Tagged “go”
CVEs tagged go, newest first.
2108 CVEsRSS
CVE-2026-41179Critical· 9.8PoCRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
CVE-2026-41131Medium· 5.0OpenFGA has Improper Policy Enforcement
OpenFGA has Improper Policy Enforcement
CVE-2026-41282Medium· 5.3Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
CVE-2026-33812NoneExcessive memory allocation when decoding malicious SFNT in golang.org/x/image
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
CVE-2026-39396Low· 3.1OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
CVE-2026-40264LowOpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
CVE-2026-39388Low· 3.1OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
CVE-2026-39946Medium· 4.9OpenBao's SQL Injection in PostgreSQL database secrets engine
OpenBao's SQL Injection in PostgreSQL database secrets engine
CVE-2026-40890High· 7.5github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input (CVE-2026-40890)
A flaw was found in github.com/gomarkdown/markdown, a Go library for parsing Markdown text and rendering as HTML. A remote attacker could exploit this vulnerability by providing a specially crafted malformed input. Specifically, input cont…
CVE-2026-40161High· 7.7github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure of Git API token via user-controlled serverURL (CVE-2026-40161)
A flaw was found in Tekton Pipelines. A tenant with permissions to create TaskRun or PipelineRun resources can exploit this vulnerability. By omitting the Git API token parameter and pointing the serverURL to an attacker-controlled endpoin…
CVE-2026-25542Medium· 6.5github.com/tektoncd/pipeline: Tekton Pipelines: Security bypass due to regular expression matching flaw (CVE-2026-25542)
A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the `regexp.MatchString` function in G…
CVE-2026-6634Medium· 6.3Memos has an Incorrect Privilege Assignment issue
Memos has an Incorrect Privilege Assignment issue
CVE-2026-41589Critical· 9.6Wish has SCP Path Traversal that allows arbitrary file read/write
Wish has SCP Path Traversal that allows arbitrary file read/write
CVE-2026-41491High· 8.1Dapr: Service Invocation path traversal ACL bypass
Dapr: Service Invocation path traversal ACL bypass
CVE-2026-5052Medium· 5.3HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
CVE-2026-5807High· 7.5HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
CVE-2026-4525High· 7.5HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
CVE-2026-40293High· 7.5OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint (CVE-2026-40293)
A flaw was found in OpenFGA, an authorization/permission engine. When OpenFGA is configured to use preshared-key authentication and the built-in playground is enabled and accessible beyond localhost or trusted networks, a remote attacker c…
CVE-2026-5160Medium· 6.1goldmark vulnerable to Cross-site Scripting (XSS)
goldmark vulnerable to Cross-site Scripting (XSS)
CVE-2026-40173Critical· 9.4Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
CVE-2026-40611High· 8.8ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
CVE-2026-41068High· 7.7Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
CVE-2026-21727Low· 3.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user wi…
CVE-2024-53412High· 8.4NietThijmen ShoppingCart: Command injection in the connect function
NietThijmen ShoppingCart: Command injection in the connect function
CVE-2026-40574Medium· 6.8OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims
CVE-2026-40575Critical· 9.1OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing
CVE-2026-21726Medium· 5.3Grafana Loki Path Traversal - CVE-2021-36156 Bypass
Grafana Loki Path Traversal - CVE-2021-36156 Bypass
CVE-2026-41145High· 8.2MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
CVE-2026-40344High· 8.2MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
CVE-2026-40090High· 7.1Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write