vulnwire

All · go

Newest first. Every filter here is also a feed: see the subscribe box.

  1. 9.9crit
    GHSA-47w9-6r3f-938gLXD has restricted project bypass leading to arbitrary command execution
    go
    35 h ago
  2. 7.7high
    GHSA-7mr3-28h5-m5vxLXD has project restriction bypass for custom volume copy across projects
    go
    35 h ago
  3. 7.7high
    GHSA-qx75-2p3r-pwm5LXD has project restriction bypass in instance copy across projects
    go
    35 h ago
  4. 9.9crit
    GHSA-pjff-c2wc-f6jmLXD has arbitrary file write on client due to trusted image hash
    go
    36 h ago
  5. 9.9crit
    GHSA-fmc8-p6q7-75ccLXD has argument injection in backup compression algorithm leading to AFW and ACE
    go
    36 h ago
  6. 9.9crit
    GHSA-vghh-5rfx-xhq8LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
    go
    36 h ago
  7. 9.9crit
    GHSA-jpf8-86f3-wp38LXD has arbitrary file read+write on host via templates/ symlink in malicious image
    go
    36 h ago
  8. 9.9crit
    GHSA-9j25-mm2h-2f76LXD has arbitrary file write on host via `exec-output` symlink in crafted image
    go
    37 h ago
  9. –no cvss
    GO-2026-6911SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go
    go
    2 d ago
  10. –no cvss
    GO-2026-6909Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml
    go
    2 d ago
  11. –no cvss
    GO-2026-6905Panic on negative member size in Reader.Read in github.com/blakesmith/ar
    go
    2 d ago
  12. –no cvss
    GO-2026-6893Event type spoofing via UntrustedType in github.com/google/go-eventlog
    go
    2 d ago
  13. medno cvss
    GHSA-9ppr-wfw9-xvr2Netfoil doesn't decrement TTL
    go
    4 d ago
  14. lowno cvss
    GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
    go
    4 d ago
  15. 9.3crit
    CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
    go
    5 d ago
  16. 9.8crit
    GHSA-hff9-5pqw-6w9fimgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
    go
    8 d ago
  17. 7.5high
    GHSA-494m-4556-wf5pimgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
    go
    8 d ago
  18. 7.5high
    GHSA-mmq5-xm89-9pfgimgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
    go
    8 d ago
  19. 6.5med
    GHSA-2wrx-84qj-4pcganacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS
    go
    8 d ago
  20. 6.5med
    CVE-2026-55098Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
    go
    8 d ago
  21. 8.6high
    CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
    go
    8 d ago
  22. 8.2high
    CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injection
    go
    8 d ago
  23. 5.9med
    GHSA-f3fj-9625-rv3mcharmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
    go
    8 d ago
  24. 5.3med
    GHSA-fgxm-5hvv-x4vhcharmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
    go
    8 d ago
  25. 5.9med
    CVE-2026-119285Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
    go
    9 d ago
  26. 7.5high
    CVE-2026-118761Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
    go
    9 d ago
  27. 8.7high
    CVE-2026-62160Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
    go
    9 d ago
  28. 7.5high
    CVE-2026-118759Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
    go
    9 d ago
  29. 4.7med
    CVE-2026-118658Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
    go
    10 d ago
  30. 5.9med
    CVE-2026-118657Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
    go
    10 d ago