Critical Go package vulnerabilities

GHSA-cxf3-9h37-7rr8 · Go

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

CVE-2026-102748 · Go

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

CVE-2026-104252 · Go

Vitess vttablet /twopcz reflected XSS

CVE-2026-77459 · Go

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

CVE-2026-77524 · Go

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

CVE-2026-94603 · Go

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

CVE-2026-107806 · Go

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

CVE-2026-68582 · Go

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

CVE-2026-62252 · Go

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

CVE-2026-62253 · Go

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

CVE-2026-73802 · Go

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

CVE-2026-69085 · Go

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

CVE-2026-61604 · Go

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

CVE-2026-63132 · Go

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

CVE-2026-61682 · Go

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-77405 · Go

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

CVE-2026-77408 · Go

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

CVE-2026-77411 · Go

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

CVE-2026-88007 · Go

Traefik HTTP/3 Backend NTLM Connection Reuse

CVE-2026-88018 · Go

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

CVE-2026-88044 · Go

rclone: RC per-server auth-proxy bypass

CVE-2026-60004 · Go

Gitea: Remote Code Execution via diffpatch Git Hook Installation

CVE-2026-73294 · Go

Semaphore U: OS Command Injection

CVE-2026-73842 · Go

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

CVE-2026-69083 · Go

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

CVE-2026-69084 · Go

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

CVE-2026-72811 · Go

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE-2026-71485 · Go

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

CVE-2026-72920 · Go

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

CVE-2026-73843 · Go

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

CVE-2026-54754 · Go

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

CVE-2026-54755 · Go

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

CVE-2026-55068 · Go

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

CVE-2026-54523 · Go

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

CVE-2026-54061 · Go

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

CVE-2026-64859 · Go

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

CVE-2026-71479 · Go

New API: Integer overflow in quota billing yields negative charges (self-crediting)

CVE-2026-73080 · Go

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

CVE-2026-65600 · Go

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

CVE-2026-52855 · Go

Wings exposes node configuration secrets through egg configuration-file templating

CVE-2026-54725 · Go

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

CVE-2026-54680 · Go

Logging operator has Fluentd configuration injection that allows remote code execution

CVE-2026-54735 · Go

prebid-server's request forgery vulnerability allows for possible host environment data extraction

CVE-2026-62325 · Go

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

CVE-2026-64863 · Go

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

GHSA-r277-6w6q-xmqw · Go

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

CVE-2026-20896 · Go

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

CVE-2026-22874 · Go

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

CVE-2026-56750 · Go

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVE-2026-58426 · Go

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

CVE-2026-58443 · Go

Gitea: Public-only repository tokens can update private PR head branches

CVE-2026-53713 · Go

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

CVE-2026-50006 · Go

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

CVE-2026-50551 · Go

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

CVE-2026-54067 · Go

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

CVE-2026-54069 · Go

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

CVE-2026-54072 · Go

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

CVE-2026-54088 · Go

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

CVE-2026-54089 · Go

File Browser: Authentication Bypass via Proxy Auth Header Forgery

CVE-2026-54158 · Go

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

GHSA-g936-7jqj-mwv8 · Go

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation

CVE-2026-52831 · Go

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

CVE-2026-53649 · Go

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

CVE-2026-53552 · Go

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

CVE-2026-49445 · Go

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

CVE-2026-22547 · Go

Gitea repository creation accepts insufficiently validated fields

CVE-2026-25718 · Go

Gitea template repository generation follows unsafe filesystem paths

CVE-2026-26232 · Go

Gitea OAuth2 authorization codes can be reused after expiry

CVE-2026-26247 · Go

Gitea OAuth2 PKCE S256 verifier bypass

CVE-2026-26292 · Go

Gitea LFS mirror operations bypass migration HTTP transport protections

CVE-2026-27780 · Go

Gitea pre-receive hook scanner errors allow branch-protection bypass

CVE-2026-41052 · Go

Rancher has Privilege Escalation from Project Owner to Host

CVE-2026-44935 · Go

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

CVE-2026-44939 · Go

Rancher vulnerable to command injection through unsanitized YAML parameter

CVE-2026-50545 · Go

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

CVE-2026-50563 · Go

Fission Container Executor Function PodSpec Injection Leading to Node Escape

CVE-2026-50564 · Go

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

CVE-2026-50566 · Go

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

CVE-2026-48749 · Go

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

CVE-2026-48750 · Go

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

CVE-2026-48751 · Go

Incus has a restricted project bypass leading to arbitrary command execution

CVE-2026-48752 · Go

Incus has arbitrary file read+write on host via templates/ symlink in malicious image

