vulnerable to XSS through display name field in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS through display name field in github.com/mattermost/mattermost-server...

GO-2026-4299 Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint in github.com/mattermost/mattermost-server

Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint in github.com/mattermost/mattermost-server...

GO-2026-4297 Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server

Mattermost Server has intermittent Authorization bypass for resource-owners in github.com/mattermost/mattermost-server...

GO-2025-4272 Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server

Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server...

GO-2026-4279 flagd: Multiple Go Runtime CVEs Impact Security and Availability in github.com/open-feature/flagd/core

flagd: Multiple Go Runtime CVEs Impact Security and Availability in github.com/open-feature/flagd/core...

GO-2026-4280 Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver

Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver...

GO-2026-4292 WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora

WeKnora has Command Injection in MCP stdio test in github.com/Tencent/WeKnora...

GO-2026-4284 Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in github.com/axllent/mailpit

Mailpit Proxy Endpoint has Server-Side Request Forgery SSRF vulnerability in github.com/axllent/mailpit...

GO-2026-4286 OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware in github.com/openflagr/flagr

OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware in github.com/openflagr/flagr...

GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve

Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve...

GO-2026-4283 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings...

GO-2026-4289 CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns

CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns...

GO-2026-4274 Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea...

GO-2026-4278 HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad

HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad...

GO-2026-4277 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk

listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-4275 Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira

Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-4281 Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer

Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer...

GO-2026-4287 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app

Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app...

GO-2026-4285 Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno

Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno...

GO-2025-4269 SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle...

GO-2026-4293 WeKnora vulnerable to SQL Injection in github.com/Tencent/WeKnora

WeKnora vulnerable to SQL Injection in github.com/Tencent/WeKnora...

GO-2025-4268 Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea...

GO-2025-4264 Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea...

GO-2025-4258 Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea...

GO-2025-4265 Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea...

GO-2025-4255 Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls

Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in in github.com/mattermost/mattermost-plugin-calls...

GO-2025-4257 KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda...

GO-2025-4267 Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea...

GO-2025-4262 Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

Gitea: anonymous user can visit private user's project in code.gitea.io/gitea...

GO-2025-4256 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost

Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost...

GO-2025-4263 Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

Gitea allows XSS because the search input box for creating tags and branches is v-html instead of v-text in code.gitea.io/gitea...

GO-2025-4254 Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls

Mattermost has CSRF vulnerability via Calls Widget page in github.com/mattermost/mattermost-plugin-calls...

GO-2025-4261 Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea...

GO-2025-4266 Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

Gitea inadvertently discloses users' login times by allowing for example the lastlogintime explore/users sort order in code.gitea.io/gitea...