Security Digest · page 2 of 4
Critical Go advisories (page 2)
391 critical advisories for Go packages since October 2023, newest first. Check your project with govulncheck ./....
- Tilt: Missing authentication on the network-exposed Tilt HUD server CVE-2026-55884 CVSS 9.2 Critical
github.com/tilt-dev/tilt>= 0.20.8, <= 0.37.3 → fixed in 0.37.4 - googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) CVE-2026-11718 CVSS 9.3 Critical
github.com/googleapis/mcp-toolbox< 1.4.0 → fixed in 1.4.0 - googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) CVE-2026-11717 CVSS 9.3 Critical
github.com/googleapis/mcp-toolbox< 1.4.0 → fixed in 1.4.0 - Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix CVE-2026-49980 CVSS 9.8 Critical
github.com/rclone/rclone>= 1.46.0, <= 1.74.2 → fixed in 1.74.3 - MCP Toolbox for Databases has an Origin Validation Error CVE-2026-11624 CVSS 9.4 Critical
github.com/googleapis/mcp-toolbox< 0.25.0 → fixed in 0.25.0 - Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands CVE-2026-53474 CVSS 9.6 Critical
github.com/kubev2v/migration-planner< 0.13.5 → fixed in 0.13.5 - Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs CVE-2026-53470 CVSS 9.6 Critical
github.com/kubev2v/migration-planner< 0.13.5 → fixed in 0.13.5 - Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery CVE-2026-48031 CVSS 9.1 Critical
github.com/dhax/go-base< 0.0.0-20260517152733-cc82b9740fa6 → fixed in 0.0.0-20260517152733-cc82b9740fa6 - Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication CVE-2026-53475 CVSS 9.3 Critical
github.com/kubev2v/assisted-migration-agent< 0.16.0 → fixed in 0.16.0 - Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution CVE-2026-53476 CVSS 9.6 Critical
github.com/kubev2v/assisted-migration-agent< 0.16.0 → fixed in 0.16.0 - Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API CVE-2026-53469 CVSS 9.1 Critical
github.com/kubev2v/migration-planner< 0.13.5 → fixed in 0.13.5 - Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation CVE-2026-53471 CVSS 9.6 Critical
github.com/kubev2v/migration-planner< 0.13.5 → fixed in 0.13.5 - Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin CVE-2026-47252 CVSS 9.0 Critical
github.com/julien040/anyquery/plugins/chrome< 0.0.0-20240826075852-c651df0b8767 → fixed in 0.0.0-20240826075852-c651df0b8767;github.com/julien040/anyquery/plugins/brave< 0.0.0-20240826075852-c651df0b8767 → fixed in 0.0.0-20240826075852-c651df0b8767;github.com/julien040/anyquery/plugins/edge< 0.0.0-20240826075852-c651df0b8767 → fixed in 0.0.0-20240826075852-c651df0b8767; +1 more packages - nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation CVE-2026-47724 CVSS 9.9 Critical
github.com/juev/nebula-mesh< 0.3.4 → fixed in 0.3.4 - Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest CVE-2026-9098 CVSS 9.1 Critical
github.com/casdoor/casdoor<= 1.1000.1-0.20260321120606-239e8bd69487 → no fix listed - Casdoor has an authentication bypass CVE-2026-9090 CVSS 9.1 Critical
github.com/casdoor/casdoor<= 1.1000.1-0.20260321120606-239e8bd69487 → no fix listed - Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check CVE-2026-9094 CVSS 9.8 Critical
github.com/casdoor/casdoor< 2.387.0 → fixed in 2.387.0 - Casdoor does not validate the AudienceRestriction element in SAML assertions CVE-2026-9093 CVSS 9.8 Critical
github.com/casdoor/casdoor<= 1.1000.1-0.20260321120606-239e8bd69487 → no fix listed - Casdoor doesn't verify that a JWT used for token exchange is still active CVE-2026-9097 CVSS 9.8 Critical
github.com/casdoor/casdoor<= 1.1000.1-0.20260321120606-239e8bd69487 → no fix listed - MCP Toolbox for Databases vulnerable to DNS rebinding attacks CVE-2026-9739 CVSS 9.4 Critical