CVE-2026-48753 · Go

Incus has an arbitrary file write via path traversal in S3 multipart upload

CVE-2026-48755 · Go

Incus has an argument injection in backup compression algorithm leading to AFW and ACE

CVE-2026-48769 · Go

Incus has an arbitrary file write on its client due to trusted image hash

CVE-2026-53519 · Go

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

GHSA-q6xx-5vr8-p898 · Go

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

CVE-2026-39830 · Go

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

CVE-2026-39831 · Go

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

CVE-2026-39832 · Go

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

CVE-2026-39833 · Go

golang.org/x/crypto doesn't enforce invoking key constraints

CVE-2026-39834 · Go

golang.org/x/crypto vulnerable to infinite loop on large channel writes

CVE-2026-42508 · Go

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

CVE-2026-46595 · Go

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

CVE-2026-52806 · Go

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

CVE-2026-52811 · Go

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

CVE-2026-52813 · Go

Gogs has Path Traversal in organization name that results in RCE through Git hooks

CVE-2026-12249 · Go

Canonical ADSys Uses a Less Trusted Source

CVE-2026-55884 · Go

Tilt: Missing authentication on the network-exposed Tilt HUD server

GHSA-wfqx-gjrf-g28r · Go

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

CVE-2026-49980 · Go

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

CVE-2026-48031 · Go

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

CVE-2026-53469 · Go

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

CVE-2026-53470 · Go

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

CVE-2026-53471 · Go

Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

CVE-2026-53474 · Go

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

CVE-2026-53475 · Go

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

CVE-2026-53476 · Go

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

CVE-2026-47252 · Go

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

CVE-2026-47724 · Go

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

CVE-2026-9090 · Go

Casdoor has an authentication bypass

CVE-2026-9093 · Go

Casdoor does not validate the AudienceRestriction element in SAML assertions

CVE-2026-9094 · Go

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

CVE-2026-9097 · Go

Casdoor doesn't verify that a JWT used for token exchange is still active

CVE-2026-9098 · Go

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

CVE-2026-7374 · Go

KubeVirt has a Link Following vulnerability

CVE-2026-46716 · Go

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

CVE-2026-48777 · Go

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

CVE-2026-46614 · Go

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

CVE-2026-46695 · PyPI

BoxLite: Permission Bypass Allows Modification of Read-Only Files

CVE-2026-46703 · PyPI

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

CVE-2026-45695 · Go

Kopia: RCE via SSH ProxyCommand Injection

CVE-2026-45721 · Go

Algernon: handler.lua discovery walks parent directories above the server root

CVE-2026-46354 · Go

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

CVE-2026-45625 · Go

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

CVE-2026-44848 · Go

Portainer missing authorization on Docker plugin endpoints, which allows host RCE

CVE-2026-44849 · Go

Portainer has an endpoint security bypass via Swarm service create/update

CVE-2026-8634 · Go

Crabbox: environment variable exposure vulnerability

CVE-2026-45375 · Go

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

CVE-2026-45087 · Go

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

CVE-2026-44477 · Go

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

CVE-2026-44315 · Go

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

CVE-2026-44326 · Go

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

CVE-2026-44327 · Go

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

CVE-2026-44329 · Go

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

CVE-2026-44330 · Go

free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

CVE-2026-44588 · Go

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

CVE-2026-44670 · Go

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

CVE-2026-41050 · Go

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

CVE-2026-42589 · Go

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

CVE-2026-42596 · Go

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

CVE-2026-42880 · Go

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

CVE-2026-44523 · Go

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

CVE-2026-44542 · Go

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

CVE-2026-42238 · Go

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

GHSA-9h64-2846-7x7f · Go

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

CVE-2026-42300 · Go

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

CVE-2026-42882 · Go

S3-Proxy has Security Issues in its Resource Path Matching Implementation

CVE-2026-42571 · Go

Pelican Web UI Affected by a Privilege Escalation Attack

CVE-2026-40281 · Go

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

CVE-2026-42560 · Go

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

CVE-2026-38651 · Go

Netmaker does not verify JWT signatures for host tokens

CVE-2026-41571 · Go

Note Mark: OIDC-registered users authenticated by submitting password "null"

CVE-2026-41327 · Go

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

CVE-2026-41328 · Go

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

CVE-2026-41492 · Go

Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

GHSA-xhj4-g6w8-2xjw · Go

go-zserio has Unbounded Memory Allocation for All Platforms

CVE-2026-39087 · Go

ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

CVE-2026-41070 · Go

openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

CVE-2026-41176 · Go

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

CVE-2026-41179 · Go

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

CVE-2026-42072 · Go

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

CVE-2026-41574 · Go

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

CVE-2026-41589 · Go

Wish has SCP Path Traversal that allows arbitrary file read/write

CVE-2026-40173 · Go

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

CVE-2025-41118 · Go

Pyroscope Exposes Storage Secret

CVE-2026-40575 · Go

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

CVE-2026-6290 · Go

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

CVE-2026-34457 · Go

OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

CVE-2026-40884 · Go

goshs has an empty-username SFTP password authentication bypass

CVE-2026-40946 · Go

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

CVE-2026-34177 · Go

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

CVE-2026-34178 · Go

LXD: Importing a crafted backup leads to project restriction bypass

CVE-2026-34179 · Go

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

CVE-2026-40189 · Go

goshs has a file-based ACL authorization bypass in goshs state-changing routes

CVE-2026-5412 · Go

Juju: CloudSpec method leaking cloud credentials

GHSA-9cp7-j3f8-p5jx · Go

Daptin has Unauthenticated Path Traversal and Zip Slip

CVE-2026-39846 · Go

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

CVE-2026-33815 · Go

pgx contains memory-safety vulnerability

CVE-2026-33816 · Go

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVE-2026-35392 · Go

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

CVE-2026-35393 · Go

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

CVE-2026-35471 · Go

goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

CVE-2026-34976 · Go

Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

CVE-2026-4370 · Go

Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster

CVE-2026-34448 · Go

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

CVE-2026-34449 · Go

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

CVE-2026-33026 · Go

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

CVE-2026-33897 · Go

Incus vulnerable to arbitrary file read and write through pongo templates

CVE-2026-33945 · Go

Incus has an abitrary file write through its systemd-creds options

CVE-2026-33757 · Go

OpenBao lacks user confirmation for OIDC direct callback mode

CVE-2026-33758 · Go

OpenBao has Reflected XSS in its OIDC authentication error message

GHSA-2pv8-4c52-mf8j · Go

Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

CVE-2026-33669 · Go

SiYuan has Arbitrary Document Reading within the Publishing Service

CVE-2026-33670 · Go

SiYuan has directory traversal within its publishing service

CVE-2026-33634 · Go

Trivy ecosystem supply chain was briefly compromised

CVE-2026-4404 · Go

Harbor allows the use of the default password for web UI login

CVE-2026-33419 · Go

MinIO LDAP login brute-force via user enumeration and missing rate limit

CVE-2026-33494 · Go

Ory Oathkeeper has a path traversal authorization bypass

CVE-2026-30836 · Go

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

CVE-2026-30924 · Go

qui CORS Misconfiguration: Arbitrary Origins Trusted

CVE-2026-33322 · Go

MinIO has JWT Algorithm Confusion in OIDC Authentication

CVE-2026-33186 · Go

gRPC-Go has an authorization bypass via missing leading slash in :path

CVE-2026-33211 · Go

Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

CVE-2026-32938 · Go

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service

CVE-2026-32940 · Go

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

CVE-2026-32760 · Go

File Browser Signup Grants Admin When Default Permissions Include Admin

CVE-2026-32767 · Go

SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API

CVE-2026-31886 · Go

Dagu: Path Traversal via `dagRunId` in Inline DAG Execution

CVE-2026-32301 · Go

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

CVE-2026-32614 · Go

SM9 Infinity-Point Ciphertext Forgery Vulnerability

CVE-2026-32136 · Go

AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

GHSA-54gx-3cgr-7mfm · Go

Cosmos EVM: incorrect state handling during nested EVM execution paths

GHSA-j443-wcqq-xprh · Go

Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go

GHSA-xv8g-fj9h-6gmv · Go

Linkdave Missing Authentication on REST and WebSocket endpoints

CVE-2026-30869 · Go

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

CVE-2026-30832 · Go

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import

CVE-2026-30855 · Go

WeKnora Vulnerable to Broken Access Control in Tenant Management

CVE-2026-30860 · Go

WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

CVE-2026-25921 · Go

Gogs: Cross-repository LFS object overwrite via missing content hash verification

CVE-2026-27944 · Go

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

CVE-2026-29183 · Go

SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

CVE-2026-29188 · Go

File Browser's TUS Delete Endpoint Bypasses Delete Permission Check

CVE-2026-29191 · Go

ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint

CVE-2021-25320 · Go

Rancher cloud credentials can be used through proxy API by users without access

CVE-2021-36783 · Go

Rancher doesn't properly sanitize credentials in cluster template answers

CVE-2022-31247 · Go

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

CVE-2026-28268 · Go

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

CVE-2026-27969 · Go

Vitess users with backup storage access can write to arbitrary file paths on restore

CVE-2026-27575 · Go

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

CVE-2026-27626 · Go

OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

CVE-2026-27112 · Go

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

GHSA-6qr9-g2xw-cw92 · Go

Dagu affected by unauthenticated RCE via inline DAG spec in default configuration

CVE-2026-26190 · Go

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

CVE-2025-66630 · Go

Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

CVE-2025-64111 · Go

Gogs's update .git/config file allows remote command execution

GHSA-x9p2-77v6-6vhf · Go

FrankenPHP has delayed propagation of security fixes in upstream base images

CVE-2025-62878 · Go

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

CVE-2026-25160 · Go

Alist has Insecure TLS Config

CVE-2026-25579 · Go

Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

CVE-2026-25539 · Go

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

CVE-2026-22039 · Go

Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

CVE-2025-66719 · Go

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

CVE-2026-22822 · Go

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

CVE-2026-23518 · Go

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

CVE-2026-23520 · Go

Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

CVE-2026-22688 · Go

WeKnora has Command Injection in MCP stdio test

CVE-2026-0650 · Go

OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware

GHSA-gg4x-fgg2-h9w9 · Go

Bypassing Kyverno Policies via Double Policy Exceptions

CVE-2025-62877 · Go

Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer

CVE-2025-13888 · Go

OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources

CVE-2025-66565 · Go

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values

CVE-2025-67494 · Go

ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login

CVE-2025-44005 · Go

Step CA Has Authorization Bypass in ACME and SCEP Provisioners

CVE-2025-12419 · Go

Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication

CVE-2025-12421 · Go

Mattermost fails to to verify the token used during code exchange

GHSA-rj4j-2jph-gg43 · Go

LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction

CVE-2025-41115 · Go

Grafana Incorrect Privilege Assignment vulnerability

CVE-2025-64513 · Go

Milvus Proxy has a Critical Authentication Bypass Vulnerability

GHSA-6jqf-mv7m-3q7p · Go

File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency

CVE-2025-64522 · Go

Soft Serve is vulnerable to SSRF through its Webhooks

CVE-2025-62714 · Go

Karmada Dashboard API Unauthorized Access Vulnerability

CVE-2025-54469 · Go

NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

GHSA-8pfh-j44r-f654 · Go

Cosmos EVM Vulnerability

CVE-2025-10678 · Go

NetBird VPN does not remove the default password of an admin account

CVE-2025-59823 · Go

Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

CVE-2025-59359 · Go

Chaos Controller Manager is vulnerable to OS command injection

CVE-2025-59360 · Go

Chaos Controller Manager is vulnerable to OS command injection

CVE-2025-59361 · Go

Chaos Controller Manager is vulnerable to OS command injection

CVE-2025-54123 · Go

Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

CVE-2025-58450 · Go

pREST has a Systemic SQL Injection Vulnerability

CVE-2025-55190 · Go

Argo CD's Project API Token Exposes Repository Credentials

CVE-2025-8077 · Go

NeuVector admin account has insecure default password

GHSA-qp7j-x725-g67f · Go

HydrAIDE Authentication Bypass Vulnerability

CVE-2025-55205 · Go

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

CVE-2025-54997 · Go

Privileged OpenBao Operator May Execute Code on the Underlying Host

CVE-2025-6000 · Go

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

CVE-2025-54576 · Go

OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion

CVE-2025-23266 · Go

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

CVE-2024-56731 · Go

Gogs allows deletion of internal files which leads to remote command execution

CVE-2025-4981 · Go

Mattermost allows authenticated users to write files to arbitrary locations

CVE-2025-49825 · Go

Teleport allows remote authentication bypass

CVE-2025-49136 · Go

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

CVE-2025-48865 · Go

Fabio allows HTTP clients to manipulate custom headers it adds

CVE-2025-47933 · Go

Argo CD allows cross-site scripting on repositories page

CVE-2025-47282 · Go

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

CVE-2025-47283 · Go

Gardener allows bypassing project secret validation which can lead to privilege escalation

CVE-2025-47284 · Go

Gardener allows metadata injection for a project secret which can lead to privilege escalation

CVE-2025-3757 · Go

OpenPubkey Vulnerable to Authentication Bypass

CVE-2025-4658 · Go

OPKSSH Vulnerable to Authentication Bypass

CVE-2025-46816 · Go

goshs route not protected, allows command execution

CVE-2025-24016 · Go

Wazuh server vulnerable to remote code execution

GHSA-5423-jcjm-2gpv · Go

Traefik affected by Go HTTP Request Smuggling Vulnerability

CVE-2025-30206 · Go

Dpanel's hard-coded JWT secret leads to remote code execution

CVE-2025-30215 · Go

NATS Server may fail to authorize certain Jetstream admin APIs

CVE-2025-32445 · Go

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

CVE-2025-23391 · Go

Rancher: Restricted Administrator can change Administrator's passwords

CVE-2025-30223 · Go

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

CVE-2025-1974 · Go

ingress-nginx admission controller RCE escalation

CVE-2025-29922 · Go

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

GHSA-h2rp-8vpx-q9r4 · Go

cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

GHSA-4wf3-5qj9-368v · Go

IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt

GHSA-33cr-m232-xqch · Go

cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement

CVE-2025-27509 · Go

Fleet has SAML authentication vulnerability due to improper SAML response validation

CVE-2025-27507 · Go

IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

GHSA-jg6f-48ff-5xrw · Go

IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement

CVE-2025-20051 · Go

Mattermost allows reading arbitrary files

CVE-2025-25279 · Go

Mattermost allows reading arbitrary files related to importing boards

CVE-2024-57604 · Go

MaysWind ezBookkeeping has Improper Privilege Management

CVE-2025-24786 · Go

WhoDB has a path traversal opening Sqlite3 database

CVE-2025-21613 · Go

go-git has an Argument Injection via the URL field

CVE-2024-39930 · Go

Gogs has an argument Injection in the built-in SSH server

CVE-2024-39931 · Go

Gogs allows deletion of internal files

CVE-2024-39932 · Go

Gogs allows argument injection during the previewing of changes

CVE-2024-28892 · Go

GoCast OS Command Injection vulnerability

CVE-2024-45337 · Go

Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

CVE-2024-51735 · Go

Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

CVE-2024-0132 · Go

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

CVE-2023-32197 · Go

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

CVE-2024-22036 · Go

Rancher Remote Code Execution via Cluster/Node Drivers

GHSA-7h65-4p22-39j6 · Go

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

GHSA-x7xj-jvwp-97rv · Go

RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists

CVE-2024-9264 · Go

Grafana Command Injection And Local File Inclusion Via Sql Expressions

CVE-2024-9486 · Go

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

CVE-2024-47832 · Go

SSOReady has an XML Signature Bypass via differential XML parsing

CVE-2024-46957 · Go

Mellium allows Authentication Bypass by Spoofing

CVE-2024-47062 · Go

Navidrome has Multiple SQL Injections and ORM Leak

CVE-2023-27584 · Go

Dragonfly2 has hard coded cyptographic key

CVE-2024-45410 · Go

HTTP client can manipulate custom HTTP headers that are added by Traefik

CVE-2024-8986 · Go

Grafana plugin SDK Information Leakage

CVE-2023-47105 · Go

Chaosblade vulnerable to OS command execution

CVE-2024-42490 · Go

GoAuthentik vulnerable to Insufficient Authorization for several API endpoints

CVE-2024-32231 · Go

SQL injection in github.com/stashapp/stash

CVE-2024-42480 · Go

RBAC Roles for `etcd` created by Kamaji are not disjunct

CVE-2024-6886 · Go

Gitea Cross-site Scripting Vulnerability

CVE-2023-30625 · Go

rudder-server is vulnerable to SQL injection

CVE-2023-37469 · Go

CasaOS Command Injection vulnerability

CVE-2024-39274 · Go

Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

CVE-2024-39777 · Go

Mattermost allows unsolicited invites to expose access to local channels

CVE-2024-41110 · Go

Authz zero length regression

GHSA-wm25-j4gw-6vr3 · Go

pREST vulnerable to jwt bypass + sql injection

CVE-2024-36533 · Go

Volcano has insecure permissions

CVE-2024-36536 · Go

fabedge has insecure permissions

CVE-2024-39907 · Go

1Panel has an SQL injection issue related to the orderBy clause

CVE-2024-39223 · Go

Missing key verification in gost

CVE-2024-38513 · Go

Session Middleware Token Injection Vulnerability

CVE-2019-25211 · Go

Gin mishandles a wildcard at the end of an origin string

CVE-2023-32191 · Go

rke's credentials are stored in the RKE1 Cluster state ConfigMap

CVE-2024-5262 · Go

Files or Directories Accessible to External Parties in ProjectDiscovery

CVE-2024-31989 · Go

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

CVE-2021-41244 · Go

Grafana Fine-grained access control vulnerability

CVE-2022-39328 · Go

Grafana Race condition allowing privilege escalation

CVE-2024-33434 · Go

tiagorlampert CHAOS vulnerable to arbitrary code execution

GHSA-v84h-653v-4pq9 · Go

Some CORS middleware allow untrusted origins

GHSA-vhxv-fg4m-p2w8 · Go

Some CORS middleware allow untrusted origins

CVE-2020-14316 · Go

Privilege Escalation in kubevirt

CVE-2020-28991 · Go

Improper Access Control in Gitea

CVE-2024-3817 · Go

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

GHSA-v6rw-hhgg-wc4x · Go

Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit

CVE-2024-2029 · Go

LocalAI Command Injection in audioToWav

CVE-2024-32644 · Go

Evmos transaction execution not accounting for all state transition after interaction with precompiles

GHSA-j496-crgh-34mx · Go

ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks

CVE-2024-21652 · Go

Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

CVE-2024-27102 · Go

Pterodactyl Wings vulnerable to improper isolation of server file access

CVE-2024-28175 · Go

Cross-site scripting on application summary component

CVE-2024-27302 · Go

Authorization Bypass Through User-Controlled Key in go-zero

GHSA-x5r5-2qrx-rqj8 · Go

Transparent TLS may not be applied to Marbles with certain manifest configurations

CVE-2024-25124 · Go

Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

CVE-2024-23652 · Go

BuildKit vulnerable to possible host system access from mount stub cleaner

CVE-2024-23653 · Go

Buildkit's interactive containers API does not validate entitlements check

CVE-2020-10661 · Go

HashiCorp Vault Improper Privilege Management

CVE-2024-23827 · Go

Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature

CVE-2024-22199 · Go

Django Template Engine Vulnerable to XSS

CVE-2023-49569 · Go

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

CVE-2022-3328 · Go

snapd Race Condition vulnerability