Vulnerability Reports - Go Packages

GO-2026-6665

Wed, 07 Oct 2026 22:58:04 +0000

CVE-2026-86597, GHSA-qqj6-54q6-cxv6, github.com/snowflakedb/gosnowflake, github.com/snowflakedb/gosnowflake/v2, Published: Oct 07, 2026

Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake

GO-2026-6664

CVE-2026-21727, GHSA-p5x9-j974-rpfp
Affects: github.com/grafana/grafana
Published: Oct 07, 2026, Unreviewed, Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260127141016-e702db6096e0.

_{-- Delivered by RssEverything service}

GO-2026-6663

Wed, 07 Oct 2026 22:58:02 +0000

GHSA-4wwp-f6gw-6qm5, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6662

Wed, 07 Oct 2026 22:57:51 +0000

GHSA-3cm4-ccvw-6xr6, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6657

Wed, 07 Oct 2026 22:57:47 +0000

GHSA-x8gv-g2g3-65fj, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6656

Wed, 07 Oct 2026 22:57:42 +0000

CVE-2026-73802, GHSA-x4q3-gcj3-m6cf, gitea.com/gitea/runner, Published: Oct 07, 2026, Unreviewed, gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled in gitea.com/gitea/runner

_{-- Delivered by RssEverything service}

GO-2026-6655

Wed, 07 Oct 2026 22:57:33 +0000

GHSA-p23f-cm6q-2qp8, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6654

Wed, 07 Oct 2026 22:57:31 +0000

CVE-2026-74904, GHSA-4vpg-gwqq-w44c, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6650

Wed, 07 Oct 2026 22:57:22 +0000

CVE-2026-74802, GHSA-3cc2-h3v6-rqpq, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6645

Wed, 07 Oct 2026 22:57:16 +0000

CVE-2026-59707, GHSA-8c5q-hx4g-qq23, github.com/mudler/LocalAI, Published: Oct 07, 2026, Unreviewed, LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI

_{-- Delivered by RssEverything service}

GO-2026-6639

Wed, 07 Oct 2026 22:57:10 +0000

CVE-2026-62314, GHSA-6wcg-mqvh-fcvg, github.com/TecharoHQ/anubis, Published: Oct 07, 2026, Unreviewed, Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis

_{-- Delivered by RssEverything service}

GO-2026-6638

Wed, 07 Oct 2026 22:57:07 +0000

CVE-2026-58167, GHSA-27c6-wp53-387x, github.com/ccfos/nightingale, github.com/ccfos/nightingale/v4, and 2 more, Published: Oct 07, 2026, Unreviewed, Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale

_{-- Delivered by RssEverything service}

GO-2026-6635

Wed, 07 Oct 2026 22:57:00 +0000

CVE-2026-73606, GHSA-vg99-7gj7-2fr5, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6634

Wed, 07 Oct 2026 22:56:57 +0000

CVE-2026-73609, GHSA-j4ph-9xwf-wcj4, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6632

Wed, 07 Oct 2026 22:56:49 +0000

GHSA-9cqf-hhrq-7v45, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6629

Wed, 07 Oct 2026 22:56:45 +0000

CVE-2026-56851, golang.org/x/text, Published: Oct 07, 2026

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

GO-2026-6626

CVE-2026-73605, GHSA-hf8h-97gm-4x2p
Affects: github.com/siyuan-note/siyuan/kernel
Published: Oct 07, 2026, Unreviewed, SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6624

Wed, 07 Oct 2026 22:56:37 +0000

CVE-2026-73607, GHSA-53fp-9jmv-227g, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6622

Wed, 07 Oct 2026 22:56:29 +0000

CVE-2026-72788, GHSA-hgfg-j9pg-43xw, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6621

Wed, 07 Oct 2026 22:56:26 +0000

CVE-2026-69085, GHSA-33jq-p8c2-q3q4, github.com/siyuan-note/siyuan/kernel, Published: Oct 07, 2026, Unreviewed, SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel

_{-- Delivered by RssEverything service}

GO-2026-6620

Fri, 02 Oct 2026 02:08:34 +0000

CVE-2026-53433, GHSA-mvmf-94v6-879g, github.com/junegunn/fzf, Published: Oct 01, 2026, Unreviewed, fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf

_{-- Delivered by RssEverything service}

GO-2026-6619

Fri, 02 Oct 2026 02:08:27 +0000

CVE-2024-29296, GHSA-87x6-8m9v-g8c2, github.com/portainer/portainer, Published: Oct 01, 2026, Unreviewed, Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer

_{-- Delivered by RssEverything service}

GO-2026-6617 standard library CVE-2026-97032 Affects: net/http, net/http/internal/http2, and 1 more Published: Oct 08, 2026 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a cli...

Fri, 09 Oct 2026 07:52:51 +0000

CVE-2026-81869, GHSA-p9f8-wvj8-2fg8, go.opentelemetry.io/otel/sdk, Published: Oct 01, 2026

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk

GO-2026-6615

CVE-2026-81872, GHSA-hjf4-fphr-2h65
Affects: go.opentelemetry.io/otel/sdk/log
Published: Oct 01, 2026

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log

GO-2026-6613

standard library

CVE-2026-94439
Affects: net/http
Published: Oct 08, 2026

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

GO-2026-6612

standard library

CVE-2026-78663
Affects: net/http, net/http/internal/http2, and 1 more
Published: Oct 08, 2026

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

GO-2026-6611

standard library

CVE-2026-78669
Affects: net/http, net/http/internal/http2, and 1 more
Published: Oct 08, 2026

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

GO-2026-6610

standard library

CVE-2026-78660
Affects: net/http, net/http/internal/http2, and 1 more
Published: Oct 08, 2026

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

GO-2026-6609

standard library

CVE-2026-78667
Affects: net/http
Published: Oct 08, 2026

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

GO-2026-6608

standard library

CVE-2026-94440
Affects: net/textproto, mime/multipart
Published: Oct 08, 2026

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

GO-2026-6607

standard library

CVE-2026-97031
Affects: crypto/tls
Published: Oct 08, 2026

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

GO-2026-6605

standard library

CVE-2026-56866
Affects: net/http, net/http/httputil
Published: Oct 08, 2026

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

GO-2026-6604

standard library

CVE-2026-56857
Affects: os, internal/syscall/windows
Published: Oct 08, 2026

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

GO-2026-6603

standard library

CVE-2026-78659
Affects: net/http, net/http/internal/http2, and 1 more
Published: Oct 08, 2026

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

GO-2026-6602

standard library

CVE-2026-94447
Affects: cmd/go
Published: Oct 08, 2026

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

GO-2026-6601

standard library

CVE-2026-94444
Affects: cmd/go
Published: Oct 08, 2026

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

GO-2026-6600

standard library

CVE-2026-97030
Affects: html/template
Published: Oct 08, 2026

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

GO-2026-6599

standard library

CVE-2026-94448
Affects: html/template
Published: Oct 08, 2026

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

GO-2026-6597

CVE-2026-53493, GHSA-pg57-6jwg-q645
Affects: github.com/containerd/containerd, github.com/containerd/containerd/v2
Published: Oct 01, 2026, Unreviewed, Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd

_{-- Delivered by RssEverything service}

GO-2026-6596

Fri, 02 Oct 2026 02:08:13 +0000

CVE-2026-56742, GHSA-w7c2-w76w-5hmj, github.com/cilium/cilium, Published: Oct 01, 2026

Modified: Oct 07, 2026

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

GO-2026-6595

CVE-2026-61604, GHSA-w3rp-4cm2-4wgc
Affects: github.com/ixofoundation/ixo-blockchain, github.com/ixofoundation/ixo-blockchain/v3, and 5 more
Published: Oct 01, 2026, Unreviewed, ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain

_{-- Delivered by RssEverything service}

GO-2026-6594

Fri, 02 Oct 2026 02:08:03 +0000

CVE-2026-57231, GHSA-4hq8-gpf5-8p68, github.com/containers/libpod, github.com/containers/podman, and 5 more, Published: Oct 01, 2026, Unreviewed, Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod

_{-- Delivered by RssEverything service}

GO-2026-6592

Fri, 02 Oct 2026 02:07:54 +0000

CVE-2026-62286, GHSA-xcw9-qmmf-vqxj, github.com/amir20/dozzle, Published: Oct 01, 2026, Unreviewed, Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle

_{-- Delivered by RssEverything service}

GO-2026-6591

Fri, 02 Oct 2026 02:07:48 +0000

CVE-2026-85057, GHSA-fgmf-7rf8-m6vf, github.com/zitadel/zitadel, Published: Oct 01, 2026, Unreviewed, ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel

_{-- Delivered by RssEverything service}

GO-2026-6590

Fri, 02 Oct 2026 02:07:45 +0000

CVE-2026-10609, GHSA-9xm2-gw56-wj7m, github.com/openshift/cluster-logging-operator, Published: Oct 01, 2026, Unreviewed, OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/openshift/cluster-logging-operator before v0.0.0-20260804174055-1864c2a9851d.

_{-- Delivered by RssEverything service}

GO-2026-6589

Fri, 02 Oct 2026 02:07:35 +0000

CVE-2026-85056, GHSA-9993-rfwp-rhwf, github.com/zitadel/zitadel, Published: Oct 01, 2026, Unreviewed, ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

_{-- Delivered by RssEverything service}

GO-2026-6588

Fri, 02 Oct 2026 02:07:31 +0000

CVE-2026-19730, GHSA-fx76-2j3w-2mx6, github.com/containers/podman, github.com/containers/podman/v2, and 3 more, Published: Oct 01, 2026, Unreviewed, podman quadlet install --replace does not fully replace the old file in github.com/containers/podman

_{-- Delivered by RssEverything service}

GO-2026-6586

Fri, 02 Oct 2026 02:07:26 +0000

CVE-2026-82407, GHSA-9wh6-9hq7-9688, github.com/klever-io/klever-go, Published: Oct 01, 2026, Unreviewed, Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

_{-- Delivered by RssEverything service}

GO-2026-6585

Fri, 02 Oct 2026 02:07:18 +0000

CVE-2026-82409, GHSA-7c7c-373r-gfjj, github.com/klever-io/klever-go, Published: Oct 01, 2026, Unreviewed, Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go

_{-- Delivered by RssEverything service}

GO-2026-6584

Fri, 02 Oct 2026 02:07:12 +0000

CVE-2026-82406, GHSA-26r5-4mm2-px5c, github.com/klever-io/klever-go, Published: Oct 01, 2026, Unreviewed, Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

_{-- Delivered by RssEverything service}

GO-2026-6583

Fri, 02 Oct 2026 02:07:06 +0000

CVE-2026-86064, GHSA-9v8p-frvj-2pcm, github.com/klever-io/klever-go, Published: Oct 01, 2026, Unreviewed, Klever-Go: /log controls global node logging in github.com/klever-io/klever-go

_{-- Delivered by RssEverything service}

GO-2026-6582

Fri, 02 Oct 2026 02:07:04 +0000

CVE-2026-82405, GHSA-97cv-x867-6xhm, github.com/klever-io/klever-go, Published: Oct 01, 2026, Unreviewed, Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go

_{-- Delivered by RssEverything service}

GO-2026-6581

Fri, 02 Oct 2026 02:06:53 +0000

CVE-2026-86065, GHSA-4fwh-wrm6-97xm, github.com/klever-io/klever-go, Published: Oct 01, 2026, Unreviewed, Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

_{-- Delivered by RssEverything service}

GO-2026-6579

Fri, 02 Oct 2026 02:06:49 +0000

CVE-2026-63131, GHSA-xp3c-3jw3-4vcr, github.com/openbao/openbao, Published: Oct 01, 2026, Unreviewed, OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

_{-- Delivered by RssEverything service}

GO-2026-6578

Fri, 02 Oct 2026 02:06:41 +0000

CVE-2026-77633, GHSA-xj3h-wwxq-gfcj, github.com/cloudreve/Cloudreve, github.com/cloudreve/Cloudreve/v3, and 1 more, Published: Oct 01, 2026, Unreviewed, Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve

_{-- Delivered by RssEverything service}

GO-2026-6577

Fri, 02 Oct 2026 02:06:37 +0000

CVE-2026-76803, GHSA-xhmx-w2j4-rw3q, github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei

_{-- Delivered by RssEverything service}

GO-2026-6576

Fri, 02 Oct 2026 02:06:33 +0000

CVE-2026-77637, GHSA-w89x-c962-c44g, github.com/cloudreve/Cloudreve, github.com/cloudreve/Cloudreve/v3, and 1 more, Published: Oct 01, 2026, Unreviewed, Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve

_{-- Delivered by RssEverything service}

GO-2026-6575

Fri, 02 Oct 2026 02:06:24 +0000

CVE-2026-76819, GHSA-vxg7-f2jj-jmqm, github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei

_{-- Delivered by RssEverything service}

GO-2026-6574

Fri, 02 Oct 2026 02:06:21 +0000

CVE-2026-76804, GHSA-qgw5-7j4f-fg97, github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei

_{-- Delivered by RssEverything service}

GO-2026-6573

Fri, 02 Oct 2026 02:06:17 +0000

CVE-2026-62182, GHSA-m3c6-2p7h-cfr3, github.com/kubeedge/kubeedge, Published: Oct 01, 2026, Unreviewed, KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge

_{-- Delivered by RssEverything service}

GO-2026-6572

Fri, 02 Oct 2026 02:06:06 +0000

CVE-2026-79913, GHSA-jvh5-97xg-v99f, github.com/cloudreve/Cloudreve, github.com/cloudreve/Cloudreve/v3, and 1 more, Published: Oct 01, 2026, Unreviewed, Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses in github.com/cloudreve/Cloudreve

_{-- Delivered by RssEverything service}

GO-2026-6571

Fri, 02 Oct 2026 02:05:59 +0000

CVE-2026-76805, GHSA-jpvm-9frm-hjcq, github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei

_{-- Delivered by RssEverything service}

GO-2026-6570

Fri, 02 Oct 2026 02:05:53 +0000

CVE-2026-76802, GHSA-jpf4-98qj-qr67, github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei

_{-- Delivered by RssEverything service}

GO-2026-6569

Fri, 02 Oct 2026 02:05:51 +0000

CVE-2026-62370, GHSA-gfw4-49f9-cp25, github.com/kubeedge/kubeedge, Published: Oct 01, 2026, Unreviewed, KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge

_{-- Delivered by RssEverything service}

GO-2026-6568

Fri, 02 Oct 2026 02:05:42 +0000

CVE-2026-79767, GHSA-gfjv-gqf2-c888, github.com/gardener/gardener, github.com/gardener/gardener, Published: Oct 01, 2026, Unreviewed, Gardener: Authorization Bypass via Group Subject Injection in gardener/gardener. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/gardener/gardener from v1.143.0 before v1.143.3, from v1.144.0 before v1.144.2.

_{-- Delivered by RssEverything service}

GO-2026-6567

Fri, 02 Oct 2026 02:05:37 +0000

CVE-2026-63342, GHSA-g26x-m427-f48f, github.com/hatchet-dev/hatchet, Published: Oct 01, 2026, Unreviewed, Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet

_{-- Delivered by RssEverything service}

GO-2026-6566

Fri, 02 Oct 2026 02:05:29 +0000

CVE-2026-62987, GHSA-fq95-v8xc-jm3v, github.com/fabiolb/fabio, Published: Oct 01, 2026, Unreviewed, Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio

_{-- Delivered by RssEverything service}

GO-2026-6565

Fri, 02 Oct 2026 02:05:29 +0000

CVE-2026-61681, GHSA-fjwv-jf2v-j499, github.com/hatchet-dev/hatchet, Published: Oct 01, 2026

Modified: Oct 07, 2026

SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet

GO-2026-6564

CVE-2026-77561, GHSA-9xhm-w3wj-xhqh
Affects: github.com/tinyauthapp/tinyauth
Published: Oct 01, 2026, Unreviewed, Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service in github.com/tinyauthapp/tinyauth

_{-- Delivered by RssEverything service}

GO-2026-6563

Fri, 02 Oct 2026 02:05:14 +0000

CVE-2026-62369, GHSA-9vm9-pqxx-x83v, github.com/kubeedge/kubeedge, Published: Oct 01, 2026, Unreviewed, KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge

_{-- Delivered by RssEverything service}

GO-2026-6561

Fri, 02 Oct 2026 02:05:08 +0000

CVE-2026-84298, GHSA-9q4h-f4x5-ffq8, github.com/hatchet-dev/hatchet, Published: Oct 01, 2026, Unreviewed, Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet

_{-- Delivered by RssEverything service}

GO-2026-6560

Fri, 02 Oct 2026 02:05:03 +0000

CVE-2026-88978, GHSA-992g-9cr3-vm5x, github.com/hatchet-dev/hatchet, Published: Oct 01, 2026, Unreviewed, Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

_{-- Delivered by RssEverything service}

GO-2026-6559

Fri, 02 Oct 2026 02:04:56 +0000

CVE-2026-77322, GHSA-8h6x-h86x-75wh, github.com/emiago/sipgo, Published: Oct 01, 2026, Unreviewed, SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo

_{-- Delivered by RssEverything service}

GO-2026-6558

Fri, 02 Oct 2026 02:04:51 +0000

CVE-2026-88010, GHSA-8fcf-v89g-xpg6, github.com/traefik/traefik, Published: Oct 01, 2026, Unreviewed, Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/traefik/traefik from v3.6.11 before v3.7.13.

_{-- Delivered by RssEverything service}

GO-2026-6557

Fri, 02 Oct 2026 02:04:44 +0000

CVE-2026-62371, GHSA-5jpj-293f-rhvj, github.com/kubeedge/kubeedge, Published: Oct 01, 2026, Unreviewed, KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge

_{-- Delivered by RssEverything service}

GO-2026-6556

Fri, 02 Oct 2026 02:04:37 +0000

CVE-2026-71543, GHSA-59w7-v8rr-pr4p, github.com/openbao/openbao, Published: Oct 01, 2026, Unreviewed, OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao

_{-- Delivered by RssEverything service}

GO-2026-6555

Fri, 02 Oct 2026 02:04:29 +0000

CVE-2026-77582, GHSA-456h-ww26-f758, github.com/tinyauthapp/tinyauth, Published: Oct 01, 2026, Unreviewed, Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth

_{-- Delivered by RssEverything service}

GO-2026-6554

Fri, 02 Oct 2026 02:04:28 +0000

CVE-2026-77285, GHSA-444v-8vxr-p36h, github.com/openbao/openbao, Published: Oct 01, 2026, Unreviewed, OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao

_{-- Delivered by RssEverything service}

GO-2026-6553

Fri, 02 Oct 2026 02:04:17 +0000

CVE-2026-63132, GHSA-34fc-gh42-pj53, github.com/openbao/openbao, Published: Oct 01, 2026, Unreviewed, OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao

_{-- Delivered by RssEverything service}

GO-2026-6552

Fri, 02 Oct 2026 02:04:13 +0000

CVE-2026-77560, GHSA-328g-jx67-v94g, github.com/tinyauthapp/tinyauth, Published: Oct 01, 2026, Unreviewed, Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for in github.com/tinyauthapp/tinyauth

_{-- Delivered by RssEverything service}

GO-2026-6550

Fri, 02 Oct 2026 02:04:06 +0000

CVE-2026-58268, GHSA-pg59-5vwg-4jxq, github.com/emiago/sipgo, Published: Oct 01, 2026, Unreviewed, SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo

_{-- Delivered by RssEverything service}

GO-2026-6549

Fri, 02 Oct 2026 02:04:04 +0000

CVE-2026-59168, GHSA-cqxr-jxr2-85pq, github.com/tomwright/dasel, github.com/tomwright/dasel/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

_{-- Delivered by RssEverything service}

GO-2026-6548

Fri, 02 Oct 2026 02:03:57 +0000

CVE-2026-62866, GHSA-65gg-g7rw-6cpc, github.com/tomwright/dasel, github.com/tomwright/dasel/v2, and 1 more, Published: Oct 01, 2026, Unreviewed, Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` in github.com/tomwright/dasel

_{-- Delivered by RssEverything service}

GO-2026-6547

Fri, 02 Oct 2026 02:03:51 +0000

CVE-2026-8823, GHSA-xmfh-3ccg-c9fx, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5, and 2 more, Published: Oct 01, 2026, Unreviewed, Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

_{-- Delivered by RssEverything service}

GO-2026-6545

Mon, 28 Sep 2026 22:08:27 +0000

CVE-2026-10601, GHSA-9493-h4f5-633x, github.com/grafana/grafana, github.com/grafana/grafana, and 4 more, Published: Sep 28, 2026, Unreviewed, Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

_{-- Delivered by RssEverything service}

GO-2026-6544

Mon, 28 Sep 2026 22:08:16 +0000

CVE-2026-42129, GHSA-f74p-cwhp-x2wx, github.com/grafana/grafana, github.com/grafana/grafana, and 4 more, Published: Sep 28, 2026, Unreviewed, Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

_{-- Delivered by RssEverything service}

GO-2026-6543

Mon, 28 Sep 2026 22:08:11 +0000

CVE-2026-12249, GHSA-crm4-q7v4-c2r2, github.com/ubuntu/adsys, Published: Sep 28, 2026, Unreviewed, Canonical ADSys Uses a Less Trusted Source in github.com/ubuntu/adsys. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/ubuntu/adsys before v0.16.3-0.20250318112551-8b1939f96d38.

_{-- Delivered by RssEverything service}

GO-2026-6542

Mon, 28 Sep 2026 22:08:07 +0000

CVE-2026-9029, GHSA-9g84-39mm-q4p3, github.com/grafana/grafana, github.com/grafana/grafana, and 1 more, Published: Sep 28, 2026, Unreviewed, Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

_{-- Delivered by RssEverything service}

GO-2026-6541

Mon, 28 Sep 2026 22:07:59 +0000

CVE-2026-42127, GHSA-3w66-95m3-8jxg, github.com/grafana/grafana, github.com/grafana/grafana, and 4 more, Published: Sep 28, 2026, Unreviewed, Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/grafana/grafana before v1.9.2-0.20260616075434-82ef13993059.

_{-- Delivered by RssEverything service}

GO-2026-6540

Mon, 28 Sep 2026 22:07:52 +0000

CVE-2026-61628, GHSA-pxcx-fv34-x9p5, github.com/lucasdillmann/nginx-ignition, Published: Sep 28, 2026, Unreviewed, nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/lucasdillmann/nginx-ignition before v0.0.0-20260621194639-0586b4e55ab.

_{-- Delivered by RssEverything service}

GO-2026-6539

Mon, 28 Sep 2026 22:07:49 +0000

CVE-2026-61629, GHSA-jr34-h97m-9hpx, github.com/lucasdillmann/nginx-ignition, Published: Sep 28, 2026, Unreviewed, nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition

_{-- Delivered by RssEverything service}

GO-2026-6538

Mon, 28 Sep 2026 22:07:42 +0000

GHSA-jhjp-4c2q-xmx4, github.com/falcosecurity/plugins/plugins/k8saudit, github.com/falcosecurity/plugins/plugins/k8saudit-aks, and 3 more, Published: Sep 28, 2026, Unreviewed, k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers in github.com/falcosecurity/plugins/plugins/k8saudit

_{-- Delivered by RssEverything service}

GO-2026-6537

Mon, 28 Sep 2026 22:07:37 +0000

CVE-2026-61630, GHSA-hf33-q6cf-c66f, github.com/lucasdillmann/nginx-ignition, Published: Sep 28, 2026, Unreviewed, nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition

_{-- Delivered by RssEverything service}

GO-2026-6535

Mon, 28 Sep 2026 22:07:28 +0000

CVE-2026-61687, GHSA-phg3-3g28-wq9v, github.com/hatchet-dev/hatchet, Published: Sep 28, 2026

Modified: Oct 07, 2026

Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet

GO-2026-6530

GHSA-xwmw-prc4-v3cr
Affects: github.com/obot-platform/obot
Published: Sep 28, 2026, Unreviewed, Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot

_{-- Delivered by RssEverything service}

GO-2026-6529

Mon, 28 Sep 2026 22:07:21 +0000

CVE-2026-63406, GHSA-w72w-9qmj-c9qm, github.com/anycable/anycable-go, Published: Sep 28, 2026, Unreviewed, AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/anycable/anycable-go before v1.6.15.

_{-- Delivered by RssEverything service}

GO-2026-6528

Mon, 28 Sep 2026 22:07:15 +0000

CVE-2026-63445, GHSA-vr5f-w35q-98jp, github.com/perses/perses, Published: Sep 28, 2026, Unreviewed, Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses

_{-- Delivered by RssEverything service}

GO-2026-6527

Mon, 28 Sep 2026 22:07:09 +0000

CVE-2026-61833, GHSA-qg67-7m6v-qg25, zotregistry.dev/zot, zotregistry.dev/zot/v2, Published: Sep 28, 2026, Unreviewed, zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion in zotregistry.dev/zot

_{-- Delivered by RssEverything service}

GO-2026-6526

Mon, 28 Sep 2026 22:07:01 +0000

CVE-2026-58197, GHSA-qg2g-g9w3-m5h8, github.com/stacklok/toolhive, Published: Sep 28, 2026, Unreviewed, ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive

_{-- Delivered by RssEverything service}

GO-2026-6525

Mon, 28 Sep 2026 22:06:57 +0000

GHSA-pr6h-vr44-xq8j, github.com/obot-platform/obot, Published: Sep 28, 2026, Unreviewed, Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot

_{-- Delivered by RssEverything service}

GO-2026-6523

Mon, 28 Sep 2026 22:06:49 +0000

CVE-2026-81505, GHSA-p5vg-v7mj-f6q4, github.com/frain-dev/convoy, Published: Sep 28, 2026, Unreviewed, Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy

_{-- Delivered by RssEverything service}

GO-2026-6522

Mon, 28 Sep 2026 22:06:44 +0000

GHSA-jgh3-fggc-mcpm, github.com/obot-platform/obot, Published: Sep 28, 2026, Unreviewed, Obot: Server-Side Request Forgery via remote MCP server URL in github.com/obot-platform/obot

_{-- Delivered by RssEverything service}

GO-2026-6521

Mon, 28 Sep 2026 22:06:34 +0000

CVE-2026-61794, GHSA-gxjc-74v5-3vx3, github.com/projectcapsule/capsule, Published: Sep 28, 2026, Unreviewed, Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule

_{-- Delivered by RssEverything service}

GO-2026-6520

Mon, 28 Sep 2026 22:06:29 +0000

CVE-2026-61672, GHSA-gjw4-3v3v-rqxg, github.com/projectcapsule/capsule, Published: Sep 28, 2026, Unreviewed, Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule

_{-- Delivered by RssEverything service}

GO-2026-6519

Mon, 28 Sep 2026 22:06:24 +0000

CVE-2026-61795, GHSA-f94q-w3w8-cj67, github.com/projectcapsule/capsule, Published: Sep 28, 2026, Unreviewed, Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule

_{-- Delivered by RssEverything service}

GO-2026-6518

Mon, 28 Sep 2026 22:06:21 +0000

CVE-2026-63458, GHSA-cjgj-2fwf-4c2w, github.com/perses/perses, Published: Sep 28, 2026, Unreviewed, Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses

_{-- Delivered by RssEverything service}

GO-2026-6517

Mon, 28 Sep 2026 22:06:15 +0000

CVE-2026-61682, GHSA-c8w2-fgvx-vhv4, github.com/kcp-dev/kcp, Published: Sep 28, 2026, Unreviewed, kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

_{-- Delivered by RssEverything service}

GO-2026-6516

Mon, 28 Sep 2026 22:06:08 +0000

CVE-2026-63405, GHSA-5p54-whvp-x327, github.com/anycable/anycable-go, Published: Sep 28, 2026, Unreviewed, AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/anycable/anycable-go before v1.6.15.

_{-- Delivered by RssEverything service}

GO-2026-6515

Mon, 28 Sep 2026 22:06:02 +0000

CVE-2026-77339, GHSA-5gm3-9crp-6g3v, github.com/f1bonacc1/process-compose, Published: Sep 28, 2026, Unreviewed, Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose

_{-- Delivered by RssEverything service}

GO-2026-6514

Mon, 28 Sep 2026 22:05:55 +0000

CVE-2026-63199, GHSA-4227-9989-jrhx, github.com/perses/perses, Published: Sep 28, 2026, Unreviewed, Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses

_{-- Delivered by RssEverything service}

GO-2026-6512

Fri, 02 Oct 2026 02:03:41 +0000

CVE-2026-77281, GHSA-j8px-rmrx-76h9, github.com/caddyserver/caddy/v2, Published: Oct 01, 2026

Rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass in github.com/caddyserver/caddy

GO-2026-6508

CVE-2026-81871, GHSA-w34q-cm8f-9c5x
Affects: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
Published: Sep 28, 2026, Unreviewed, OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc

_{-- Delivered by RssEverything service}

GO-2026-6507

Mon, 28 Sep 2026 22:05:39 +0000

CVE-2026-82399, GHSA-mrg3-qvqr-jw29, github.com/coredns/coredns, Published: Sep 28, 2026, Unreviewed, CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns

_{-- Delivered by RssEverything service}

GO-2026-6506

Mon, 28 Sep 2026 22:05:36 +0000

CVE-2026-86003, GHSA-9gm5-9rfh-m6vx, github.com/coredns/coredns, Published: Sep 28, 2026, Unreviewed, CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns

_{-- Delivered by RssEverything service}

GO-2026-6505

Fri, 02 Oct 2026 02:03:38 +0000

CVE-2026-81870, GHSA-8wmf-6v46-5gfg, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, and 3 more, Published: Oct 01, 2026, Unreviewed, OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

_{-- Delivered by RssEverything service}

GO-2026-6503

Fri, 02 Oct 2026 02:03:33 +0000

CVE-2026-77403, GHSA-xwwf-m8fg-p9q2, github.com/rabbitmq/amqp091-go, Published: Oct 01, 2026, Unreviewed, RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation in github.com/rabbitmq/amqp091-go

_{-- Delivered by RssEverything service}

GO-2026-6502

Fri, 02 Oct 2026 02:03:25 +0000

CVE-2026-77406, GHSA-rm6m-hrcw-jw33, github.com/rabbitmq/amqp091-go, Published: Oct 01, 2026, Unreviewed, RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go

_{-- Delivered by RssEverything service}

GO-2026-6500

Fri, 02 Oct 2026 02:03:17 +0000

CVE-2026-77410, GHSA-r9c8-gcjp-xfwh, github.com/rabbitmq/amqp091-go, Published: Oct 01, 2026, Unreviewed, RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation in github.com/rabbitmq/amqp091-go

_{-- Delivered by RssEverything service}

GO-2026-6499

Fri, 02 Oct 2026 02:03:17 +0000

CVE-2026-85731, GHSA-m37j-52j7-pjw7, oras.land/oras-go/v2, Published: Oct 01, 2026

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

GO-2026-6498

CVE-2026-77408, GHSA-j497-x9hr-x34x
Affects: github.com/rabbitmq/amqp091-go
Published: Oct 01, 2026, Unreviewed, RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go

_{-- Delivered by RssEverything service}

GO-2026-6497

Fri, 02 Oct 2026 02:03:06 +0000

CVE-2026-85732, GHSA-h7vf-4x9w-h99v, oras.land/oras-go/v2, Published: Oct 01, 2026

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

GO-2026-6496

CVE-2026-77411, GHSA-c5pq-fr2g-9jpf
Affects: github.com/rabbitmq/amqp091-go
Published: Oct 01, 2026, Unreviewed, RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr in github.com/rabbitmq/amqp091-go

_{-- Delivered by RssEverything service}

GO-2026-6495

Mon, 28 Sep 2026 22:05:29 +0000

CVE-2026-86043, GHSA-5gpm-rgj3-9q76, github.com/zalando/skipper, Published: Sep 28, 2026, Unreviewed, Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

_{-- Delivered by RssEverything service}

GO-2026-6494

Fri, 02 Oct 2026 02:03:05 +0000

CVE-2026-77412, GHSA-4v58-74mf-rjx3, github.com/rabbitmq/amqp091-go, Published: Oct 01, 2026, Unreviewed, RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client in github.com/rabbitmq/amqp091-go

_{-- Delivered by RssEverything service}