github.com/googleapis/mcp-toolbox< 1.2.0 → fixed in 1.2.0 - KubeVirt has a Link Following vulnerability CVE-2026-7374 CVSS 9.9 Critical
kubevirt.io/kubevirt>= 1.8.0-alpha.0, < 1.8.3 → fixed in 1.8.3;kubevirt.io/kubevirt>= 1.7.0-alpha.0, < 1.7.4 → fixed in 1.7.4;kubevirt.io/kubevirt< 1.6.6 → fixed in 1.6.6 - FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory CVE-2026-48777 CVSS 9.3 Critical
github.com/gtsteffaniak/filebrowser/backend< 0.0.0-20260518193514-28e9b81e438e → fixed in 0.0.0-20260518193514-28e9b81e438e - Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVE-2026-46716 CVSS 9.9 Critical
github.com/nezhahq/nezha>= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97 → fixed in 1.14.15-0.20260517022419-d7526351cf97 - BoxLite: Permission Bypass Allows Modification of Read-Only Files CVE-2026-46695 CVSS 10.0 Critical
boxlite< 0.9.0 → fixed in 0.9.0;@boxlite-ai/boxlite< 0.9.0 → fixed in 0.9.0;github.com/boxlite-ai/boxlite/sdks/go< 0.9.0 → fixed in 0.9.0; +2 more packages - Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host CVE-2026-46703 CVSS 9.6 Critical
boxlite< 0.9.0 → fixed in 0.9.0;boxlite-cli< 0.9.0 → fixed in 0.9.0;boxlite< 0.9.0 → fixed in 0.9.0; +2 more packages - Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger CVE-2026-46614 CVSS 9.8 Critical
github.com/fission/fission<= 1.22.0 → fixed in 1.23.0 - Algernon: handler.lua discovery walks parent directories above the server root CVE-2026-45721 CVSS 9.0 Critical
github.com/xyproto/algernon<= 1.17.6 → fixed in 1.17.7 - MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path GHSA-g53w-w6mj-hrpp CVSS 9.3 Critical
github.com/Kuadrant/mcp-gateway< 0.7.0 → fixed in 0.7.0 - Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVE-2026-46354 CVSS 9.1 Critical
github.com/coder/coder/v2>= 2.33.0-rc.0, < 2.33.3 → fixed in 2.33.3;github.com/coder/coder/v2>= 2.32.0-rc.0, < 2.32.2 → fixed in 2.32.2;github.com/coder/coder/v2>= 2.31.0, < 2.31.12 → fixed in 2.31.12; +4 more packages - Kopia: RCE via SSH ProxyCommand Injection CVE-2026-45695 CVSS 9.8 Critical
github.com/kopia/kopia<= 0.22.3 → fixed in 0.23.0 - Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and… CVE-2026-45625 CVSS 9.9 Critical
github.com/getarcaneapp/arcane/backend<= 1.18.1 → fixed in 1.19.0 - Portainer missing authorization on Docker plugin endpoints, which allows host RCE CVE-2026-44848 CVSS 9.4 Critical
github.com/portainer/portainer>= 2.33.0, < 2.33.8 → fixed in 2.33.8;github.com/portainer/portainer>= 2.39.0, < 2.39.2 → fixed in 2.39.2;github.com/portainer/portainer>= 2.40.0, < 2.41.0 → fixed in 2.41.0 - Crabbox: environment variable exposure vulnerability CVE-2026-8634 CVSS 9.3 Critical
github.com/openclaw/crabbox< 0.12.0 → fixed in 0.12.0 - Portainer has an endpoint security bypass via Swarm service create/update CVE-2026-44849 CVSS 9.4 Critical
github.com/portainer/portainer>= 2.33.0, < 2.33.8 → fixed in 2.33.8;github.com/portainer/portainer>= 2.39.0, < 2.39.2 → fixed in 2.39.2;github.com/portainer/portainer>= 2.40.0, < 2.41.0 → fixed in 2.41.0 - Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server GHSA-vw82-7fv8-r6gp CVSS 9.6 Critical
github.com/obot-platform/obot<= 0.21.0 → fixed in 0.21.1 - SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution CVE-2026-45375 CVSS 9.0 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260421031503-96dfe0bea474 → no fix listed - Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` CVE-2026-45087 CVSS 10.0 Critical
github.com/hahwul/dalfox/v2<= 2.12.0 → fixed in 2.13.0 - CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE CVE-2026-44477 CVSS 9.4 Critical
github.com/cloudnative-pg/cloudnative-pg< 1.28.3 → fixed in 1.28.3;github.com/cloudnative-pg/cloudnative-pg>= 1.29.0, < 1.29.1 → fixed in 1.29.1 - free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions CVE-2026-44330 CVSS 10.0 Critical
github.com/free5gc/nef<= 1.2.3 → no fix listed - free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CVE-2026-44327 CVSS 10.0 Critical
github.com/free5gc/nef<= 1.2.3 → no fix listed - free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions CVE-2026-44315 CVSS 9.4 Critical
github.com/free5gc/nef<= 1.2.3 → no fix listed - free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete… CVE-2026-44326 CVSS 9.4 Critical
github.com/free5gc/nef<= 1.2.3 → no fix listed - free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CVE-2026-44329 CVSS 10.0 Critical
github.com/free5gc/smf< 1.4.3 → fixed in 1.4.3 - SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE CVE-2026-44670 CVSS 9.4 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260421031503-96dfe0bea474 → fixed in 0.0.0-20260512140701-d7b77d945e0d - SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) CVE-2026-44588 CVSS 9.4 Critical
github.com/siyuan-note/siyuan/kernel<= 0.0.0-20260421031503-96dfe0bea474 → no fix listed - Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery CVE-2026-44523 CVSS 10.0 Critical
github.com/enchant97/note-mark/backend< 0.0.0-20260501152247-18b587758667 → fixed in 0.0.0-20260501152247-18b587758667 - Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection CVE-2026-42589 CVSS 9.8 Critical
github.com/gotenberg/gotenberg/v8= 8.29.1 → no fix listed - FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion CVE-2026-44542 CVSS 9.1 Critical
github.com/gtsteffaniak/filebrowser< 0.0.0-20260501183844-112740bdd41d → fixed in 0.0.0-20260501183844-112740bdd41d - Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening GHSA-9h64-2846-7x7f CVSS 9.1 Critical
github.com/getaxonflow/axonflow< 7.5.0 → fixed in 7.5.0 - Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVE-2026-41050 CVSS 9.9 Critical
github.com/rancher/fleet>= 0.15.0, < 0.15.1 → fixed in 0.15.1;github.com/rancher/fleet>= 0.14.0, < 0.14.5 → fixed in 0.14.5;github.com/rancher/fleet>= 0.13.0, < 0.13.10 → fixed in 0.13.10; +2 more packages - Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42596 CVSS 9.4 Critical
github.com/gotenberg/gotenberg/v8<= 8.30.1 → fixed in 8.32.0 - Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore CVE-2026-42238 CVSS 9.0 Critical
github.com/0xJacky/nginx-ui< 2.3.8 → fixed in 2.3.8 - ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVE-2026-42880 CVSS 9.6 Critical
github.com/argoproj/argo-cd/v3>= 3.2.0, < 3.2.11 → fixed in 3.2.11;github.com/argoproj/argo-cd/v3>= 3.3.0, < 3.3.9 → fixed in 3.3.9 - S3-Proxy has Security Issues in its Resource Path Matching Implementation CVE-2026-42882 CVSS 9.4 Critical
github.com/oxyno-zeta/s3-proxy< 0.0.0-20260424211602-1320e4abd46a → fixed in 0.0.0-20260424211602-1320e4abd46a - DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header CVE-2026-42300 CVSS 9.3 Critical
github.com/l3montree-dev/devguard< 1.2.2 → fixed in 1.2.2 - Pelican Web UI Affected by a Privilege Escalation Attack CVE-2026-42571 CVSS 9.0 Critical
github.com/pelicanplatform/pelican< 0.0.0-20260408120501-7f73b9c3e677 → fixed in 0.0.0-20260408120501-7f73b9c3e677 - Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) CVE-2026-40281 CVSS 10.0 Critical
github.com/gotenberg/gotenberg/v8<= 8.30.1 → fixed in 8.31.0 - auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation CVE-2026-42560 CVSS 9.1 Critical
github.com/go-pkgz/auth>= 1.18.0, <= 1.25.1 → fixed in 1.25.2;github.com/go-pkgz/auth/v2>= 2.0.0, <= 2.1.1 → fixed in 2.1.2 - Netmaker does not verify JWT signatures for host tokens CVE-2026-38651 CVSS 9.2 Critical
github.com/gravitl/netmaker< 1.5.0 → fixed in 1.5.0 - Note Mark: OIDC-registered users authenticated by submitting password "null" CVE-2026-41571 CVSS 9.4 Critical
github.com/enchant97/note-mark/backend< 0.0.0-20260417132909-dea5530cc989 → fixed in 0.0.0-20260417132909-dea5530cc989 - go-zserio has Unbounded Memory Allocation for All Platforms GHSA-xhj4-g6w8-2xjw CVSS 9.8 Critical
github.com/woven-planet/go-zserio< 0.9.1 → fixed in 0.9.1 - Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVE-2026-41328 CVSS 9.1 Critical
github.com/dgraph-io/dgraph/v25< 25.3.3 → fixed in 25.3.3;github.com/dgraph-io/dgraph/v24<= 24.1.8 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars CVE-2026-41492 CVSS 9.8 Critical
github.com/dgraph-io/dgraph/v25< 25.3.3 → fixed in 25.3.3;github.com/dgraph-io/dgraph/v24<= 24.1.8 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVE-2026-41327 CVSS 9.1 Critical
github.com/dgraph-io/dgraph/v25< 25.3.3 → fixed in 25.3.3;github.com/dgraph-io/dgraph/v24<= 24.1.8 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function CVE-2026-39087 CVSS 9.8 Critical
heckel.io/ntfy/v2< 2.22.0 → fixed in 2.22.0 - RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution CVE-2026-41179 CVSS 9.2 Critical
github.com/rclone/rclone>= 1.48.0, <= 1.73.4 → fixed in 1.73.5 - NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access CVE-2026-42072 CVSS 9.8 Critical
github.com/orneryd/nornicdb< 1.0.42-hotfix → fixed in 1.0.42-hotfix - Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution CVE-2026-41176 CVSS 9.2 Critical
github.com/rclone/rclone>= 1.45.0, < 1.73.5 → fixed in 1.73.5 - openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access CVE-2026-41070 CVSS 10.0 Critical
github.com/jkroepke/openvpn-auth-oauth2>= 1.26.3, < 1.27.3 → fixed in 1.27.3 - Wish has SCP Path Traversal that allows arbitrary file read/write CVE-2026-41589 CVSS 9.6 Critical
charm.land/wish/v2< 2.0.1 → fixed in 2.0.1;github.com/charmbracelet/wish<= 1.4.7 → no fix listed - Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass CVE-2026-41574 CVSS 9.3 Critical
github.com/nhost/nhost< 0.0.0-20260417112436-ec8dab3f2cf4 → fixed in 0.0.0-20260417112436-ec8dab3f2cf4 - Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints CVE-2026-40173 CVSS 9.4 Critical
github.com/dgraph-io/dgraph/v25< 25.3.2 → fixed in 25.3.2;github.com/dgraph-io/dgraph/v24<= 24.1.7 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - Pyroscope Exposes Storage Secret CVE-2025-41118 CVSS 9.1 Critical
github.com/grafana/pyroscope< 1.15.2 → fixed in 1.15.2;github.com/grafana/pyroscope>= 1.16.0, < 1.16.1 → fixed in 1.16.1 - Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token CVE-2026-6290 CVSS 9.1 Critical
www.velocidex.com/golang/velociraptor<= 0.76.2 → no fix listed - OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CVE-2026-40575 CVSS 9.1 Critical
github.com/oauth2-proxy/oauth2-proxy/v7>= 7.5.0, < 7.15.2 → fixed in 7.15.2 - Oxia has an OIDC token audience validation bypass via SkipClientIDCheck CVE-2026-40946 CVSS 9.3 Critical
github.com/oxia-db/oxia<= 0.16.1 → fixed in 0.16.2 - goshs has an empty-username SFTP password authentication bypass CVE-2026-40884 CVSS 9.8 Critical
github.com/patrickhener/goshs<= 1.1.4 → no fix listed;github.com/patrickhener/goshs/v2< 2.0.0 → fixed in 2.0.0 - OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVE-2026-34457 CVSS 9.1 Critical
github.com/oauth2-proxy/oauth2-proxy/v7< 7.15.2 → fixed in 7.15.2;github.com/oauth2-proxy/oauth2-proxy<= 3.2.0 → no fix listed - goshs has a file-based ACL authorization bypass in goshs state-changing routes CVE-2026-40189 CVSS 9.3 Critical
github.com/patrickhener/goshs<= 1.1.4 → no fix listed - Juju: CloudSpec method leaking cloud credentials CVE-2026-5412 CVSS 9.9 Critical
github.com/juju/juju< 0.0.0-20260408003526-d395054dc2c3 → fixed in 0.0.0-20260408003526-d395054dc2c3 - LXD: Importing a crafted backup leads to project restriction bypass CVE-2026-34178 CVSS 9.1 Critical
github.com/canonical/lxd>= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267 → no fix listed - LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf CVE-2026-34177 CVSS 9.1 Critical
github.com/canonical/lxd>= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267 → no fix listed - LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin CVE-2026-34179 CVSS 9.1 Critical
github.com/canonical/lxd>= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267 → no fix listed - Daptin has Unauthenticated Path Traversal and Zip Slip GHSA-9cp7-j3f8-p5jx CVSS 10.0 Critical
github.com/daptin/daptin<= 0.11.3 → fixed in 0.12.0 - SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions CVE-2026-39846 CVSS 9.0 Critical
github.com/siyuan-note/siyuan/kernel< 0.0.0-20260407035653-2f416e5253f1 → fixed in 0.0.0-20260407035653-2f416e5253f1 - pgx contains memory-safety vulnerability CVE-2026-33815 CVSS 9.8 Critical
github.com/jackc/pgx/v5< 5.9.0 → fixed in 5.9.0 - Memory-safety vulnerability in github.com/jackc/pgx/v5. CVE-2026-33816 CVSS 9.8 Critical
github.com/jackc/pgx/v5< 5.9.0 → fixed in 5.9.0 - goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) CVE-2026-35471 CVSS 9.8 Critical
github.com/patrickhener/goshs< 1.1.5-0.20260401172448-237f3af891a9 → fixed in 1.1.5-0.20260401172448-237f3af891a9 - Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVE-2026-34976 CVSS 10.0 Critical
github.com/dgraph-io/dgraph/v25<= 25.3.0 → fixed in 25.3.1;github.com/dgraph-io/dgraph/v24<= 24.0.5 → no fix listed;github.com/dgraph-io/dgraph<= 1.2.8 → no fix listed - goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVE-2026-35393 CVSS 9.8 Critical
github.com/patrickhener/goshs< 1.1.5-0.20260401172448-237f3af891a9 → fixed in 1.1.5-0.20260401172448-237f3af891a9 - goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVE-2026-35392 CVSS 9.8 Critical
github.com/patrickhener/goshs< 1.1.5-0.20260401172448-237f3af891a9 → fixed in 1.1.5-0.20260401172448-237f3af891a9 - Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster CVE-2026-4370 CVSS 10.0 Critical
github.com/juju/juju<= 0.0.0-20260401092550-1c1ac1922b57 → no fix listed - SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client CVE-2026-34448 CVSS 9.0 Critical
github.com/siyuan-note/siyuan/kernel<= 3.6.1 → fixed in 3.6.2 - SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection CVE-2026-34449 CVSS 9.6 Critical
github.com/siyuan-note/siyuan/kernel<= 3.6.1 → fixed in 3.6.2 - nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVE-2026-33032 CVSS 9.8 Critical
github.com/0xJacky/Nginx-UI<= 1.99 → no fix listed - nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVE-2026-33026 CVSS 9.4 Critical
github.com/0xJacky/Nginx-UI< 1.9.10-0.20260315015203-f61bcec547c0 → fixed in 1.9.10-0.20260315015203-f61bcec547c0 - Incus has an abitrary file write through its systemd-creds options CVE-2026-33945 CVSS 9.9 Critical
github.com/lxc/incus/v6< 6.23.0 → fixed in 6.23.0 - Incus vulnerable to arbitrary file read and write through pongo templates CVE-2026-33897 CVSS 9.9 Critical
github.com/lxc/incus/v6< 6.23.0 → fixed in 6.23.0;github.com/lxc/incus<= 0.7.0 → no fix listed - OpenBao has Reflected XSS in its OIDC authentication error message CVE-2026-33758 CVSS 9.4 Critical
github.com/openbao/openbao< 0.0.0-20260325133417-6e2b2dd84f0e → fixed in 0.0.0-20260325133417-6e2b2dd84f0e - OpenBao lacks user confirmation for OIDC direct callback mode CVE-2026-33757 CVSS 9.6 Critical
github.com/openbao/openbao< 0.0.0-20260325142553-e32103951925 → fixed in 0.0.0-20260325142553-e32103951925