Security Digest · page 1 of 4
Critical Go advisories
391 critical advisories for Go packages since October 2023, newest first. Check your project with govulncheck ./....
- Vitess vttablet /twopcz reflected XSS CVE-2026-104252 CVSS 9.8 Critical
vitess.io/vitess< 0.23.5 → fixed in 0.23.5;vitess.io/vitess>= 0.24.0, < 0.24.2 → fixed in 0.24.2 - Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service CVE-2026-102748 CVSS 9.2 Critical
github.com/dgraph-io/dgraph/v25<= 25.3.8 → fixed in 25.4.0 - Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks CVE-2026-77459 CVSS 9.9 Critical
github.com/argoproj/argo-cd/v2>= 2.10.0, <= 2.14.21 → no fix listed;github.com/argoproj/argo-cd/v3>= 3.0.0, < 3.3.15 → fixed in 3.3.15;github.com/argoproj/argo-cd/v3>= 3.4.0, < 3.4.10 → fixed in 3.4.10; +2 more packages - KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication CVE-2026-77524 CVSS 9.9 Critical
github.com/kedacore/keda<= 1.5.0 → no fix listed;github.com/kedacore/keda/v2< 2.21.0 → fixed in 2.21.0 - Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation CVE-2026-94603 CVSS 10.0 Critical
github.com/containers/podman>= 4.4.0, < 5.8.8 → fixed in 5.8.8;go.podman.io/podman/v6>= 6.0.0, < 6.1.3 → fixed in 6.1.3 - Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) CVE-2026-68582 CVSS 9.3 Critical
code.vikunja.io/api>= 0.24.0, <= 2.3.0 → fixed in 2.4.0 - Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite CVE-2026-107806 CVSS 9.0 Critical
github.com/0xJacky/Nginx-UI>= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 → fixed in 1.9.10-0.20260728074146-a467ed652591 - Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) CVE-2026-62253 CVSS 9.8 Critical
github.com/sipcapture/homer-app< 0.0.0-20260625093330-5e90809657c9 → fixed in 0.0.0-20260625093330-5e90809657c9 - Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login CVE-2026-62252 CVSS 9.8 Critical
github.com/sipcapture/homer-app< 0.0.0-20260625091610-b2e942031ff8 → fixed in 0.0.0-20260625091610-b2e942031ff8 - gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled CVE-2026-73802 CVSS 9.9 Critical
gitea.com/gitea/runner< 1.0.9-0.20260731160927-34bfa1915022 → fixed in 1.0.9-0.20260731160927-34bfa1915022 - SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking CVE-2026-69085 CVSS 10.0 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260721043339-eef10568384e → fixed in 0.0.0-20260721043339-eef10568384e - ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass CVE-2026-61604 CVSS 9.3 Critical
github.com/ixofoundation/ixo-blockchain/v8< 8.0.0 → fixed in 8.0.0;github.com/ixofoundation/ixo-blockchain/v7<= 7.0.0 → no fix listed;github.com/ixofoundation/ixo-blockchain/v6<= 6.0.1 → no fix listed; +4 more packages - OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack CVE-2026-63132 CVSS 9.1 Critical
github.com/openbao/openbao< 0.0.0-20260713141742-763625a20721 → fixed in 0.0.0-20260713141742-763625a20721;github.com/openbao/openbao>= 0.1.0, <= 1.1.5 → no fix listed - kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and… CVE-2026-61682 CVSS 9.9 Critical
github.com/kcp-dev/kcp< 0.31.4 → fixed in 0.31.4;github.com/kcp-dev/kcp>= 0.32.0, < 0.32.2 → fixed in 0.32.2 - RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow CVE-2026-77408 CVSS 9.1 Critical
github.com/rabbitmq/amqp091-go< 1.13.0 → fixed in 1.13.0 - RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-77411 CVSS 9.5 Critical
github.com/rabbitmq/amqp091-go< 1.13.0 → fixed in 1.13.0 - RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77405 CVSS 9.4 Critical
github.com/rabbitmq/amqp091-go< 1.13.0 → fixed in 1.13.0 - rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass CVE-2026-88018 CVSS 9.8 Critical
github.com/rclone/rclone< 1.75.1 → fixed in 1.75.1 - Traefik HTTP/3 Backend NTLM Connection Reuse CVE-2026-88007 CVSS 9.1 Critical
github.com/traefik/traefik/v3>= 3.0.0, < 3.7.13 → fixed in 3.7.13;github.com/traefik/traefik/v2>= 2.11.0, < 2.11.57 → fixed in 2.11.57 - rclone: RC per-server auth-proxy bypass CVE-2026-88044 CVSS 9.1 Critical
github.com/rclone/rclone>= 1.70.0, < 1.75.1 → fixed in 1.75.1 - Semaphore U: OS Command Injection CVE-2026-73294 CVSS 9.9 Critical
github.com/semaphoreui/semaphore< 0.0.0-20260704181911-7e8a9434bd81 → fixed in 0.0.0-20260704181911-7e8a9434bd81 - Gitea: Remote Code Execution via diffpatch Git Hook Installation CVE-2026-60004 CVSS 9.8 Critical
gitea.dev>= 1.17.0, < 1.27.1 → fixed in 1.27.1 - OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and… CVE-2026-73842 CVSS 9.0 Critical
github.com/openchoreo/openchoreo< 1.0.3 → fixed in 1.0.3;github.com/openchoreo/openchoreo>= 1.1.0, < 1.1.3 → fixed in 1.1.3;github.com/openchoreo/openchoreo>= 1.2.0-rc.1, < 1.2.0-rc.2 → fixed in 1.2.0 - SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle… CVE-2026-69084 CVSS 10.0 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260721002947-23a17d44b5f3 → fixed in 0.0.0-20260721002947-23a17d44b5f3 - SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and… CVE-2026-72811 CVSS 10.0 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260723004839-1a5b3431d5ab → fixed in 0.0.0-20260723004839-1a5b3431d5ab - SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method… CVE-2026-69083 CVSS 10.0 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260721004815-cf42dd5680c8 → fixed in 0.0.0-20260721004815-cf42dd5680c8 - OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs CVE-2026-73843 CVSS 9.6 Critical
github.com/openchoreo/openchoreo< 1.0.2 → fixed in 1.0.2;github.com/openchoreo/openchoreo>= 1.1.0, < 1.1.2 → fixed in 1.1.2 - Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends CVE-2026-71485 CVSS 9.1 Critical
github.com/centrifugal/centrifugo<= 6.8.4 → fixed in 6.9.0 - SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control CVE-2026-72920 CVSS 9.8 Critical
github.com/seaweedfs/seaweedfs< 0.0.0-20260512171108-5e8f99f40a8a → fixed in 0.0.0-20260512171108-5e8f99f40a8a - free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints CVE-2026-55068 CVSS 9.3 Critical
github.com/free5gc/free5gc< 4.2.2 → fixed in 4.2.2 - Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) CVE-2026-54754 CVSS 9.6 Critical
github.com/klever-io/klever-go< 1.7.19 → fixed in 1.7.19 - Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) CVE-2026-54755 CVSS 9.6 Critical
github.com/klever-io/klever-go< 1.7.19 → fixed in 1.7.19 - Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any… CVE-2026-54523 CVSS 9.6 Critical
github.com/kyverno/kyverno>= 1.18.0, <= 1.18.1 → fixed in 1.18.2 - Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import CVE-2026-54061 CVSS 9.1 Critical
github.com/dgraph-io/dgraph/v25<= 25.3.4 → fixed in 25.3.5 - New API: Integer overflow in quota billing yields negative charges (self-crediting) CVE-2026-71479 CVSS 9.1 Critical
github.com/QuantumNous/new-api<= 1.0.0-rc.17 → fixed in 1.0.0-rc.18 - New API: User List API Leaks Root User Access Token Leading to Privilege Escalation CVE-2026-64859 CVSS 9.1 Critical
github.com/QuantumNous/new-api< 1.0.0-rc.7 → fixed in 1.0.0-rc.7 - SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle CVE-2026-73080 CVSS 9.3 Critical
github.com/seaweedfs/seaweedfs< 0.0.0-20260512171120-69da20bdaec9 → fixed in 0.0.0-20260512171120-69da20bdaec9 - Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware CVE-2026-65600 CVSS 9.1 Critical
github.com/traefik/traefik/v2<= 2.11.51 → fixed in 2.11.52;github.com/traefik/traefik/v3<= 3.6.22 → fixed in 3.6.23;github.com/traefik/traefik/v3>= 3.7.0, <= 3.7.6 → fixed in 3.7.7; +1 more packages - vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide… CVE-2026-54725 CVSS 9.6 Critical
github.com/bank-vaults/vault-secrets-webhook<= 1.22.2 → fixed in 1.23.1 - Wings exposes node configuration secrets through egg configuration-file templating CVE-2026-52855 CVSS 9.9 Critical
github.com/pterodactyl/wings< 1.12.3 → fixed in 1.12.3 - Logging operator has Fluentd configuration injection that allows remote code execution CVE-2026-54680 CVSS 9.9 Critical
github.com/kube-logging/logging-operator< 0.0.0-20260608145523-cf437d7f1e05 → fixed in 0.0.0-20260608145523-cf437d7f1e05 - prebid-server's request forgery vulnerability allows for possible host environment data extraction CVE-2026-54735 CVSS 10.0 Critical
github.com/prebid/prebid-server/v4< 4.4.0 → fixed in 4.4.0;github.com/prebid/prebid-server/v3<= 3.30.0 → no fix listed;github.com/prebid/prebid-server/v2<= 2.32.0 → no fix listed; +1 more packages - goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) CVE-2026-62325 CVSS 9.1 Critical
github.com/patrickhener/goshs/v2= 2.1.3 → fixed in 2.1.4;goshs.de/goshs/v2= 2.1.3 → fixed in 2.1.4 - goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite CVE-2026-64863 CVSS 9.1 Critical
goshs.de/goshs/v2<= 2.1.3 → fixed in 2.1.4;github.com/patrickhener/goshs/v2<= 2.1.3 → fixed in 2.1.4;goshs.de/goshs<= 1.1.4 → no fix listed; +1 more packages - kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default GHSA-r277-6w6q-xmqw CVSS 9.1 Critical
github.com/getkin/kin-openapi<= 0.143.0 → fixed in 0.144.0 - Gitea: Public-only repository tokens can update private PR head branches CVE-2026-58443 CVSS 9.6 Critical
code.gitea.io/gitea< 1.27.0 → fixed in 1.27.0 - Gitea Remember-Me Token Theft Not Invalidating Attacker Session CVE-2026-56750 CVSS 9.1 Critical
code.gitea.io/gitea< 1.27.0 → fixed in 1.27.0 - Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write CVE-2026-58426 CVSS 9.6 Critical
code.gitea.io/gitea>= 1.22.0, < 1.26.2 → fixed in 1.26.2 - Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` CVE-2026-20896 CVSS 9.8 Critical
code.gitea.io/gitea< 1.26.3 → fixed in 1.26.3 - Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter CVE-2026-22874 CVSS 9.6 Critical
code.gitea.io/gitea< 1.26.3 → fixed in 1.26.3 - Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure CVE-2026-53713 CVSS 9.1 Critical
github.com/envoyproxy/gateway>= 1.8.0-rc.0, < 1.8.1 → fixed in 1.8.1;github.com/envoyproxy/gateway< 1.7.4 → fixed in 1.7.4 - Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode CVE-2026-50006 CVSS 9.1 Critical
github.com/julien040/anyquery< 0.4.5 → no fix listed - File Browser: Authentication Bypass via Proxy Auth Header Forgery CVE-2026-54089 CVSS 9.1 Critical
github.com/filebrowser/filebrowser/v2>= 2.0.0-rc.1, <= 2.63.18 → no fix listed - SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() CVE-2026-54067 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVE-2026-54088 CVSS 9.3 Critical
github.com/filebrowser/filebrowser/v2<= 2.63.5 → fixed in 2.63.6 - SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist CVE-2026-54069 CVSS 9.2 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL CVE-2026-54072 CVSS 9.3 Critical
github.com/authorizerdev/authorizer< 0.0.0-20260409051328-bd3f5baf6d3d → fixed in 0.0.0-20260409051328-bd3f5baf6d3d - TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation GHSA-g936-7jqj-mwv8 CVSS 9.0 Critical
github.com/almeidapaulopt/tsdproxy< 1.4.4-0.20260603142855-434819b4421e → fixed in 1.4.4-0.20260603142855-434819b4421e - SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() CVE-2026-54158 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content CVE-2026-50551 CVSS 9.9 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4 - Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE CVE-2026-53649 CVSS 9.6 Critical
github.com/BishopFox/joro< 0.0.0-20260601151442-5c0ca35db828 → fixed in 0.0.0-20260601151442-5c0ca35db828 - Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE CVE-2026-52831 CVSS 10.0 Critical
github.com/nuclio/nuclio< 0.0.0-20260601075854-3356b86a8bfa → fixed in 0.0.0-20260601075854-3356b86a8bfa - LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs CVE-2026-59707 CVSS 9.2 Critical
github.com/mudler/LocalAI< 1.40.1-0.20260703213242-2cbb3c96b34d → fixed in 1.40.1-0.20260703213242-2cbb3c96b34d - Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers CVE-2026-53552 CVSS 9.6 Critical
github.com/zhenorzz/goploy<= 1.17.5 → no fix listed - Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access CVE-2026-49445 CVSS 9.2 Critical
github.com/cilium/cilium>= 1.19.0, < 1.19.2 → fixed in 1.19.2;github.com/cilium/cilium>= 1.18.0, < 1.18.8 → fixed in 1.18.8;github.com/cilium/cilium< 1.17.14 → fixed in 1.17.14 - Gitea pre-receive hook scanner errors allow branch-protection bypass CVE-2026-27780 CVSS 9.8 Critical
code.gitea.io/gitea< 1.26.0 → fixed in 1.26.0 - Gitea LFS mirror operations bypass migration HTTP transport protections CVE-2026-26292 CVSS 9.8 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea OAuth2 PKCE S256 verifier bypass CVE-2026-26247 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea template repository generation follows unsafe filesystem paths CVE-2026-25718 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea repository creation accepts insufficiently validated fields CVE-2026-22547 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea OAuth2 authorization codes can be reused after expiry CVE-2026-26232 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer CVE-2026-44935 CVSS 9.9 Critical
github.com/rancher/fleet>= 0.15.0, < 0.15.2 → fixed in 0.15.2;github.com/rancher/fleet>= 0.14.0, < 0.14.6 → fixed in 0.14.6;github.com/rancher/fleet>= 0.13.0, < 0.13.11 → fixed in 0.13.11; +1 more packages - Rancher has Privilege Escalation from Project Owner to Host CVE-2026-41052 CVSS 9.4 Critical
github.com/rancher/rancher>= 2.14.0, < 2.14.2 → fixed in 2.14.2;github.com/rancher/rancher>= 2.13.0, < 2.13.6 → fixed in 2.13.6;github.com/rancher/rancher>= 2.12.0, < 2.12.10 → fixed in 2.12.10; +1 more packages - Rancher vulnerable to command injection through unsanitized YAML parameter CVE-2026-44939 CVSS 9.4 Critical
github.com/rancher/rancher>= 2.14.0, < 2.14.2 → fixed in 2.14.2;github.com/rancher/rancher>= 2.13.0, < 2.13.6 → fixed in 2.13.6;github.com/rancher/rancher>= 2.12.0, < 2.12.10 → fixed in 2.12.10; +3 more packages - Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover CVE-2026-50545 CVSS 9.9 Critical
github.com/fission/fission<= 1.23.0 → fixed in 1.24.0 - Fission Container Executor Function PodSpec Injection Leading to Node Escape CVE-2026-50563 CVSS 9.9 Critical
github.com/fission/fission<= 1.23.0 → fixed in 1.24.0 - Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation CVE-2026-50566 CVSS 9.9 Critical
github.com/fission/fission<= 1.23.0 → fixed in 1.24.0 - Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape CVE-2026-50564 CVSS 9.9 Critical
github.com/fission/fission<= 1.23.0 → fixed in 1.24.0 - MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints CVE-2026-11720 CVSS 9.3 Critical
github.com/googleapis/mcp-toolbox< 1.3.0 → fixed in 1.3.0 - Incus has arbitrary file read+write on host via templates/ symlink in malicious image CVE-2026-48752 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.2.0 → fixed in 7.2.0 - Incus has an argument injection in backup compression algorithm leading to AFW and ACE CVE-2026-48755 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.2.0 → fixed in 7.2.0 - Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check GHSA-q6xx-5vr8-p898 CVSS 9.9 Critical
github.com/nezhahq/nezha>= 1.14.13, <= 1.14.14 → no fix listed;github.com/nezhahq/nezha>= 2.0.0, <= 2.0.9 → fixed in 2.0.10 - Incus has an arbitrary file write on its client due to trusted image hash CVE-2026-48769 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.2.0 → fixed in 7.2.0 - Incus has an arbitrary file write via path traversal in S3 multipart upload CVE-2026-48753 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.1.0 → fixed in 7.1.0 - Incus has an arbitrary file write on host via `exec-output` symlink in crafted image CVE-2026-48750 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.2.0 → fixed in 7.2.0 - Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key CVE-2026-53519 CVSS 9.1 Critical
github.com/nezhahq/nezha< 2.0.13 → fixed in 2.0.13 - Incus has a restricted project bypass leading to arbitrary command execution CVE-2026-48751 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.2.0 → fixed in 7.2.0 - Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image CVE-2026-48749 CVSS 9.9 Critical
github.com/lxc/incus/v7/cmd/incusd< 7.2.0 → fixed in 7.2.0 - golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement CVE-2026-46595 CVSS 10.0 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses CVE-2026-39830 CVSS 9.1 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - golang.org/x/crypto vulnerable to infinite loop on large channel writes CVE-2026-39834 CVSS 9.1 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - golang.org/x/crypto doesn't enforce invoking key constraints CVE-2026-39833 CVSS 9.1 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys CVE-2026-39832 CVSS 9.1 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed CVE-2026-39831 CVSS 9.1 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status CVE-2026-42508 CVSS 9.1 Critical
golang.org/x/crypto< 0.52.0 → fixed in 0.52.0 - Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge CVE-2026-52806 CVSS 9.9 Critical
gogs.io/gogs< 0.14.3 → fixed in 0.14.3 - Gogs has Path Traversal in organization name that results in RCE through Git hooks CVE-2026-52813 CVSS 10.0 Critical
gogs.io/gogs< 0.14.3 → fixed in 0.14.3 - Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym CVE-2026-52811 CVSS 9.0 Critical
gogs.io/gogs< 0.14.3 → fixed in 0.14.3 - Canonical ADSys Uses a Less Trusted Source CVE-2026-12249 CVSS 9.0 Critical
github.com/ubuntu/adsys< 0.16.3-0.20250318112551-8b1939f96d38 → fixed in 0.16.3-0.20250318112551-8b1939f96d38 - Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag GHSA-wfqx-gjrf-g28r CVSS 9.0 Critical
github.com/crossplane/crossplane/v2>= 2.3.0-rc.0, <= 2.3.2 → fixed in 2.3.3;github.com/crossplane/crossplane/v2<= 2.2.2 → fixed in 2.2.3;github.com/crossplane/crossplane<= 1.21.0-rc.0 → no fix listed