Tagged “go”

CVEs tagged go, newest first.

1735 CVEsRSS

CVE-2026-5807High· 7.5

5mo ago

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

▾ Twilighthashicorp · github.com/hashicorp/vaultEPSS 0.91%via OSV

CVE-2026-4525High· 7.5

5mo ago

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization

▾ Twilighthashicorp · github.com/hashicorp/vaultEPSS 0.59%via OSV

CVE-2026-40293High· 7.5

5mo ago

OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint (CVE-2026-40293)

A flaw was found in OpenFGA, an authorization/permission engine. When OpenFGA is configured to use preshared-key authentication and the built-in playground is enabled and accessible beyond localhost or trusted networks, a remote attacker c…

Tagged “go”

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization

OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint (CVE-2026-40293)

goldmark vulnerable to Cross-site Scripting (XSS)

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

NietThijmen ShoppingCart: Command injection in the connect function

OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Grafana Loki Path Traversal - CVE-2021-36156 Bypass

Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

SiYuan has incomplete fix for CVE-2026-33066: XSS

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

LXD: Importing a crafted backup leads to project restriction bypass

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint