Tagged “go”
CVEs tagged go, newest first.
2075 CVEsRSS
CVE-2026-100349High· 8.2kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The…
CVE-2026-100351High· 7.4PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPa…
CVE-2026-100352High· 7.5PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-num…
CVE-2026-102748Critical· 9.2Dgraph is an open source distributed GraphQL database
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts atta…
CVE-2026-77564Low· 3.3Talos Linux is a Linux distribution built for Kubernetes deployments
Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.ta…
CVE-2026-77524Critical· 9.9PoCKEDA is a Kubernetes-based Event Driven Autoscaling component
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled…
CVE-2026-100394Medium· 6.5PoCNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later…
CVE-2026-73802Critical· 9.9Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective desp…
CVE-2026-59766Medium· 4.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still re…
CVE-2026-53999High· 7.7PoCRadius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a …
CVE-2026-104252Critical· 9.8Vitess is a database clustering system for horizontal scaling of MySQL
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP …
CVE-2026-85747Medium· 6.8PoCDistribution is a toolkit to pack, ship, store, and deliver container content
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest witho…
CVE-2026-94603Critical· 10.0Podman is a tool for managing OCI containers and pods
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied …
CVE-2026-82416High· 7.7FrankenPHP is a modern application server for PHP
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION …
CVE-2026-77459Critical· 9.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authoriz…
CVE-2026-77375Medium· 6.5SFTPGo is an open source, event-driven file transfer solution
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and aff…
CVE-2026-103028Medium· 4.3SFTPGo is an open source, event-driven file transfer solution
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name…
CVE-2026-102603Medium· 5.3Gotify server is a simple server for sending and receiving messages in real-time per WebSocket
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's curre…
CVE-2026-84312High· 7.1PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value b…
CVE-2026-84360High· 8.1PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_a…
CVE-2026-84321Medium· 5.4PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token fie…
CVE-2026-84320Medium· 6.3Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory…
CVE-2026-84319High· 8.3Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface al…
CVE-2026-84318High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The id…
CVE-2026-84317High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl module…
CVE-2026-84316High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolo…
CVE-2026-84315High· 8.3PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Sess…
CVE-2026-84314High· 8.7PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though…
CVE-2026-84313High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying…
CVE-2026-95838Medium· 4.6containerd is an open-source container runtime
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger…