---
title: "Critical Go advisories (page 3)"
url: https://erroneo.us/security/ecosystem/go/3/
description: "All 391 critical GitHub-reviewed Go security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 3 of 4."
type: ecosystem
section: "Security Digest"
date_modified: 2026-03-26
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Go advisories (page 3)

- 2026-03-26 [GHSA-2pv8-4c52-mf8j](https://erroneo.us/security/ghsa/GHSA-2pv8-4c52-mf8j/index.md) Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR — code.vikunja.io/api <= 2.2.0 → 2.2.1
- 2026-03-25 [CVE-2026-33670](https://erroneo.us/security/cve/CVE-2026-33670/index.md) SiYuan has directory traversal within its publishing service — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260317012524-fe4523fff2c8 → no fix
- 2026-03-25 [CVE-2026-33669](https://erroneo.us/security/cve/CVE-2026-33669/index.md) SiYuan has Arbitrary Document Reading within the Publishing Service — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260317012524-fe4523fff2c8 → no fix; github.com/siyuan-note/siyuan/kernel > 0 → no fix
- 2026-03-24 [CVE-2026-33634](https://erroneo.us/security/cve/CVE-2026-33634/index.md) Trivy ecosystem supply chain was briefly compromised — github.com/aquasecurity/trivy = 0.69.4 → no fix; aquasecurity/trivy-action < 0.35.0 → 0.35.0; aquasecurity/setup-trivy < 0.2.6 → 0.2.6
- 2026-03-23 [CVE-2026-4404](https://erroneo.us/security/cve/CVE-2026-4404/index.md) Harbor allows the use of the default password for web UI login — github.com/goharbor/harbor <= 2.15.0 → no fix
- 2026-03-20 [CVE-2026-33494](https://erroneo.us/security/cve/CVE-2026-33494/index.md) Ory Oathkeeper has a path traversal authorization bypass — github.com/ory/oathkeeper < 0.40.10-0.20260320084758-8e0002140491 → 0.40.10-0.20260320084758-8e0002140491
- 2026-03-20 [CVE-2026-33419](https://erroneo.us/security/cve/CVE-2026-33419/index.md) MinIO LDAP login brute-force via user enumeration and missing rate limit — github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c → no fix
- 2026-03-19 [CVE-2026-30836](https://erroneo.us/security/cve/CVE-2026-30836/index.md) step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) — github.com/smallstep/certificates < 0.30.0 → 0.30.0
- 2026-03-19 [CVE-2026-30924](https://erroneo.us/security/cve/CVE-2026-30924/index.md) qui CORS Misconfiguration: Arbitrary Origins Trusted — github.com/autobrr/qui < 1.15.0 → 1.15.0
- 2026-03-19 [CVE-2026-33322](https://erroneo.us/security/cve/CVE-2026-33322/index.md) MinIO has JWT Algorithm Confusion in OIDC Authentication — github.com/minio/minio <= 0.0.0-20260212201848-7aac2a2c5b7c → no fix
- 2026-03-18 [CVE-2026-33186](https://erroneo.us/security/cve/CVE-2026-33186/index.md) gRPC-Go has an authorization bypass via missing leading slash in :path — google.golang.org/grpc < 1.79.3 → 1.79.3
- 2026-03-18 [CVE-2026-33211](https://erroneo.us/security/cve/CVE-2026-33211/index.md) Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod — github.com/tektoncd/pipeline >= 1.0.0, < 1.0.1 → 1.0.1; github.com/tektoncd/pipeline >= 1.1.0, < 1.3.3 → 1.3.3; github.com/tektoncd/pipeline >= 1.4.0, < 1.6.1 → 1.6.1
- 2026-03-17 [CVE-2026-32938](https://erroneo.us/security/cve/CVE-2026-32938/index.md) SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260313024916-fd6526133bb3 → no fix
- 2026-03-17 [CVE-2026-32940](https://erroneo.us/security/cve/CVE-2026-32940/index.md) SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) — github.com/siyuan-note/siyuan <= 0.0.0-20260313024916-fd6526133bb3 → no fix
- 2026-03-16 [CVE-2026-32767](https://erroneo.us/security/cve/CVE-2026-32767/index.md) SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260313024916-fd6526133bb3 → no fix
- 2026-03-16 [CVE-2026-32760](https://erroneo.us/security/cve/CVE-2026-32760/index.md) File Browser Signup Grants Admin When Default Permissions Include Admin — github.com/filebrowser/filebrowser/v2 <= 2.61.2 → 2.62.0
- 2026-03-13 [CVE-2026-31886](https://erroneo.us/security/cve/CVE-2026-31886/index.md) Dagu: Path Traversal via `dagRunId` in Inline DAG Execution — github.com/dagu-org/dagu <= 2.2.4 → no fix
- 2026-03-13 [CVE-2026-32301](https://erroneo.us/security/cve/CVE-2026-32301/index.md) Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL — github.com/centrifugal/centrifugo/v6 <= 6.6.2 → 6.7.0; github.com/centrifugal/centrifugo <= 2.4.0 → no fix; github.com/centrifugal/centrifugo/v3 <= 3.2.3 → no fix
- 2026-03-13 [CVE-2026-32614](https://erroneo.us/security/cve/CVE-2026-32614/index.md) SM9 Infinity-Point Ciphertext Forgery Vulnerability — github.com/emmansun/gmsm < 0.41.1 → 0.41.1
- 2026-03-12 [CVE-2026-32136](https://erroneo.us/security/cve/CVE-2026-32136/index.md) AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass — github.com/AdguardTeam/AdGuardHome < 0.107.73 → 0.107.73
- 2026-03-11 [GHSA-54gx-3cgr-7mfm](https://erroneo.us/security/ghsa/GHSA-54gx-3cgr-7mfm/index.md) Cosmos EVM: incorrect state handling during nested EVM execution paths — github.com/cosmos/evm < 0.6.0 → 0.6.0
- 2026-03-10 [GHSA-j443-wcqq-xprh](https://erroneo.us/security/ghsa/GHSA-j443-wcqq-xprh/index.md) Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go — github.com/arslanbekov/terraform-provider-sendgrid <= 1.1.3-0.20250606002314-b4a2dfeb7b0f → no fix
- 2026-03-09 [GHSA-xv8g-fj9h-6gmv](https://erroneo.us/security/ghsa/GHSA-xv8g-fj9h-6gmv/index.md) Linkdave Missing Authentication on REST and WebSocket endpoints — github.com/shi-gg/linkdave < 0.1.5 → 0.1.5
- 2026-03-06 [CVE-2026-30861](https://erroneo.us/security/cve/CVE-2026-30861/index.md) WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation — github.com/Tencent/WeKnora >= 0.2.5, < 0.2.10 → 0.2.10
- 2026-03-06 [CVE-2026-30855](https://erroneo.us/security/cve/CVE-2026-30855/index.md) WeKnora Vulnerable to Broken Access Control in Tenant Management — github.com/Tencent/WeKnora <= 0.3.1 → 0.3.2
- 2026-03-06 [CVE-2026-30860](https://erroneo.us/security/cve/CVE-2026-30860/index.md) WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool — github.com/Tencent/WeKnora <= 0.2.11 → 0.2.12
- 2026-03-06 [CVE-2026-30832](https://erroneo.us/security/cve/CVE-2026-30832/index.md) soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import — github.com/charmbracelet/soft-serve >= 0.6.0, < 0.11.4 → 0.11.4
- 2026-03-06 [CVE-2026-30869](https://erroneo.us/security/cve/CVE-2026-30869/index.md) SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage — github.com/siyuan-note/siyuan/kernel <= 3.5.9 → 3.5.10
- 2026-03-05 [CVE-2026-27944](https://erroneo.us/security/cve/CVE-2026-27944/index.md) Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure — github.com/0xJacky/Nginx-UI < 2.3.3 → 2.3.3
- 2026-03-05 [CVE-2026-25921](https://erroneo.us/security/cve/CVE-2026-25921/index.md) Gogs: Cross-repository LFS object overwrite via missing content hash verification — gogs.io/gogs <= 0.14.1 → 0.14.2
- 2026-03-04 [CVE-2026-29191](https://erroneo.us/security/cve/CVE-2026-29191/index.md) ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint — github.com/zitadel/zitadel >= 4.0.0, < 4.12.0 → 4.12.0; github.com/zitadel/zitadel/v2 >= 4.0.0, < 4.12.0 → 4.12.0
- 2026-03-04 [CVE-2026-29188](https://erroneo.us/security/cve/CVE-2026-29188/index.md) File Browser's TUS Delete Endpoint Bypasses Delete Permission Check — github.com/filebrowser/filebrowser/v2 <= 2.61.0 → 2.61.1
- 2026-03-04 [CVE-2026-29183](https://erroneo.us/security/cve/CVE-2026-29183/index.md) SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260304034809-d68bd5a79391 → 0.0.0-20260304034809-d68bd5a79391
- 2026-03-03 [CVE-2021-25320](https://erroneo.us/security/cve/CVE-2021-25320/index.md) Rancher cloud credentials can be used through proxy API by users without access — github.com/rancher/rancher >= 2.2.0, < 2.4.16 → 2.4.16; github.com/rancher/rancher >= 2.5.0, < 2.5.9 → 2.5.9
- 2026-03-03 [CVE-2021-36783](https://erroneo.us/security/cve/CVE-2021-36783/index.md) Rancher doesn't properly sanitize credentials in cluster template answers — github.com/rancher/rancher >= 2.5.0, <= 2.5.12 → 2.5.13; github.com/rancher/rancher >= 2.6.0, <= 2.6.3 → 2.6.4
- 2026-03-03 [CVE-2022-31247](https://erroneo.us/security/cve/CVE-2022-31247/index.md) Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) — github.com/rancher/rancher >= 2.5.0, <= 2.5.15 → 2.5.16; github.com/rancher/rancher >= 2.6.0, <= 2.6.6 → 2.6.7
- 2026-02-27 [CVE-2026-28268](https://erroneo.us/security/cve/CVE-2026-28268/index.md) Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse — code.vikunja.io/api <= 0.24.6 → no fix
- 2026-02-27 [CVE-2026-27969](https://erroneo.us/security/cve/CVE-2026-27969/index.md) Vitess users with backup storage access can write to arbitrary file paths on restore — vitess.io/vitess >= 0.23.0-rc1, < 0.23.3 → 0.23.3; vitess.io/vitess < 0.22.4 → 0.22.4
- 2026-02-25 [CVE-2026-27626](https://erroneo.us/security/cve/CVE-2026-27626/index.md) OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks — github.com/OliveTin/OliveTin < 0.0.0-20260222101908-4bbd2eab1532 → 0.0.0-20260222101908-4bbd2eab1532
- 2026-02-25 [CVE-2026-27575](https://erroneo.us/security/cve/CVE-2026-27575/index.md) Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change — code.vikunja.io/api <= 0.24.6 → no fix
- 2026-02-19 [CVE-2026-27112](https://erroneo.us/security/cve/CVE-2026-27112/index.md) Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints — github.com/akuity/kargo >= 1.9.0-rc.1, < 1.9.3 → 1.9.3; github.com/akuity/kargo >= 1.8.0-rc.1, < 1.8.11 → 1.8.11; github.com/akuity/kargo >= 1.7.0, < 1.7.8 → 1.7.8
- 2026-02-19 [GHSA-6qr9-g2xw-cw92](https://erroneo.us/security/ghsa/GHSA-6qr9-g2xw-cw92/index.md) Dagu affected by unauthenticated RCE via inline DAG spec in default configuration — github.com/dagu-org/dagu <= 1.30.3 → no fix
- 2026-02-11 [CVE-2026-26190](https://erroneo.us/security/cve/CVE-2026-26190/index.md) Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise — github.com/milvus-io/milvus < 2.5.27 → 2.5.27; github.com/milvus-io/milvus >= 2.6.0, < 2.6.10 → 2.6.10
- 2026-02-09 [CVE-2025-66630](https://erroneo.us/security/cve/CVE-2025-66630/index.md) Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure — github.com/gofiber/fiber/v2 < 2.52.11 → 2.52.11
- 2026-02-06 [CVE-2025-64111](https://erroneo.us/security/cve/CVE-2025-64111/index.md) Gogs's update .git/config file allows remote command execution — gogs.io/gogs <= 0.13.3 → 0.13.4
- 2026-02-05 [GHSA-x9p2-77v6-6vhf](https://erroneo.us/security/ghsa/GHSA-x9p2-77v6-6vhf/index.md) FrankenPHP has delayed propagation of security fixes in upstream base images — github.com/dunglas/frankenphp < 1.1.11 → 1.1.11
- 2026-02-04 [CVE-2025-62878](https://erroneo.us/security/cve/CVE-2025-62878/index.md) Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern — github.com/rancher/local-path-provisioner < 0.0.34 → 0.0.34
- 2026-02-04 [CVE-2026-25160](https://erroneo.us/security/cve/CVE-2026-25160/index.md) Alist has Insecure TLS Config — github.com/alist-org/alist/v3 < 3.57.0 → 3.57.0
- 2026-02-03 [CVE-2026-25579](https://erroneo.us/security/cve/CVE-2026-25579/index.md) Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints — github.com/navidrome/navidrome < 0.60.0 → 0.60.0
- 2026-01-29 [CVE-2026-25539](https://erroneo.us/security/cve/CVE-2026-25539/index.md) SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE — github.com/siyuan-note/siyuan/kernel <= 0.0.0-20260126094835-d5d10dd41b0c → no fix
- 2026-01-27 [CVE-2026-22039](https://erroneo.us/security/cve/CVE-2026-22039/index.md) Kyverno Cross-Namespace Privilege Escalation via Policy apiCall — github.com/kyverno/kyverno < 1.15.3 → 1.15.3; github.com/kyverno/kyverno >= 1.16.0-rc.1, < 1.16.3 → 1.16.3
- 2026-01-23 [CVE-2025-66719](https://erroneo.us/security/cve/CVE-2025-66719/index.md) Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value — github.com/free5gc/nrf < 1.4.1 → 1.4.1
- 2026-01-20 [CVE-2026-22822](https://erroneo.us/security/cve/CVE-2026-22822/index.md) External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function — github.com/external-secrets/external-secrets >= 0.20.2, < 1.2.0 → 1.2.0
- 2026-01-20 [CVE-2026-23518](https://erroneo.us/security/cve/CVE-2026-23518/index.md) Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment — github.com/fleetdm/fleet >= 4.78.0, < 4.78.3 → 4.78.3; github.com/fleetdm/fleet >= 4.77.0, < 4.77.1 → 4.77.1; github.com/fleetdm/fleet >= 4.76.0, < 4.76.2 → 4.76.2
- 2026-01-15 [CVE-2026-23520](https://erroneo.us/security/cve/CVE-2026-23520/index.md) Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE — github.com/getarcaneapp/arcane/backend < 0.0.0-20260114065515-5a9c2f92e11f → 0.0.0-20260114065515-5a9c2f92e11f
- 2026-01-09 [CVE-2026-22688](https://erroneo.us/security/cve/CVE-2026-22688/index.md) WeKnora has Command Injection in MCP stdio test — github.com/Tencent/WeKnora < 0.2.5 → 0.2.5
- 2026-01-07 [CVE-2026-0650](https://erroneo.us/security/cve/CVE-2026-0650/index.md) OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware — github.com/openflagr/flagr < 0.0.0-20251009103504-fe83dc87aa40 → 0.0.0-20251009103504-fe83dc87aa40
- 2026-01-06 [GHSA-gg4x-fgg2-h9w9](https://erroneo.us/security/ghsa/GHSA-gg4x-fgg2-h9w9/index.md) Bypassing Kyverno Policies via Double Policy Exceptions — github.com/kyverno/kyverno >= 1.9.0, <= 1.12.7 → 1.13.0
- 2026-01-05 [CVE-2025-62877](https://erroneo.us/security/cve/CVE-2025-62877/index.md) Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer — github.com/harvester/harvester-installer >= 1.6.0, <= 1.6.1 → no fix; github.com/harvester/harvester-installer >= 1.5.0, <= 1.5.2 → no fix
- 2025-12-18 [CVE-2025-63389](https://erroneo.us/security/cve/CVE-2025-63389/index.md) Ollama Platform has missing authentication enabling attackers to perform model management operations — github.com/ollama/ollama <= 0.13.5 → no fix
- 2025-12-15 [CVE-2025-13888](https://erroneo.us/security/cve/CVE-2025-13888/index.md) OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources — github.com/redhat-developer/gitops-operator < 1.16.2 → 1.16.2
- 2025-12-08 [CVE-2025-66565](https://erroneo.us/security/cve/CVE-2025-66565/index.md) Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values — github.com/gofiber/utils/v2 < 2.0.0-rc.3.0.20251205210924-6c6cf047032b → 2.0.0-rc.4; github.com/gofiber/utils <= 1.1.0 → 1.2.0
- 2025-12-08 [CVE-2025-67494](https://erroneo.us/security/cve/CVE-2025-67494/index.md) ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login — github.com/zitadel/zitadel < 1.80.0-v2.20.0.20251208091519-4c879b47334e → 1.80.0-v2.20.0.20251208091519-4c879b47334e; github.com/zitadel/zitadel >= 1.83.4, <= 1.87.5 → no fix; github.com/zitadel/zitadel >= 4.0.0-rc.1, < 4.7.1 → 4.7.1
- 2025-12-03 [CVE-2025-44005](https://erroneo.us/security/cve/CVE-2025-44005/index.md) Step CA Has Authorization Bypass in ACME and SCEP Provisioners — github.com/smallstep/certificates <= 0.28.4 → 0.29.0
- 2025-11-27 [CVE-2025-12421](https://erroneo.us/security/cve/CVE-2025-12421/index.md) Mattermost fails to to verify the token used during code exchange — github.com/mattermost/mattermost/server/v8 < 8.0.0-20251022210333-acda1fb5dd46 → 8.0.0-20251022210333-acda1fb5dd46; github.com/mattermost/mattermost-server >= 11.0.0, < 11.0.3 → 11.0.3; github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 → 10.12.2
- 2025-11-27 [CVE-2025-12419](https://erroneo.us/security/cve/CVE-2025-12419/index.md) Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication — github.com/mattermost/mattermost/server/v8 < 8.0.0-20251028000919-d3ed703dc833 → 8.0.0-20251028000919-d3ed703dc833; github.com/mattermost/mattermost-server >= 10.12.0, < 10.12.2 → 10.12.2; github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.5 → 10.11.5
- 2025-11-24 [GHSA-rj4j-2jph-gg43](https://erroneo.us/security/ghsa/GHSA-rj4j-2jph-gg43/index.md) LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction — github.com/lf-edge/ekuiper/v2 < 2.3.0 → 2.3.0
- 2025-11-21 [CVE-2025-41115](https://erroneo.us/security/cve/CVE-2025-41115/index.md) Grafana Incorrect Privilege Assignment vulnerability — github.com/grafana/grafana >= 12.0.0, < 12.0.7 → 12.0.7; github.com/grafana/grafana >= 12.1.0, < 12.1.4 → 12.1.4; github.com/grafana/grafana >= 12.2.0, < 12.2.2 → 12.2.2
- 2025-11-13 [CVE-2025-64513](https://erroneo.us/security/cve/CVE-2025-64513/index.md) Milvus Proxy has a Critical Authentication Bypass Vulnerability — github.com/milvus-io/milvus >= 0.10.4, < 2.4.24 → 2.4.24; github.com/milvus-io/milvus >= 2.5.0, < 2.5.21 → 2.5.21; github.com/milvus-io/milvus >= 2.6.0, < 2.6.5 → 2.6.5
- 2025-11-13 [GHSA-6jqf-mv7m-3q7p](https://erroneo.us/security/ghsa/GHSA-6jqf-mv7m-3q7p/index.md) File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency — github.com/filebrowser/filebrowser/v2 <= 2.45.1 → 2.45.2
- 2025-11-10 [CVE-2025-64522](https://erroneo.us/security/cve/CVE-2025-64522/index.md) Soft Serve is vulnerable to SSRF through its Webhooks — github.com/charmbracelet/soft-serve < 0.11.1 → 0.11.1
- 2025-10-24 [CVE-2025-62714](https://erroneo.us/security/cve/CVE-2025-62714/index.md) Karmada Dashboard API Unauthorized Access Vulnerability — github.com/karmada-io/dashboard < 0.2.0 → 0.2.0
- 2025-10-21 [CVE-2025-54469](https://erroneo.us/security/cve/CVE-2025-54469/index.md) NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow — github.com/neuvector/neuvector >= 5.3.0, < 5.3.5 → 5.3.5; github.com/neuvector/neuvector >= 5.4.0, <= 5.4.6 → 5.4.7; github.com/neuvector/neuvector >= 0.0.0-20230727023453-1c4957d53911, < 0.0.0-20251020133207-084a437033b4 → 0.0.0-20251020133207-084a437033b4
- 2025-10-21 [GHSA-8pfh-j44r-f654](https://erroneo.us/security/ghsa/GHSA-8pfh-j44r-f654/index.md) Cosmos EVM Vulnerability — github.com/cosmos/evm >= 0.3.0, < 0.3.2 → 0.3.2; github.com/cosmos/evm >= 0.4.0, < 0.4.2 → 0.4.2
- 2025-10-20 [CVE-2025-10678](https://erroneo.us/security/cve/CVE-2025-10678/index.md) NetBird VPN does not remove the default password of an admin account — github.com/netbirdio/netbird < 0.57.0 → 0.57.0
- 2025-09-25 [CVE-2025-59823](https://erroneo.us/security/cve/CVE-2025-59823/index.md) Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning — github.com/gardener/gardener-extension-provider-aws < 1.64.0 → 1.64.0; github.com/gardener/gardener-extension-provider-gcp < 1.46.0 → 1.46.0; github.com/gardener/gardener-extension-provider-azure < 1.55.0 → 1.55.0
- 2025-09-15 [CVE-2025-59360](https://erroneo.us/security/cve/CVE-2025-59360/index.md) Chaos Controller Manager is vulnerable to OS command injection — github.com/chaos-mesh/chaos-mesh < 2.7.3 → 2.7.3
- 2025-09-15 [CVE-2025-59359](https://erroneo.us/security/cve/CVE-2025-59359/index.md) Chaos Controller Manager is vulnerable to OS command injection — github.com/chaos-mesh/chaos-mesh < 2.7.3 → 2.7.3
- 2025-09-15 [CVE-2025-59361](https://erroneo.us/security/cve/CVE-2025-59361/index.md) Chaos Controller Manager is vulnerable to OS command injection — github.com/chaos-mesh/chaos-mesh < 2.7.3 → 2.7.3
- 2025-09-10 [CVE-2025-54123](https://erroneo.us/security/cve/CVE-2025-54123/index.md) Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation — github.com/SpectoLabs/hoverfly <= 1.11.3 → no fix
- 2025-09-08 [CVE-2025-58450](https://erroneo.us/security/cve/CVE-2025-58450/index.md) pREST has a Systemic SQL Injection Vulnerability — github.com/prest/prest/v2 < 2.0.0-rc2 → no fix
- 2025-09-04 [CVE-2025-55190](https://erroneo.us/security/cve/CVE-2025-55190/index.md) Argo CD's Project API Token Exposes Repository Credentials — github.com/argoproj/argo-cd/v2 >= 2.13.0, < 2.13.9 → 2.13.9; github.com/argoproj/argo-cd/v2 >= 2.14.0, < 2.14.16 → 2.14.16; github.com/argoproj/argo-cd/v3 < 3.0.14 → 3.0.14
- 2025-08-28 [CVE-2025-8077](https://erroneo.us/security/cve/CVE-2025-8077/index.md) NeuVector admin account has insecure default password — github.com/neuvector/neuvector < 0.0.0-20250825191744-da1a462074c3 → 0.0.0-20250825191744-da1a462074c3
- 2025-08-19 [GHSA-qp7j-x725-g67f](https://erroneo.us/security/ghsa/GHSA-qp7j-x725-g67f/index.md) HydrAIDE Authentication Bypass Vulnerability — github.com/hydraide/hydraide >= 2.1.1, < 2.2.1 → 2.2.1; github.com/hydraide/hydraide < 0.0.0-20250816184905-1256db38c33c → 0.0.0-20250816184905-1256db38c33c
- 2025-08-18 [CVE-2025-55205](https://erroneo.us/security/cve/CVE-2025-55205/index.md) Capsule tenant owners with "patch namespace" permission can hijack system namespaces label — github.com/projectcapsule/capsule < 0.10.4 → 0.10.4
- 2025-08-08 [CVE-2025-54997](https://erroneo.us/security/cve/CVE-2025-54997/index.md) Privileged OpenBao Operator May Execute Code on the Underlying Host — github.com/openbao/openbao >= 0.1.0, < 2.3.2 → 2.3.2; github.com/openbao/openbao < 0.0.0-20250806194004-a14053c9679d → 0.0.0-20250806194004-a14053c9679d
- 2025-08-01 [CVE-2025-6000](https://erroneo.us/security/cve/CVE-2025-6000/index.md) Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration — github.com/hashicorp/vault >= 0.8.0, < 1.20.1 → 1.20.1
- 2025-07-30 [CVE-2025-54576](https://erroneo.us/security/cve/CVE-2025-54576/index.md) OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion — github.com/oauth2-proxy/oauth2-proxy/v7 <= 7.10.0 → 7.11.0
- 2025-07-17 [CVE-2025-23266](https://erroneo.us/security/cve/CVE-2025-23266/index.md) NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path — github.com/NVIDIA/nvidia-container-toolkit < 1.17.8 → 1.17.8; github.com/NVIDIA/k8s-device-plugin < 0.17.3 → 0.17.3; github.com/NVIDIA/gpu-operator < 25.3.2 → 25.3.2
- 2025-06-24 [CVE-2024-56731](https://erroneo.us/security/cve/CVE-2024-56731/index.md) Gogs allows deletion of internal files which leads to remote command execution — gogs.io/gogs <= 0.13.2 → 0.13.3
- 2025-06-20 [CVE-2025-4981](https://erroneo.us/security/cve/CVE-2025-4981/index.md) Mattermost allows authenticated users to write files to arbitrary locations — github.com/mattermost/mattermost-server < 0.0.0-20250519205859-65aec10162f6 → 0.0.0-20250519205859-65aec10162f6; github.com/mattermost/mattermost/server/v8 < 8.0.0-20250519205859-65aec10162f6 → 8.0.0-20250519205859-65aec10162f6; github.com/mattermost/mattermost/server/v8 >= 10.5.0, <= 10.5.5 → 10.5.6
- 2025-06-16 [CVE-2025-49825](https://erroneo.us/security/cve/CVE-2025-49825/index.md) Teleport allows remote authentication bypass — github.com/gravitational/teleport >= 17.0.0, < 17.5.2 → 17.5.2; github.com/gravitational/teleport >= 16.0.0, < 16.5.12 → 16.5.12; github.com/gravitational/teleport >= 15.0.0, < 15.5.3 → 15.5.3
- 2025-06-09 [CVE-2025-49136](https://erroneo.us/security/cve/CVE-2025-49136/index.md) listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user — github.com/knadh/listmonk >= 4.0.0, < 5.0.2 → 5.0.2
- 2025-05-29 [CVE-2025-48865](https://erroneo.us/security/cve/CVE-2025-48865/index.md) Fabio allows HTTP clients to manipulate custom headers it adds — github.com/fabiolb/fabio <= 1.6.5 → 1.6.6
- 2025-05-28 [CVE-2025-47933](https://erroneo.us/security/cve/CVE-2025-47933/index.md) Argo CD allows cross-site scripting on repositories page — github.com/argoproj/argo-cd >= 1.2.0-rc1, <= 1.8.7 → no fix; github.com/argoproj/argo-cd/v2 >= 2.0.0-rc3, < 2.13.8 → 2.13.8; github.com/argoproj/argo-cd/v2 >= 2.14.0-rc1, < 2.14.13 → 2.14.13
- 2025-05-19 [CVE-2025-47282](https://erroneo.us/security/cve/CVE-2025-47282/index.md) Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation — github.com/gardener/external-dns-management < 0.23.6 → 0.23.6; github.com/gardener/gardener-extension-shoot-dns-service <= 1.6.0 → no fix
- 2025-05-19 [CVE-2025-47284](https://erroneo.us/security/cve/CVE-2025-47284/index.md) Gardener allows metadata injection for a project secret which can lead to privilege escalation — github.com/gardener/gardener < 1.116.4 → 1.116.4; github.com/gardener/gardener >= 1.117.0, < 1.117.5 → 1.117.5; github.com/gardener/gardener >= 1.118.0, < 1.118.2 → 1.118.2
- 2025-05-19 [CVE-2025-47283](https://erroneo.us/security/cve/CVE-2025-47283/index.md) Gardener allows bypassing project secret validation which can lead to privilege escalation — github.com/gardener/gardener < 1.116.4 → 1.116.4; github.com/gardener/gardener >= 1.117.0, < 1.117.5 → 1.117.5; github.com/gardener/gardener >= 1.118.0, < 1.118.2 → 1.118.2
- 2025-05-13 [CVE-2025-4658](https://erroneo.us/security/cve/CVE-2025-4658/index.md) OPKSSH Vulnerable to Authentication Bypass — github.com/openpubkey/opkssh < 0.5.0 → 0.5.0
- 2025-05-13 [CVE-2025-3757](https://erroneo.us/security/cve/CVE-2025-3757/index.md) OpenPubkey Vulnerable to Authentication Bypass — github.com/openpubkey/openpubkey < 0.10.0 → 0.10.0

Pages: https://erroneo.us/security/ecosystem/go/index.md · https://erroneo.us/security/ecosystem/go/2/index.md · https://erroneo.us/security/ecosystem/go/3/index.md · https://erroneo.us/security/ecosystem/go/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/go/3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt