---
title: "Critical Go advisories (page 2)"
url: https://erroneo.us/security/ecosystem/go/2/
description: "All 391 critical GitHub-reviewed Go security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 2 of 4."
type: ecosystem
section: "Security Digest"
date_modified: 2026-06-19
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Go advisories (page 2)

- 2026-06-19 [CVE-2026-55884](https://erroneo.us/security/cve/CVE-2026-55884/index.md) Tilt: Missing authentication on the network-exposed Tilt HUD server — github.com/tilt-dev/tilt >= 0.20.8, <= 0.37.3 → 0.37.4
- 2026-06-18 [CVE-2026-11718](https://erroneo.us/security/cve/CVE-2026-11718/index.md) googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) — github.com/googleapis/mcp-toolbox < 1.4.0 → 1.4.0
- 2026-06-18 [CVE-2026-11717](https://erroneo.us/security/cve/CVE-2026-11717/index.md) googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) — github.com/googleapis/mcp-toolbox < 1.4.0 → 1.4.0
- 2026-06-16 [CVE-2026-49980](https://erroneo.us/security/cve/CVE-2026-49980/index.md) Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix — github.com/rclone/rclone >= 1.46.0, <= 1.74.2 → 1.74.3
- 2026-06-13 [CVE-2026-11624](https://erroneo.us/security/cve/CVE-2026-11624/index.md) MCP Toolbox for Databases has an Origin Validation Error — github.com/googleapis/mcp-toolbox < 0.25.0 → 0.25.0
- 2026-06-10 [CVE-2026-53474](https://erroneo.us/security/cve/CVE-2026-53474/index.md) Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands — github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- 2026-06-10 [CVE-2026-53470](https://erroneo.us/security/cve/CVE-2026-53470/index.md) Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs — github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- 2026-06-10 [CVE-2026-48031](https://erroneo.us/security/cve/CVE-2026-48031/index.md) Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery — github.com/dhax/go-base < 0.0.0-20260517152733-cc82b9740fa6 → 0.0.0-20260517152733-cc82b9740fa6
- 2026-06-10 [CVE-2026-53475](https://erroneo.us/security/cve/CVE-2026-53475/index.md) Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication — github.com/kubev2v/assisted-migration-agent < 0.16.0 → 0.16.0
- 2026-06-10 [CVE-2026-53476](https://erroneo.us/security/cve/CVE-2026-53476/index.md) Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution — github.com/kubev2v/assisted-migration-agent < 0.16.0 → 0.16.0
- 2026-06-10 [CVE-2026-53469](https://erroneo.us/security/cve/CVE-2026-53469/index.md) Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API — github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- 2026-06-10 [CVE-2026-53471](https://erroneo.us/security/cve/CVE-2026-53471/index.md) Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation — github.com/kubev2v/migration-planner < 0.13.5 → 0.13.5
- 2026-06-08 [CVE-2026-47252](https://erroneo.us/security/cve/CVE-2026-47252/index.md) Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin — github.com/julien040/anyquery/plugins/chrome < 0.0.0-20240826075852-c651df0b8767 → 0.0.0-20240826075852-c651df0b8767; github.com/julien040/anyquery/plugins/brave < 0.0.0-20240826075852-c651df0b8767 → 0.0.0-20240826075852-c651df0b8767; github.com/julien040/anyquery/plugins/edge < 0.0.0-20240826075852-c651df0b8767 → 0.0.0-20240826075852-c651df0b8767
- 2026-06-08 [CVE-2026-47724](https://erroneo.us/security/cve/CVE-2026-47724/index.md) nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation — github.com/juev/nebula-mesh < 0.3.4 → 0.3.4
- 2026-05-28 [CVE-2026-9098](https://erroneo.us/security/cve/CVE-2026-9098/index.md) Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest — github.com/casdoor/casdoor <= 1.1000.1-0.20260321120606-239e8bd69487 → no fix
- 2026-05-28 [CVE-2026-9090](https://erroneo.us/security/cve/CVE-2026-9090/index.md) Casdoor has an authentication bypass — github.com/casdoor/casdoor <= 1.1000.1-0.20260321120606-239e8bd69487 → no fix
- 2026-05-28 [CVE-2026-9094](https://erroneo.us/security/cve/CVE-2026-9094/index.md) Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check — github.com/casdoor/casdoor < 2.387.0 → 2.387.0
- 2026-05-28 [CVE-2026-9093](https://erroneo.us/security/cve/CVE-2026-9093/index.md) Casdoor  does not validate the AudienceRestriction element in SAML assertions — github.com/casdoor/casdoor <= 1.1000.1-0.20260321120606-239e8bd69487 → no fix
- 2026-05-28 [CVE-2026-9097](https://erroneo.us/security/cve/CVE-2026-9097/index.md) Casdoor doesn't verify that a JWT used for token exchange is still active — github.com/casdoor/casdoor <= 1.1000.1-0.20260321120606-239e8bd69487 → no fix
- 2026-05-27 [CVE-2026-9739](https://erroneo.us/security/cve/CVE-2026-9739/index.md) MCP Toolbox for Databases vulnerable to DNS rebinding attacks — github.com/googleapis/mcp-toolbox < 1.2.0 → 1.2.0
- 2026-05-26 [CVE-2026-7374](https://erroneo.us/security/cve/CVE-2026-7374/index.md) KubeVirt has a Link Following vulnerability — kubevirt.io/kubevirt >= 1.8.0-alpha.0, < 1.8.3 → 1.8.3; kubevirt.io/kubevirt >= 1.7.0-alpha.0, < 1.7.4 → 1.7.4; kubevirt.io/kubevirt < 1.6.6 → 1.6.6
- 2026-05-22 [CVE-2026-48777](https://erroneo.us/security/cve/CVE-2026-48777/index.md) FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory — github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260518193514-28e9b81e438e → 0.0.0-20260518193514-28e9b81e438e
- 2026-05-22 [CVE-2026-46716](https://erroneo.us/security/cve/CVE-2026-46716/index.md) Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron — github.com/nezhahq/nezha >= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97 → 1.14.15-0.20260517022419-d7526351cf97
- 2026-05-21 [CVE-2026-46695](https://erroneo.us/security/cve/CVE-2026-46695/index.md) BoxLite: Permission Bypass Allows Modification of Read-Only Files — boxlite < 0.9.0 → 0.9.0; @boxlite-ai/boxlite < 0.9.0 → 0.9.0; github.com/boxlite-ai/boxlite/sdks/go < 0.9.0 → 0.9.0
- 2026-05-21 [CVE-2026-46703](https://erroneo.us/security/cve/CVE-2026-46703/index.md) Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host — boxlite < 0.9.0 → 0.9.0; boxlite-cli < 0.9.0 → 0.9.0; boxlite < 0.9.0 → 0.9.0
- 2026-05-21 [CVE-2026-46614](https://erroneo.us/security/cve/CVE-2026-46614/index.md) Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger — github.com/fission/fission <= 1.22.0 → 1.23.0
- 2026-05-19 [CVE-2026-45721](https://erroneo.us/security/cve/CVE-2026-45721/index.md) Algernon: handler.lua discovery walks parent directories above the server root — github.com/xyproto/algernon <= 1.17.6 → 1.17.7
- 2026-05-19 [GHSA-g53w-w6mj-hrpp](https://erroneo.us/security/ghsa/GHSA-g53w-w6mj-hrpp/index.md) MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path — github.com/Kuadrant/mcp-gateway < 0.7.0 → 0.7.0
- 2026-05-19 [CVE-2026-46354](https://erroneo.us/security/cve/CVE-2026-46354/index.md) Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft — github.com/coder/coder/v2 >= 2.33.0-rc.0, < 2.33.3 → 2.33.3; github.com/coder/coder/v2 >= 2.32.0-rc.0, < 2.32.2 → 2.32.2; github.com/coder/coder/v2 >= 2.31.0, < 2.31.12 → 2.31.12
- 2026-05-19 [CVE-2026-45695](https://erroneo.us/security/cve/CVE-2026-45695/index.md) Kopia: RCE via SSH ProxyCommand Injection — github.com/kopia/kopia <= 0.22.3 → 0.23.0
- 2026-05-18 [CVE-2026-45625](https://erroneo.us/security/cve/CVE-2026-45625/index.md) Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs — github.com/getarcaneapp/arcane/backend <= 1.18.1 → 1.19.0
- 2026-05-14 [CVE-2026-44848](https://erroneo.us/security/cve/CVE-2026-44848/index.md) Portainer missing authorization on Docker plugin endpoints, which allows host RCE — github.com/portainer/portainer >= 2.33.0, < 2.33.8 → 2.33.8; github.com/portainer/portainer >= 2.39.0, < 2.39.2 → 2.39.2; github.com/portainer/portainer >= 2.40.0, < 2.41.0 → 2.41.0
- 2026-05-14 [CVE-2026-8634](https://erroneo.us/security/cve/CVE-2026-8634/index.md) Crabbox: environment variable exposure vulnerability — github.com/openclaw/crabbox < 0.12.0 → 0.12.0
- 2026-05-14 [CVE-2026-44849](https://erroneo.us/security/cve/CVE-2026-44849/index.md) Portainer has an endpoint security bypass via Swarm service create/update — github.com/portainer/portainer >= 2.33.0, < 2.33.8 → 2.33.8; github.com/portainer/portainer >= 2.39.0, < 2.39.2 → 2.39.2; github.com/portainer/portainer >= 2.40.0, < 2.41.0 → 2.41.0
- 2026-05-13 [GHSA-vw82-7fv8-r6gp](https://erroneo.us/security/ghsa/GHSA-vw82-7fv8-r6gp/index.md) Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server — github.com/obot-platform/obot <= 0.21.0 → 0.21.1
- 2026-05-13 [CVE-2026-45375](https://erroneo.us/security/cve/CVE-2026-45375/index.md) SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260421031503-96dfe0bea474 → no fix
- 2026-05-12 [CVE-2026-45087](https://erroneo.us/security/cve/CVE-2026-45087/index.md) Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` — github.com/hahwul/dalfox/v2 <= 2.12.0 → 2.13.0
- 2026-05-11 [CVE-2026-44477](https://erroneo.us/security/cve/CVE-2026-44477/index.md) CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE — github.com/cloudnative-pg/cloudnative-pg < 1.28.3 → 1.28.3; github.com/cloudnative-pg/cloudnative-pg >= 1.29.0, < 1.29.1 → 1.29.1
- 2026-05-08 [CVE-2026-44330](https://erroneo.us/security/cve/CVE-2026-44330/index.md) free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions — github.com/free5gc/nef <= 1.2.3 → no fix
- 2026-05-08 [CVE-2026-44327](https://erroneo.us/security/cve/CVE-2026-44327/index.md) free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler — github.com/free5gc/nef <= 1.2.3 → no fix
- 2026-05-08 [CVE-2026-44315](https://erroneo.us/security/cve/CVE-2026-44315/index.md) free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions — github.com/free5gc/nef <= 1.2.3 → no fix
- 2026-05-08 [CVE-2026-44326](https://erroneo.us/security/cve/CVE-2026-44326/index.md) free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions — github.com/free5gc/nef <= 1.2.3 → no fix
- 2026-05-08 [CVE-2026-44329](https://erroneo.us/security/cve/CVE-2026-44329/index.md) free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers — github.com/free5gc/smf < 1.4.3 → 1.4.3
- 2026-05-08 [CVE-2026-44670](https://erroneo.us/security/cve/CVE-2026-44670/index.md) SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260421031503-96dfe0bea474 → 0.0.0-20260512140701-d7b77d945e0d
- 2026-05-08 [CVE-2026-44588](https://erroneo.us/security/cve/CVE-2026-44588/index.md) SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260421031503-96dfe0bea474 → no fix
- 2026-05-07 [CVE-2026-44523](https://erroneo.us/security/cve/CVE-2026-44523/index.md) Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery — github.com/enchant97/note-mark/backend < 0.0.0-20260501152247-18b587758667 → 0.0.0-20260501152247-18b587758667
- 2026-05-06 [CVE-2026-42589](https://erroneo.us/security/cve/CVE-2026-42589/index.md) Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection — github.com/gotenberg/gotenberg/v8 = 8.29.1 → no fix
- 2026-05-06 [CVE-2026-44542](https://erroneo.us/security/cve/CVE-2026-44542/index.md) FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion — github.com/gtsteffaniak/filebrowser < 0.0.0-20260501183844-112740bdd41d → 0.0.0-20260501183844-112740bdd41d
- 2026-05-06 [GHSA-9h64-2846-7x7f](https://erroneo.us/security/ghsa/GHSA-9h64-2846-7x7f/index.md) Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening — github.com/getaxonflow/axonflow < 7.5.0 → 7.5.0
- 2026-05-06 [CVE-2026-41050](https://erroneo.us/security/cve/CVE-2026-41050/index.md) Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering — github.com/rancher/fleet >= 0.15.0, < 0.15.1 → 0.15.1; github.com/rancher/fleet >= 0.14.0, < 0.14.5 → 0.14.5; github.com/rancher/fleet >= 0.13.0, < 0.13.10 → 0.13.10
- 2026-05-06 [CVE-2026-42596](https://erroneo.us/security/cve/CVE-2026-42596/index.md) Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook — github.com/gotenberg/gotenberg/v8 <= 8.30.1 → 8.32.0
- 2026-05-06 [CVE-2026-42238](https://erroneo.us/security/cve/CVE-2026-42238/index.md) Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore — github.com/0xJacky/nginx-ui < 2.3.8 → 2.3.8
- 2026-05-06 [CVE-2026-42880](https://erroneo.us/security/cve/CVE-2026-42880/index.md) ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction — github.com/argoproj/argo-cd/v3 >= 3.2.0, < 3.2.11 → 3.2.11; github.com/argoproj/argo-cd/v3 >= 3.3.0, < 3.3.9 → 3.3.9
- 2026-05-05 [CVE-2026-42882](https://erroneo.us/security/cve/CVE-2026-42882/index.md) S3-Proxy has Security Issues in its Resource Path Matching Implementation — github.com/oxyno-zeta/s3-proxy < 0.0.0-20260424211602-1320e4abd46a → 0.0.0-20260424211602-1320e4abd46a
- 2026-05-05 [CVE-2026-42300](https://erroneo.us/security/cve/CVE-2026-42300/index.md) DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header — github.com/l3montree-dev/devguard < 1.2.2 → 1.2.2
- 2026-05-04 [CVE-2026-42571](https://erroneo.us/security/cve/CVE-2026-42571/index.md) Pelican Web UI Affected by a Privilege Escalation Attack — github.com/pelicanplatform/pelican < 0.0.0-20260408120501-7f73b9c3e677 → 0.0.0-20260408120501-7f73b9c3e677
- 2026-04-30 [CVE-2026-40281](https://erroneo.us/security/cve/CVE-2026-40281/index.md) Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) — github.com/gotenberg/gotenberg/v8 <= 8.30.1 → 8.31.0
- 2026-04-30 [CVE-2026-42560](https://erroneo.us/security/cve/CVE-2026-42560/index.md) auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation — github.com/go-pkgz/auth >= 1.18.0, <= 1.25.1 → 1.25.2; github.com/go-pkgz/auth/v2 >= 2.0.0, <= 2.1.1 → 2.1.2
- 2026-04-28 [CVE-2026-38651](https://erroneo.us/security/cve/CVE-2026-38651/index.md) Netmaker does not verify JWT signatures for host tokens — github.com/gravitl/netmaker < 1.5.0 → 1.5.0
- 2026-04-25 [CVE-2026-41571](https://erroneo.us/security/cve/CVE-2026-41571/index.md) Note Mark: OIDC-registered users authenticated by submitting password "null" — github.com/enchant97/note-mark/backend < 0.0.0-20260417132909-dea5530cc989 → 0.0.0-20260417132909-dea5530cc989
- 2026-04-24 [GHSA-xhj4-g6w8-2xjw](https://erroneo.us/security/ghsa/GHSA-xhj4-g6w8-2xjw/index.md) go-zserio has Unbounded Memory Allocation for All Platforms — github.com/woven-planet/go-zserio < 0.9.1 → 0.9.1
- 2026-04-24 [CVE-2026-41328](https://erroneo.us/security/cve/CVE-2026-41328/index.md) Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field — github.com/dgraph-io/dgraph/v25 < 25.3.3 → 25.3.3; github.com/dgraph-io/dgraph/v24 <= 24.1.8 → no fix; github.com/dgraph-io/dgraph <= 1.2.8 → no fix
- 2026-04-24 [CVE-2026-41492](https://erroneo.us/security/cve/CVE-2026-41492/index.md) Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars — github.com/dgraph-io/dgraph/v25 < 25.3.3 → 25.3.3; github.com/dgraph-io/dgraph/v24 <= 24.1.8 → no fix; github.com/dgraph-io/dgraph <= 1.2.8 → no fix
- 2026-04-24 [CVE-2026-41327](https://erroneo.us/security/cve/CVE-2026-41327/index.md) Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field — github.com/dgraph-io/dgraph/v25 < 25.3.3 → 25.3.3; github.com/dgraph-io/dgraph/v24 <= 24.1.8 → no fix; github.com/dgraph-io/dgraph <= 1.2.8 → no fix
- 2026-04-23 [CVE-2026-39087](https://erroneo.us/security/cve/CVE-2026-39087/index.md) ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function — heckel.io/ntfy/v2 < 2.22.0 → 2.22.0
- 2026-04-22 [CVE-2026-41179](https://erroneo.us/security/cve/CVE-2026-41179/index.md) RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution — github.com/rclone/rclone >= 1.48.0, <= 1.73.4 → 1.73.5
- 2026-04-22 [CVE-2026-42072](https://erroneo.us/security/cve/CVE-2026-42072/index.md) NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access — github.com/orneryd/nornicdb < 1.0.42-hotfix → 1.0.42-hotfix
- 2026-04-22 [CVE-2026-41176](https://erroneo.us/security/cve/CVE-2026-41176/index.md) Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution — github.com/rclone/rclone >= 1.45.0, < 1.73.5 → 1.73.5
- 2026-04-22 [CVE-2026-41070](https://erroneo.us/security/cve/CVE-2026-41070/index.md) openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access — github.com/jkroepke/openvpn-auth-oauth2 >= 1.26.3, < 1.27.3 → 1.27.3
- 2026-04-17 [CVE-2026-41589](https://erroneo.us/security/cve/CVE-2026-41589/index.md) Wish has SCP Path Traversal that allows arbitrary file read/write — charm.land/wish/v2 < 2.0.1 → 2.0.1; github.com/charmbracelet/wish <= 1.4.7 → no fix
- 2026-04-17 [CVE-2026-41574](https://erroneo.us/security/cve/CVE-2026-41574/index.md) Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass — github.com/nhost/nhost < 0.0.0-20260417112436-ec8dab3f2cf4 → 0.0.0-20260417112436-ec8dab3f2cf4
- 2026-04-16 [CVE-2026-40173](https://erroneo.us/security/cve/CVE-2026-40173/index.md) Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints — github.com/dgraph-io/dgraph/v25 < 25.3.2 → 25.3.2; github.com/dgraph-io/dgraph/v24 <= 24.1.7 → no fix; github.com/dgraph-io/dgraph <= 1.2.8 → no fix
- 2026-04-15 [CVE-2025-41118](https://erroneo.us/security/cve/CVE-2025-41118/index.md) Pyroscope Exposes Storage Secret — github.com/grafana/pyroscope < 1.15.2 → 1.15.2; github.com/grafana/pyroscope >= 1.16.0, < 1.16.1 → 1.16.1
- 2026-04-15 [CVE-2026-6290](https://erroneo.us/security/cve/CVE-2026-6290/index.md) Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token — www.velocidex.com/golang/velociraptor <= 0.76.2 → no fix
- 2026-04-15 [CVE-2026-40575](https://erroneo.us/security/cve/CVE-2026-40575/index.md) OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing — github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2 → 7.15.2
- 2026-04-14 [CVE-2026-40946](https://erroneo.us/security/cve/CVE-2026-40946/index.md) Oxia has an OIDC token audience validation bypass via SkipClientIDCheck — github.com/oxia-db/oxia <= 0.16.1 → 0.16.2
- 2026-04-14 [CVE-2026-40884](https://erroneo.us/security/cve/CVE-2026-40884/index.md) goshs has an empty-username SFTP password authentication bypass — github.com/patrickhener/goshs <= 1.1.4 → no fix; github.com/patrickhener/goshs/v2 < 2.0.0 → 2.0.0
- 2026-04-14 [CVE-2026-34457](https://erroneo.us/security/cve/CVE-2026-34457/index.md) OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode — github.com/oauth2-proxy/oauth2-proxy/v7 < 7.15.2 → 7.15.2; github.com/oauth2-proxy/oauth2-proxy <= 3.2.0 → no fix
- 2026-04-10 [CVE-2026-40189](https://erroneo.us/security/cve/CVE-2026-40189/index.md) goshs has a file-based ACL authorization bypass in goshs state-changing routes — github.com/patrickhener/goshs <= 1.1.4 → no fix
- 2026-04-10 [CVE-2026-5412](https://erroneo.us/security/cve/CVE-2026-5412/index.md) Juju: CloudSpec method leaking cloud credentials — github.com/juju/juju < 0.0.0-20260408003526-d395054dc2c3 → 0.0.0-20260408003526-d395054dc2c3
- 2026-04-10 [CVE-2026-34178](https://erroneo.us/security/cve/CVE-2026-34178/index.md) LXD: Importing a crafted backup leads to project restriction bypass — github.com/canonical/lxd >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267 → no fix
- 2026-04-10 [CVE-2026-34177](https://erroneo.us/security/cve/CVE-2026-34177/index.md) LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf — github.com/canonical/lxd >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267 → no fix
- 2026-04-10 [CVE-2026-34179](https://erroneo.us/security/cve/CVE-2026-34179/index.md) LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin — github.com/canonical/lxd >= 0.0.0-20210305023314-538ac3df036e, <= 0.0.0-20260226085519-736f34afb267 → no fix
- 2026-04-10 [GHSA-9cp7-j3f8-p5jx](https://erroneo.us/security/ghsa/GHSA-9cp7-j3f8-p5jx/index.md) Daptin has Unauthenticated Path Traversal and Zip Slip — github.com/daptin/daptin <= 0.11.3 → 0.12.0
- 2026-04-08 [CVE-2026-39846](https://erroneo.us/security/cve/CVE-2026-39846/index.md) SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260407035653-2f416e5253f1 → 0.0.0-20260407035653-2f416e5253f1
- 2026-04-07 [CVE-2026-33815](https://erroneo.us/security/cve/CVE-2026-33815/index.md) pgx contains memory-safety vulnerability — github.com/jackc/pgx/v5 < 5.9.0 → 5.9.0
- 2026-04-07 [CVE-2026-33816](https://erroneo.us/security/cve/CVE-2026-33816/index.md) Memory-safety vulnerability in github.com/jackc/pgx/v5. — github.com/jackc/pgx/v5 < 5.9.0 → 5.9.0
- 2026-04-03 [CVE-2026-35471](https://erroneo.us/security/cve/CVE-2026-35471/index.md) goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) — github.com/patrickhener/goshs < 1.1.5-0.20260401172448-237f3af891a9 → 1.1.5-0.20260401172448-237f3af891a9
- 2026-04-02 [CVE-2026-34976](https://erroneo.us/security/cve/CVE-2026-34976/index.md) Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization — github.com/dgraph-io/dgraph/v25 <= 25.3.0 → 25.3.1; github.com/dgraph-io/dgraph/v24 <= 24.0.5 → no fix; github.com/dgraph-io/dgraph <= 1.2.8 → no fix
- 2026-04-02 [CVE-2026-35393](https://erroneo.us/security/cve/CVE-2026-35393/index.md) goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload — github.com/patrickhener/goshs < 1.1.5-0.20260401172448-237f3af891a9 → 1.1.5-0.20260401172448-237f3af891a9
- 2026-04-02 [CVE-2026-35392](https://erroneo.us/security/cve/CVE-2026-35392/index.md) goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload — github.com/patrickhener/goshs < 1.1.5-0.20260401172448-237f3af891a9 → 1.1.5-0.20260401172448-237f3af891a9
- 2026-04-01 [CVE-2026-4370](https://erroneo.us/security/cve/CVE-2026-4370/index.md) Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster — github.com/juju/juju <= 0.0.0-20260401092550-1c1ac1922b57 → no fix
- 2026-03-31 [CVE-2026-34448](https://erroneo.us/security/cve/CVE-2026-34448/index.md) SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client — github.com/siyuan-note/siyuan/kernel <= 3.6.1 → 3.6.2
- 2026-03-31 [CVE-2026-34449](https://erroneo.us/security/cve/CVE-2026-34449/index.md) SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection — github.com/siyuan-note/siyuan/kernel <= 3.6.1 → 3.6.2
- 2026-03-30 [CVE-2026-33032](https://erroneo.us/security/cve/CVE-2026-33032/index.md) nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover — github.com/0xJacky/Nginx-UI <= 1.99 → no fix
- 2026-03-30 [CVE-2026-33026](https://erroneo.us/security/cve/CVE-2026-33026/index.md) nginx-ui Backup Restore Allows Tampering with Encrypted Backups — github.com/0xJacky/Nginx-UI < 1.9.10-0.20260315015203-f61bcec547c0 → 1.9.10-0.20260315015203-f61bcec547c0
- 2026-03-27 [CVE-2026-33945](https://erroneo.us/security/cve/CVE-2026-33945/index.md) Incus has an abitrary file write through its systemd-creds options — github.com/lxc/incus/v6 < 6.23.0 → 6.23.0
- 2026-03-27 [CVE-2026-33897](https://erroneo.us/security/cve/CVE-2026-33897/index.md) Incus vulnerable to arbitrary file read and write through pongo templates — github.com/lxc/incus/v6 < 6.23.0 → 6.23.0; github.com/lxc/incus <= 0.7.0 → no fix
- 2026-03-26 [CVE-2026-33758](https://erroneo.us/security/cve/CVE-2026-33758/index.md) OpenBao has Reflected XSS in its OIDC authentication error message — github.com/openbao/openbao < 0.0.0-20260325133417-6e2b2dd84f0e → 0.0.0-20260325133417-6e2b2dd84f0e
- 2026-03-26 [CVE-2026-33757](https://erroneo.us/security/cve/CVE-2026-33757/index.md) OpenBao lacks user confirmation for OIDC direct callback mode — github.com/openbao/openbao < 0.0.0-20260325142553-e32103951925 → 0.0.0-20260325142553-e32103951925

Pages: https://erroneo.us/security/ecosystem/go/index.md · https://erroneo.us/security/ecosystem/go/2/index.md · https://erroneo.us/security/ecosystem/go/3/index.md · https://erroneo.us/security/ecosystem/go/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/go/2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt