Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer

memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos

An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.

SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode in github.com/siyuan-note/siyuan/kernel

Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea

Cross-site Scripting in github.com/schollz/rwtxt

On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack.

For example, Clean(".\c:") returns "c:".

Mattermost doesn't rate limit login requests, allowing DoS in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost-server from v8.0.0-20260105080200-d27a2195068d before v8.0.0-20260217110922-b7d4a1f1f59b.

A malicious account can create and sign a User JWT which causes a panic when decoded by the NATS JWT library.

yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu

Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark

Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening in github.com/getaxonflow/axonflow

Casdoor: Arbitrary file write possible through Local File System storage provider in github.com/casdoor/casdoor

An ACL policy using a block without label can be applied to unexpected resources in Nomad, a distributed, highly available scheduler designed for effortless operations and management of applications.

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

Kyverno resource with a deletionTimestamp may allow policy circumvention in github.com/kyverno/kyverno

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit

owncast is vulnerable to SQL Injection in github.com/owncast/owncast

Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik

CVE-2024-53348 in github.com/loxilb-io/loxilb

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts in github.com/edgelesssys/contrast

Collision of hash values in github.com/bnb-chain/tss-lib.

X509 Certificate verification does not validate KeyUsages EKU
requirements on Windows if VerifyOptions.Roots is nil.


Improper path sanitization on Windows permits path traversal attacks. Static file serving with the Static or StaticFS functions allows an attacker to access files from outside the filesystem root.

This vulnerability does not affect non-Windows systems.

Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` in github.com/corazawaf/coraza

### Summary
Bunch of vulnerabilities found in k8sGPT.  Fixed in release https://github.com/k8sgpt-ai/k8sgpt/releases/tag/v0.3.33

Sliver has Potential Zip Bomb Denial of Service in GzipEncoder in github.com/bishopfox/sliver

Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/portainer/portainer before v2.20.2.

Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet

Information Disclosure in Amazon ECS Container Agent in github.com/aws/amazon-ecs-agent

Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama

Network policy may be bypassed by some ICMP Echo Requests in github.com/cilium/cilium

File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser

malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor

listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk

Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.

For example, specifying origin patterns "https://foo.com" and "https://bar.com" (in that order) would yield a middleware that would incorrectly allow untrusted origin "https://barfoo.com".

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes in github.com/gotenberg/gotenberg

Arcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend

Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList

1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/1Panel-dev/1Panel/core before v0.0.0-20250730021757-04b9cbd87a15, from v1.0.0 before v2.0.6.

Application may crash due to concurrent writes, leading to a denial of service. An attacker can crash the application continuously, making it impossible for legitimate users to access the service. Authentication is not required in the attack.

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

OpenFGA is vulnerable to a denial of service attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.

CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join in github.com/daytonaio/daytona

On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.

Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/milvus-io/milvus before v2.4.24, from v2.5.0 before v2.5.21, from v2.6.0 before v2.6.5.

Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings

Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber

Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi

Improper sanitization of glob characters in github.com/caddyserver/caddy/v2

Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability in github.com/apache/trafficcontrol

CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns

Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium

### Impact
This vulnerability only affects customers using Fleet for continuous delivery with authenticated Git and/or Helm repositories.

A security vulnerability ([CVE-2022-29810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29810)) was discovered in `go-getter` library in versions prior to [`v1.5.11`](https://github.com/hashicorp/go-getter/releases/tag/v1.5.11) that exposes SSH private keys in base64 format due to a failure in redacting such information from error messages. The vulnerable version of this library is used in Rancher through Fleet in versions of Fleet prior to [`v0.3.9`](https://github.com/rancher/fleet/releases/tag/v0.3.9). This issue affects Rancher versions 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3.

When Git and/or Helm authentication is configured in [Fleet](https://rancher.com/docs/rancher/v2.6/en/deploy-across-clusters/fleet/) and Fleet is used to deploy a git repo through `Continuous Delivery`, the affected `go-getter` version will expose the configured SSH private key secret if Fleet fails to download the git repo due to a misconfigured URL. The exposed SSH key is logged in base64 format as a query parameter together with the git URL. The credentials can be seen in Rancher UI and in Fleet's deployment pod logs.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
There is not a direct mitigation besides upgrading to the patched Rancher versions. Until you are able to upgrade, limit access in Rancher to trusted users and carefully validate the URLs you are using are correct. Please note that the SSH key might still be compromised in valid URLs if the service goes down or a connection error happens when pulling from the repos.

**Note:** If you believe that SSH keys might have been exposed in your environment, it's highly advised to rotate them.

### Credits
This issue was found and reported by Dagan Henderson from Raft Engineering.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints in gitea.dev

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/0xJacky/nginx-ui before v2.3.8.

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy

traQ Allows Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/traPtitech/traQ before v3.25.0.

A malformed query can cause an out-of-bounds panic due to improper validation of arguments. If processing queries from untrusted parties, this may be used as a vector for denial of service attacks.

Soft Serve is vulnerable to SSRF through its Webhooks in github.com/charmbracelet/soft-serve

Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.3.0.

### Impact
Data Validation

### Detail
The parseCompactionRetention function in embed/etcd.go allows the retention variable value to be negative and causes the node to execute the history compaction in a loop, taking more CPU than usual and spamming logs.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)

### Summary 

The AWS Load Balancer Controller includes an optional, default-enabled feature that manages WAF WebACLs on Application Load Balancers (ALBs) on your behalf. In versions 2.8.1 and earlier, if the WebACL annotation [1] [alb.ingress.kubernetes.io/wafv2-acl-arn](http://alb.ingress.kubernetes.io/wafv2-acl-arn) or [alb.ingress.kubernetes.io/waf-acl-id](http://alb.ingress.kubernetes.io/waf-acl-id) was absent on Ingresses, the controller would automatically disassociate any existing WebACL from the ALBs, including those associated by AWS Firewall Manager (FMS). Customers on impacted versions should upgrade to prevent this issue from occurring. 

### Impact 

WebACLs attached to ALBs managed by the AWS Load Balancer Controller through methods other than Ingress annotations may be automatically removed, leaving the ALBs unprotected by WebACL. 

Impacted versions: [>=2.0.0;<2.8.2] 

### Patches 

We addressed this issue in version 2.8.2 [2] and recommend customers upgrade. Now, if the WebACL annotation is absent on Ingress objects, any existing WebACL on the ALB will remain intact instead of being removed. 

### Workarounds 

If the previous behavior affected you, you can mitigate it by disabling the WebACL management feature using the --enable-waf and --enable-wafv2 command-line flags [3] 

### References 

If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [4] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. 

[1] https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/#addons 

[2] https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.8.2 

[3] https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/configurations/#waf-addons 

[4] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count in github.com/lin-snow/ech0

zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) in zotregistry.dev/zot.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: .

The bash completion script for `fscrypt` through v0.3.2 allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the `fscrypt` bash completion script to complete mountpoint paths. We recommend upgrading to v0.3.3 or above.

For more details, see [CVE-2022-25328](https://www.cve.org/CVERecord?id=CVE-2022-25328).

Power level parsing does not parse the "events_default" key of the m.room.power_levels event, setting the event default power level to zero in all cases. This can cause events to be improperly accepted or rejected in rooms where the event_default power level has been changed.

Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api before v2.2.1.

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse in code.vikunja.io/api

Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

Improper Authorization in github.com/containers/libpod

Access Restriction Bypass in kubernetes in github.com/kubernetes/kubernetes

goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

A maliciously-crafted image can cause excessive CPU consumption in decoding.

A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode in github.com/inspektor-gadget/inspektor-gadget

Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit in github.com/fleetdm/fleet

CVE-2024-21527 in github.com/gotenberg/gotenberg

HashiCorp Consul can use cleartext agent-to-agent RPC communication in github.com/hashicorp/consul

Rat.SetString had an overflow issue that can lead to uncontrolled memory consumption.

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok

Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token high compression ratio in github.com/dvsekhvalnov/jose2go

CVE ID↕	Published↕	CVSS↓
GO-2023-1662	Aug 20, 2024	N/A
GO-2025-4220	Dec 15, 2025	N/A
GO-2023-2409	Dec 20, 2023	N/A
GO-2026-5370	Jun 25, 2026	N/A
GO-2026-5081	Jun 25, 2026	N/A
GO-2022-0231	Aug 21, 2024	N/A
GO-2022-0533	Jul 28, 2022	N/A
GO-2026-4916	Apr 2, 2026	N/A
GO-2022-0402	Jul 1, 2022	N/A
GO-2026-5980	Jul 17, 2026	N/A
GO-2023-2333	Nov 15, 2023	N/A
GO-2025-3433	Feb 4, 2025	N/A
GO-2026-5290	Jun 25, 2026	N/A
GO-2026-5945	Jul 17, 2026	N/A
GO-2024-2670	Apr 4, 2024	N/A
GO-2022-0526	Jul 20, 2022	N/A
GO-2023-1819	Aug 20, 2024	N/A
GO-2026-5468	Jun 25, 2026	N/A
GO-2026-4858	Mar 27, 2026	N/A
GO-2022-1138	Aug 21, 2024	N/A
GO-2026-6466	Sep 16, 2026	N/A
GO-2025-3545	Mar 25, 2025	N/A
GO-2026-5497	Jun 25, 2026	N/A
GO-2026-5901	Jul 7, 2026	N/A
GO-2026-5864	Jul 7, 2026	N/A
GO-2023-1904	Jul 11, 2023	N/A
GO-2021-0140	Jan 4, 2022	N/A
GO-2022-1027	Oct 5, 2022	N/A
GO-2022-0914	Aug 21, 2024	N/A
GO-2025-3537	Mar 25, 2025	N/A
GHSA-85rg-8m6h-825p	Jun 13, 2024	N/A
GO-2026-4548	Feb 25, 2026	N/A
GO-2024-3172	Oct 9, 2024	N/A
GO-2026-5682	Jun 25, 2026	N/A
GO-2025-3891	Aug 18, 2025	N/A
GO-2024-3104	Aug 30, 2024	N/A
GO-2022-0393	Aug 21, 2024	N/A
GO-2026-4738	Apr 7, 2026	N/A
GO-2023-1795	Aug 20, 2024	N/A
GO-2025-3943	Sep 17, 2025	N/A
GO-2024-2813	May 21, 2024	N/A
GO-2020-0041	Apr 14, 2021	N/A
GO-2025-3460	Mar 3, 2025	N/A
GO-2025-4155	Dec 2, 2025	N/A
GO-2026-4990	May 20, 2026	N/A
GO-2026-5476	Jun 25, 2026	N/A
GO-2023-1619	Aug 20, 2024	N/A
GO-2026-6109	Aug 18, 2026	N/A
GO-2025-3834	Aug 11, 2025	N/A
GO-2024-2654	Mar 22, 2024	N/A
GO-2026-5905	Jul 7, 2026	N/A
GO-2023-1872	Jul 5, 2023	N/A
GO-2026-5615	Jun 25, 2026	N/A
GO-2026-6581	Oct 1, 2026	N/A
GO-2026-5747	Jun 25, 2026	N/A
GO-2026-5598	Jun 25, 2026	N/A
GO-2021-0347	May 23, 2022	N/A
GO-2025-4114	Nov 17, 2025	N/A
GO-2026-5489	Jun 25, 2026	N/A
GO-2026-5585	Jul 24, 2026	N/A
GO-2025-3770	Jul 21, 2025	N/A
GO-2026-4535	Feb 26, 2026	N/A
GO-2025-4033	Oct 30, 2025	N/A
GO-2026-5667	Jun 25, 2026	N/A
GO-2022-0413	Aug 21, 2024	N/A
GHSA-wm2r-rp98-8pmh	Apr 27, 2022	N/A
GO-2026-6053	Jul 22, 2026	N/A
GO-2026-5129	Jun 25, 2026	N/A
GO-2026-5006	May 22, 2026	N/A
GO-2026-5628	Jun 25, 2026	N/A
GO-2026-5969	Jul 17, 2026	N/A
GO-2025-3913	Aug 29, 2025	N/A
GO-2021-0079	Apr 14, 2021	N/A
GO-2025-4111	Nov 17, 2025	N/A
GO-2026-5258	Jun 25, 2026	N/A
GHSA-pm3m-32r3-7mfh	Feb 3, 2024	N/A
GHSA-rjfv-pjvx-mjgv	Oct 24, 2024	N/A
GO-2026-5595	Jul 24, 2026	N/A
GO-2026-5541	Jun 25, 2026	N/A
GO-2026-4668	Mar 12, 2026	N/A
GHSA-w4f8-fxq2-j35v	Mar 1, 2022	N/A
GO-2022-0952	Aug 22, 2022	N/A
GO-2026-4850	Mar 26, 2026	N/A
GO-2026-4575	Mar 10, 2026	N/A
GO-2024-2635	Jun 5, 2024	N/A
GO-2026-5678	Jun 25, 2026	N/A
GO-2022-0641	Aug 21, 2024	N/A
GO-2022-0893	Aug 21, 2024	N/A
GO-2026-5221	Jun 25, 2026	N/A
GO-2023-1990	Aug 2, 2023	N/A
GO-2026-5068	Jun 25, 2026	N/A
GO-2026-5634	Jun 25, 2026	N/A
GO-2024-2996	Jul 22, 2024	N/A
GO-2023-1850	Aug 20, 2024	N/A
GO-2021-0317	May 23, 2022	N/A
GO-2026-5203	Jun 25, 2026	N/A
GO-2025-4123	Nov 18, 2025	N/A

Know every vulnerability
before it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

go CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.