Tagged “go”
CVEs tagged go, newest first.
2082 CVEsRSS
CVE-2026-95837High· 7.8containerd is an open-source container runtime
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing th…
CVE-2026-102663Medium· 4.3PoCOpenList is a file list program that supports multiple storage backends
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally …
CVE-2026-104774Medium· 5.8PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causin…
CVE-2026-41504Medium· 5.8PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without n…
CVE-2026-41510High· 7.2PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/url…
CVE-2026-41508Medium· 5.8OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPAR…
CVE-2026-111917Medium· 6.5PoCVikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-111918Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
CVE-2026-111919Medium· 6.5PoCVikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
CVE-2026-111920Medium· 5.4PoCVikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control…
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
CVE-2026-111922High· 6.3PoCVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
CVE-2026-111921Medium· 5.4PoCVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
CVE-2026-57458High· 8.1PoCVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange th…
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-exi…
CVE-2026-62376High· 8.1PoCVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to th…
GHSA-g38j-7v97-x298MediumVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
GHSA-8wvg-r2j4-3737MediumVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
GHSA-3hc7-r24j-rpwcMediumVikunja: Cross-project task disclosure through subtask expansion
Vikunja: Cross-project task disclosure through subtask expansion
GHSA-w2ch-4xgr-22wwLowVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
GHSA-fprf-r6rv-xg99Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
GHSA-4hv6-xc92-j86gMedium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
GHSA-pjr3-86v4-5p7wMedium· 5.4Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
GHSA-hjx8-qv73-f7cmMedium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
GHSA-fmmf-xq98-g327MediumVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
GHSA-m687-p538-r5hpHighVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
CVE-2026-107840High· 7.5yopass is a service for securely sharing secrets, passwords, and files
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopas…
CVE-2026-107839High· 7.5PoCageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server…
CVE-2026-107835Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie…
CVE-2026-107825Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUER…
CVE-2026-107834Medium· 5.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each te…