Tagged “go”
CVEs tagged go, newest first.
2111 CVEsRSS
CVE-2026-13426Medium· 5.4github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
CVE-2026-57231High· 7.5podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)
A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Po…
CVE-2026-55677High· 7.5github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encod…
CVE-2026-9639Medium· 6.5Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volum…
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volum…
CVE-2026-12411High· 8.4Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when securi…
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when securi…
CVE-2026-48788High· 8.2Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
GHSA-vgrc-hq28-p3xpHigh· 7.4Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
GHSA-qh5x-rfwf-rvfvHigh· 7.5Hysteria vulnerable to server crash when max_datagram_frame_size very small
Hysteria vulnerable to server crash when max_datagram_frame_size very small
GHSA-jqc5-2p7q-fqfcHigh· 7.5Hysteria: http large header with sniff cause server DoS
Hysteria: http large header with sniff cause server DoS
GHSA-rhq6-9rgh-v45cMedium· 5.0Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
GHSA-v2jf-442r-6mjhLownebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction
CVE-2026-49258High· 8.8Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
GHSA-wcr3-9x4c-f5gjHighBlnk has an API key authorization bypass in owner and scope enforcement
Blnk has an API key authorization bypass in owner and scope enforcement
GHSA-q6xx-5vr8-p898Critical· 9.9Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
CVE-2026-48794LowAuthelia has an Edge Case Access Control Rule Mismatch
Authelia has an Edge Case Access Control Rule Mismatch
CVE-2026-53520Medium· 6.5Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
CVE-2026-53521Medium· 6.4Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
CVE-2026-53519Critical· 9.1PoCNezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
CVE-2026-53522Medium· 6.5Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
CVE-2026-53523Medium· 6.8Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
CVE-2026-49340High· 8.1gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
CVE-2026-49339High· 7.1gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
CVE-2026-49338High· 7.1Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
GHSA-ww5p-j6cj-6mqqMediumNezha Dashboard: DDNS and Notification credential exposure via unredacted list API
Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API
CVE-2026-42602NoneAuthenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension
Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension
CVE-2026-40923NoneTekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
CVE-2026-40924NoneTekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
CVE-2026-42576Noneapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
CVE-2026-42575Noneapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
GHSA-r4v7-6wcg-ghj5Medium· 6.5FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks
FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks