Tagged “go”
CVEs tagged go, newest first.
2108 CVEsRSS
CVE-2026-40246High· 7.5free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions
free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions
CVE-2026-40922Medium· 5.4SiYuan has incomplete fix for CVE-2026-33066: XSS
SiYuan has incomplete fix for CVE-2026-33066: XSS
CVE-2026-34476High· 7.1Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
CVE-2026-40179Medium· 6.1PoCPrometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
CVE-2026-79671Medium· 5.5Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation
CVE-2026-79673Medium· 6.5Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session
CVE-2026-79672Medium· 5.5Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass
CVE-2026-79666Medium· 6.5Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs
CVE-2026-79670Medium· 4.8Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload
CVE-2026-79667High· 7.6Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export
CVE-2026-34178Critical· 9.1LXD: Importing a crafted backup leads to project restriction bypass
LXD: Importing a crafted backup leads to project restriction bypass
CVE-2026-34177Critical· 9.1LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
CVE-2026-34179Critical· 9.1LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
CVE-2026-35204High· 8.6PoCHelm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
CVE-2026-35205High· 7.8Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
CVE-2026-35596Medium· 4.3Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
CVE-2026-35597Medium· 5.9Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout
Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout
CVE-2026-40242High· 7.2PoCArcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
CVE-2026-35594Medium· 6.5Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
CVE-2026-34727High· 7.4Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path
Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path
CVE-2026-35206Medium· 4.4github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (CVE-2026-35206)
A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a specially crafted Chart to the `helm pull --untar` command. This would cause the Chart's contents to be written t…
CVE-2026-39414HighMinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
CVE-2026-32288Medium· 5.5tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
CVE-2026-39901Medium· 5.7monetr: Protected Transactions Deletable via PUT
monetr: Protected Transactions Deletable via PUT
CVE-2026-35607High· 8.1File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands
File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands
CVE-2026-39429High· 8.2kcp's cache server is accessible without authentication or authorization checks
kcp's cache server is accessible without authentication or authorization checks
CVE-2026-32289Medium· 5.4html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals (CVE…
A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be inco…
CVE-2026-32282High· 7.8golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before ac…
GHSA-xmrv-pmrh-hhx2Medium· 5.9Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
CVE-2026-39882High· 7.5⚖ disputedgithub.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading (CVE-2026-39882)
A flaw was found in OpenTelemetry-Go. The otlp HTTP exporters read the full HTTP response body into an in-memory buffer without a size cap. A remote attacker, by controlling the collector endpoint or performing a man-in-the-middle (MITM) a…