Tagged “go”
CVEs tagged go, newest first.
2111 CVEsRSS
CVE-2026-42508Critical· 9.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
CVE-2026-39834Medium· 6.5⚖ disputedgolang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write (CVE-2026-39834)
A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnera…
CVE-2026-46595High· 7.1PoC⚖ disputedgolang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This…
CVE-2026-46612High· 8.8Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
CVE-2026-46617HighFission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code names…
Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read
CVE-2026-45781Low· 3.5MCP Registry: OCI validator skips ownership check on upstream rate limits
MCP Registry: OCI validator skips ownership check on upstream rate limits
CVE-2026-45712Medium· 5.9Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
CVE-2026-45711Medium· 5.9Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
CVE-2026-45709Medium· 5.8Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
CVE-2026-45713High· 7.5Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
GHSA-wwhq-w58m-w29cMediumCaddy CVE-2026-30852 Fix Bypass
Caddy CVE-2026-30852 Fix Bypass
GHSA-gx7w-56w6-g48xMedium· 4.3Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
CVE-2026-45571Medium· 5.4go-git: Crafted repositories may modify main and submodule .git directories
go-git: Crafted repositories may modify main and submodule .git directories
GHSA-g53w-w6mj-hrppCriticalMCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
CVE-2026-45692Medium· 5.4Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
GHSA-mx64-mj3q-7prjHigh· 7.5iskorotkov/avro: Denial-of-Service Vulnerability in Decoder
iskorotkov/avro: Denial-of-Service Vulnerability in Decoder
CVE-2026-18676MediumDefault kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
CVE-2026-44283Medium· 4.3⚖ disputedetcd: etcd: Authenticated user can bypass RBAC for unauthorized data access (CVE-2026-44283)
A flaw was found in etcd, a distributed key-value store. An authenticated user, without sufficient read or lease-related permissions, could bypass Role-Based Access Control (RBAC) authorization checks. This bypass occurs during transaction…
CVE-2026-45021MediumDefault kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
CVE-2026-8634Critical· 9.1PoCCrabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens…
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens…
CVE-2026-44885Medium· 5.5Portainer has a path traversal in backup archive extraction that allows arbitrary file write
Portainer has a path traversal in backup archive extraction that allows arbitrary file write
GHSA-gxhx-2686-5h9gMediumslack-go `SecretsVerifier` accepts empty signing secret without precondition
slack-go `SecretsVerifier` accepts empty signing secret without precondition
CVE-2026-44697High· 8.6Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload
CVE-2026-45152High· 7.8uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution
CVE-2026-44301High· 7.3hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines (CVE-2026-44301)
A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines (such as PostCSS, Babel, or TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. This could allow code run…
CVE-2026-44477Critical· 9.9CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
CVE-2026-8276Low· 3.7bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go
bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go
CVE-2026-45022Highgo-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
CVE-2026-42595High· 8.6Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
CVE-2026-6815Medium· 5.9PoCCasdoor: Arbitrary file write possible through Local File System storage provider
Casdoor: Arbitrary file write possible through Local File System storage provider