Tagged “go”
CVEs tagged go, newest first.
1732 CVEsRSS
CVE-2026-56743Medium· 5.4Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match
CVE-2026-75602Medium· 6.5OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a pe…
GHSA-99rq-75j6-5j9fHigh· 8.7SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
GHSA-gw25-m53r-qh88Medium· 6.5SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
CVE-2026-50554Medium· 5.3Note Mark is an open-source note-taking application
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the …
CVE-2026-56855Medium· 5.3Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
CVE-2026-78662Medium· 5.3golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding (CVE-2026-78662)
A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service (DoS) for…
CVE-2026-59834High· 7.5SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
CVE-2026-59832High· 7.7Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
CVE-2026-52833High· 8.0Nuclio is a "Serverless" framework for Real-Time Events and Data Processing
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runti…
CVE-2026-52832Medium· 4.9PoCNuclio is a "Serverless" framework for Real-Time Events and Data Processing
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:…
CVE-2026-52831High· 8.0⚖ disputedNuclio is a "Serverless" framework for Real-Time Events and Data Processing
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container…
CVE-2026-53649Critical· 9.6Joro is a web exploitation framework
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelis…
CVE-2026-84303MediumgRPC-Go is the Go language implementation of gRPC
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are…
CVE-2026-84196High· 7.7Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers…
CVE-2023-54356Low· 3.7Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints
Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack (CVE-2…
CVE-2026-84200Critical· 9.0Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the po…
CVE-2026-84199High· 7.7Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions …
CVE-2026-84195High· 7.7Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCal…
CVE-2025-15613Medium· 6.5Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service conf…
CVE-2026-84304HighgRPC-Go is the Go language implementation of gRPC
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate…
CVE-2026-53508Mediumoasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRef…
CVE-2026-53552Critical· 9.6Goploy is an open-source automation deployment system
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id fro…
CVE-2026-53553High· 7.7Goploy is an open-source automation deployment system
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by…
CVE-2026-55785Low· 3.7free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAk…
CVE-2026-55764HighKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/sy…
CVE-2026-55873Medium· 4.3SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
CVE-2026-55784High· 7.5free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, ke…
CVE-2026-55763HighKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early…
CVE-2026-55761High· 5.9Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances