Tagged “go”
CVEs tagged go, newest first.
2109 CVEsRSS
CVE-2026-55982MediumGitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
CVE-2026-57894High· 8.5Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
CVE-2026-62843Medium· 6.8File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
CVE-2026-62685High· 8.1File Browser: Colliding username normalization gives two users the same home directory
File Browser: Colliding username normalization gives two users the same home directory
CVE-2026-54560High· 7.6Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
CVE-2026-54562Medium· 6.5Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
CVE-2026-55667High· 8.2File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
CVE-2026-55668Medium· 6.3File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
GO-2026-5985NoneNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
GO-2026-5982NoneTsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services in github.com/almeidapaulopt/tsdproxy
GO-2026-5981NoneEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0
GO-2026-5969NoneTSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy
GO-2026-5935Nonenetfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
GO-2026-5934Nonenetfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
GO-2026-5933Nonenetfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
netfoil has a resource leak in LRU cache in github.com/tinfoil-factory/netfoil
GHSA-8qqm-fp2q-v734High· 8.2Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
GHSA-rjwr-m7qx-3fjrLow· 0.0oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code
CVE-2026-50274High· 7.5github.com/DataDog/dd-trace-go: Datadog dd-trace-go: Denial of Service via malicious baggage headers (CVE-2026-50274)
A flaw was found in Datadog dd-trace-go, a Go client library. A remote, unauthenticated attacker can exploit this vulnerability by sending a request with a specially crafted baggage header containing an arbitrarily large number of key-valu…
CVE-2026-49834Medium· 5.9github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log (CVE-2026-49834)
A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency (CT) log to bypass the multi-log threshold requirements. An at…
CVE-2026-18679Mediumkuma-dp connects to control plane without verifying TLS certificate when no CA is configured
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
CVE-2026-18678Mediumkumactl connects to control plane without verifying TLS certificate when no CA is configured
kumactl connects to control plane without verifying TLS certificate when no CA is configured
CVE-2026-62290High· 7.3cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources und…
CVE-2026-56742Medium· 5.9Cilium is a networking, observability, and security solution
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any S…
CVE-2026-56852High· 7.5PoCInfinite loop on invalid input in golang.org/x/text
Infinite loop on invalid input in golang.org/x/text
GHSA-pqg7-v6wh-3pfpHigh· 8.5TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services
CVE-2026-54448HighTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
GHSA-mqxv-9rm6-w8qcHighEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
GHSA-7rx3-5wx3-5v76High· 7.7Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
CVE-2026-50141HighWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
CVE-2026-54250Medium· 5.8K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression