---
title: "Critical Go advisories"
url: https://erroneo.us/security/ecosystem/go/
description: "All 391 critical GitHub-reviewed Go security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-10-15
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Go advisories

- 2026-10-15 [CVE-2026-104252](https://erroneo.us/security/cve/CVE-2026-104252/index.md) Vitess vttablet /twopcz reflected XSS — vitess.io/vitess < 0.23.5 → 0.23.5; vitess.io/vitess >= 0.24.0, < 0.24.2 → 0.24.2
- 2026-10-15 [CVE-2026-102748](https://erroneo.us/security/cve/CVE-2026-102748/index.md) Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service — github.com/dgraph-io/dgraph/v25 <= 25.3.8 → 25.4.0
- 2026-10-15 [CVE-2026-77459](https://erroneo.us/security/cve/CVE-2026-77459/index.md) Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks — github.com/argoproj/argo-cd/v2 >= 2.10.0, <= 2.14.21 → no fix; github.com/argoproj/argo-cd/v3 >= 3.0.0, < 3.3.15 → 3.3.15; github.com/argoproj/argo-cd/v3 >= 3.4.0, < 3.4.10 → 3.4.10
- 2026-10-15 [CVE-2026-77524](https://erroneo.us/security/cve/CVE-2026-77524/index.md) KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication — github.com/kedacore/keda <= 1.5.0 → no fix; github.com/kedacore/keda/v2 < 2.21.0 → 2.21.0
- 2026-10-15 [CVE-2026-94603](https://erroneo.us/security/cve/CVE-2026-94603/index.md) Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation — github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8; go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3
- 2026-10-09 [CVE-2026-68582](https://erroneo.us/security/cve/CVE-2026-68582/index.md) Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) — code.vikunja.io/api >= 0.24.0, <= 2.3.0 → 2.4.0
- 2026-10-09 [CVE-2026-107806](https://erroneo.us/security/cve/CVE-2026-107806/index.md) Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite — github.com/0xJacky/Nginx-UI >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591 → 1.9.10-0.20260728074146-a467ed652591
- 2026-10-07 [CVE-2026-62253](https://erroneo.us/security/cve/CVE-2026-62253/index.md) Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) — github.com/sipcapture/homer-app < 0.0.0-20260625093330-5e90809657c9 → 0.0.0-20260625093330-5e90809657c9
- 2026-10-07 [CVE-2026-62252](https://erroneo.us/security/cve/CVE-2026-62252/index.md) Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login — github.com/sipcapture/homer-app < 0.0.0-20260625091610-b2e942031ff8 → 0.0.0-20260625091610-b2e942031ff8
- 2026-10-02 [CVE-2026-73802](https://erroneo.us/security/cve/CVE-2026-73802/index.md) gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled — gitea.com/gitea/runner < 1.0.9-0.20260731160927-34bfa1915022 → 1.0.9-0.20260731160927-34bfa1915022
- 2026-10-01 [CVE-2026-69085](https://erroneo.us/security/cve/CVE-2026-69085/index.md) SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721043339-eef10568384e → 0.0.0-20260721043339-eef10568384e
- 2026-09-24 [CVE-2026-61604](https://erroneo.us/security/cve/CVE-2026-61604/index.md) ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass — github.com/ixofoundation/ixo-blockchain/v8 < 8.0.0 → 8.0.0; github.com/ixofoundation/ixo-blockchain/v7 <= 7.0.0 → no fix; github.com/ixofoundation/ixo-blockchain/v6 <= 6.0.1 → no fix
- 2026-09-22 [CVE-2026-63132](https://erroneo.us/security/cve/CVE-2026-63132/index.md) OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack — github.com/openbao/openbao < 0.0.0-20260713141742-763625a20721 → 0.0.0-20260713141742-763625a20721; github.com/openbao/openbao >= 0.1.0, <= 1.1.5 → no fix
- 2026-09-18 [CVE-2026-61682](https://erroneo.us/security/cve/CVE-2026-61682/index.md) kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace — github.com/kcp-dev/kcp < 0.31.4 → 0.31.4; github.com/kcp-dev/kcp >= 0.32.0, < 0.32.2 → 0.32.2
- 2026-09-17 [CVE-2026-77408](https://erroneo.us/security/cve/CVE-2026-77408/index.md) RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow — github.com/rabbitmq/amqp091-go < 1.13.0 → 1.13.0
- 2026-09-17 [CVE-2026-77411](https://erroneo.us/security/cve/CVE-2026-77411/index.md) RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr — github.com/rabbitmq/amqp091-go < 1.13.0 → 1.13.0
- 2026-09-17 [CVE-2026-77405](https://erroneo.us/security/cve/CVE-2026-77405/index.md) RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser — github.com/rabbitmq/amqp091-go < 1.13.0 → 1.13.0
- 2026-09-10 [CVE-2026-88018](https://erroneo.us/security/cve/CVE-2026-88018/index.md) rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass — github.com/rclone/rclone < 1.75.1 → 1.75.1
- 2026-09-10 [CVE-2026-88007](https://erroneo.us/security/cve/CVE-2026-88007/index.md) Traefik HTTP/3 Backend NTLM Connection Reuse — github.com/traefik/traefik/v3 >= 3.0.0, < 3.7.13 → 3.7.13; github.com/traefik/traefik/v2 >= 2.11.0, < 2.11.57 → 2.11.57
- 2026-09-10 [CVE-2026-88044](https://erroneo.us/security/cve/CVE-2026-88044/index.md) rclone: RC per-server auth-proxy bypass — github.com/rclone/rclone >= 1.70.0, < 1.75.1 → 1.75.1
- 2026-09-08 [CVE-2026-73294](https://erroneo.us/security/cve/CVE-2026-73294/index.md) Semaphore U: OS Command Injection — github.com/semaphoreui/semaphore < 0.0.0-20260704181911-7e8a9434bd81 → 0.0.0-20260704181911-7e8a9434bd81
- 2026-09-08 [CVE-2026-60004](https://erroneo.us/security/cve/CVE-2026-60004/index.md) Gitea: Remote Code Execution via diffpatch Git Hook Installation — gitea.dev >= 1.17.0, < 1.27.1 → 1.27.1
- 2026-09-04 [CVE-2026-73842](https://erroneo.us/security/cve/CVE-2026-73842/index.md) OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation — github.com/openchoreo/openchoreo < 1.0.3 → 1.0.3; github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.3 → 1.1.3; github.com/openchoreo/openchoreo >= 1.2.0-rc.1, < 1.2.0-rc.2 → 1.2.0
- 2026-09-03 [CVE-2026-69084](https://erroneo.us/security/cve/CVE-2026-69084/index.md) SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721002947-23a17d44b5f3 → 0.0.0-20260721002947-23a17d44b5f3
- 2026-09-03 [CVE-2026-72811](https://erroneo.us/security/cve/CVE-2026-72811/index.md) SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260723004839-1a5b3431d5ab → 0.0.0-20260723004839-1a5b3431d5ab
- 2026-09-03 [CVE-2026-69083](https://erroneo.us/security/cve/CVE-2026-69083/index.md) SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721004815-cf42dd5680c8 → 0.0.0-20260721004815-cf42dd5680c8
- 2026-09-02 [CVE-2026-73843](https://erroneo.us/security/cve/CVE-2026-73843/index.md) OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs — github.com/openchoreo/openchoreo < 1.0.2 → 1.0.2; github.com/openchoreo/openchoreo >= 1.1.0, < 1.1.2 → 1.1.2
- 2026-09-02 [CVE-2026-71485](https://erroneo.us/security/cve/CVE-2026-71485/index.md) Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends — github.com/centrifugal/centrifugo <= 6.8.4 → 6.9.0
- 2026-09-02 [CVE-2026-72920](https://erroneo.us/security/cve/CVE-2026-72920/index.md) SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control — github.com/seaweedfs/seaweedfs < 0.0.0-20260512171108-5e8f99f40a8a → 0.0.0-20260512171108-5e8f99f40a8a
- 2026-08-28 [CVE-2026-55068](https://erroneo.us/security/cve/CVE-2026-55068/index.md) free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints — github.com/free5gc/free5gc < 4.2.2 → 4.2.2
- 2026-08-28 [CVE-2026-54754](https://erroneo.us/security/cve/CVE-2026-54754/index.md) Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) — github.com/klever-io/klever-go < 1.7.19 → 1.7.19
- 2026-08-28 [CVE-2026-54755](https://erroneo.us/security/cve/CVE-2026-54755/index.md) Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) — github.com/klever-io/klever-go < 1.7.19 → 1.7.19
- 2026-08-26 [CVE-2026-54523](https://erroneo.us/security/cve/CVE-2026-54523/index.md) Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system — github.com/kyverno/kyverno >= 1.18.0, <= 1.18.1 → 1.18.2
- 2026-08-20 [CVE-2026-54061](https://erroneo.us/security/cve/CVE-2026-54061/index.md) Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import — github.com/dgraph-io/dgraph/v25 <= 25.3.4 → 25.3.5
- 2026-08-17 [CVE-2026-71479](https://erroneo.us/security/cve/CVE-2026-71479/index.md) New API: Integer overflow in quota billing yields negative charges (self-crediting) — github.com/QuantumNous/new-api <= 1.0.0-rc.17 → 1.0.0-rc.18
- 2026-08-17 [CVE-2026-64859](https://erroneo.us/security/cve/CVE-2026-64859/index.md) New API: User List API Leaks Root User Access Token Leading to Privilege Escalation — github.com/QuantumNous/new-api < 1.0.0-rc.7 → 1.0.0-rc.7
- 2026-08-11 [CVE-2026-73080](https://erroneo.us/security/cve/CVE-2026-73080/index.md) SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle — github.com/seaweedfs/seaweedfs < 0.0.0-20260512171120-69da20bdaec9 → 0.0.0-20260512171120-69da20bdaec9
- 2026-08-06 [CVE-2026-65600](https://erroneo.us/security/cve/CVE-2026-65600/index.md) Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware — github.com/traefik/traefik/v2 <= 2.11.51 → 2.11.52; github.com/traefik/traefik/v3 <= 3.6.22 → 3.6.23; github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.6 → 3.7.7
- 2026-07-31 [CVE-2026-54725](https://erroneo.us/security/cve/CVE-2026-54725/index.md) vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API — github.com/bank-vaults/vault-secrets-webhook <= 1.22.2 → 1.23.1
- 2026-07-31 [CVE-2026-52855](https://erroneo.us/security/cve/CVE-2026-52855/index.md) Wings exposes node configuration secrets through egg configuration-file templating — github.com/pterodactyl/wings < 1.12.3 → 1.12.3
- 2026-07-29 [CVE-2026-54680](https://erroneo.us/security/cve/CVE-2026-54680/index.md) Logging operator has Fluentd configuration injection that allows remote code execution — github.com/kube-logging/logging-operator < 0.0.0-20260608145523-cf437d7f1e05 → 0.0.0-20260608145523-cf437d7f1e05
- 2026-07-29 [CVE-2026-54735](https://erroneo.us/security/cve/CVE-2026-54735/index.md) prebid-server's request forgery vulnerability allows for possible host environment data extraction — github.com/prebid/prebid-server/v4 < 4.4.0 → 4.4.0; github.com/prebid/prebid-server/v3 <= 3.30.0 → no fix; github.com/prebid/prebid-server/v2 <= 2.32.0 → no fix
- 2026-07-28 [CVE-2026-62325](https://erroneo.us/security/cve/CVE-2026-62325/index.md) goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) — github.com/patrickhener/goshs/v2 = 2.1.3 → 2.1.4; goshs.de/goshs/v2 = 2.1.3 → 2.1.4
- 2026-07-28 [CVE-2026-64863](https://erroneo.us/security/cve/CVE-2026-64863/index.md) goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite — goshs.de/goshs/v2 <= 2.1.3 → 2.1.4; github.com/patrickhener/goshs/v2 <= 2.1.3 → 2.1.4; goshs.de/goshs <= 1.1.4 → no fix
- 2026-07-24 [GHSA-r277-6w6q-xmqw](https://erroneo.us/security/ghsa/GHSA-r277-6w6q-xmqw/index.md) kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default — github.com/getkin/kin-openapi <= 0.143.0 → 0.144.0
- 2026-07-21 [CVE-2026-58443](https://erroneo.us/security/cve/CVE-2026-58443/index.md) Gitea: Public-only repository tokens can update private PR head branches — code.gitea.io/gitea < 1.27.0 → 1.27.0
- 2026-07-21 [CVE-2026-56750](https://erroneo.us/security/cve/CVE-2026-56750/index.md) Gitea Remember-Me Token Theft Not Invalidating Attacker Session — code.gitea.io/gitea < 1.27.0 → 1.27.0
- 2026-07-21 [CVE-2026-58426](https://erroneo.us/security/cve/CVE-2026-58426/index.md) Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write — code.gitea.io/gitea >= 1.22.0, < 1.26.2 → 1.26.2
- 2026-07-21 [CVE-2026-20896](https://erroneo.us/security/cve/CVE-2026-20896/index.md) Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` — code.gitea.io/gitea < 1.26.3 → 1.26.3
- 2026-07-21 [CVE-2026-22874](https://erroneo.us/security/cve/CVE-2026-22874/index.md) Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter — code.gitea.io/gitea < 1.26.3 → 1.26.3
- 2026-07-16 [CVE-2026-53713](https://erroneo.us/security/cve/CVE-2026-53713/index.md) Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure — github.com/envoyproxy/gateway >= 1.8.0-rc.0, < 1.8.1 → 1.8.1; github.com/envoyproxy/gateway < 1.7.4 → 1.7.4
- 2026-07-14 [CVE-2026-50006](https://erroneo.us/security/cve/CVE-2026-50006/index.md) Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode — github.com/julien040/anyquery < 0.4.5 → no fix
- 2026-07-10 [CVE-2026-54089](https://erroneo.us/security/cve/CVE-2026-54089/index.md) File Browser: Authentication Bypass via Proxy Auth Header Forgery — github.com/filebrowser/filebrowser/v2 >= 2.0.0-rc.1, <= 2.63.18 → no fix
- 2026-07-10 [CVE-2026-54067](https://erroneo.us/security/cve/CVE-2026-54067/index.md) SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- 2026-07-10 [CVE-2026-54088](https://erroneo.us/security/cve/CVE-2026-54088/index.md) File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) — github.com/filebrowser/filebrowser/v2 <= 2.63.5 → 2.63.6
- 2026-07-10 [CVE-2026-54069](https://erroneo.us/security/cve/CVE-2026-54069/index.md) SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- 2026-07-10 [CVE-2026-54072](https://erroneo.us/security/cve/CVE-2026-54072/index.md) Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL — github.com/authorizerdev/authorizer < 0.0.0-20260409051328-bd3f5baf6d3d → 0.0.0-20260409051328-bd3f5baf6d3d
- 2026-07-10 [GHSA-g936-7jqj-mwv8](https://erroneo.us/security/ghsa/GHSA-g936-7jqj-mwv8/index.md) TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation — github.com/almeidapaulopt/tsdproxy < 1.4.4-0.20260603142855-434819b4421e → 1.4.4-0.20260603142855-434819b4421e
- 2026-07-10 [CVE-2026-54158](https://erroneo.us/security/cve/CVE-2026-54158/index.md) SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- 2026-07-10 [CVE-2026-50551](https://erroneo.us/security/cve/CVE-2026-50551/index.md) SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content — github.com/siyuan-note/siyuan/kernel < 0.0.0-20260628153353-2d5d72223df4 → 0.0.0-20260628153353-2d5d72223df4
- 2026-07-08 [CVE-2026-53649](https://erroneo.us/security/cve/CVE-2026-53649/index.md) Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE — github.com/BishopFox/joro < 0.0.0-20260601151442-5c0ca35db828 → 0.0.0-20260601151442-5c0ca35db828
- 2026-07-08 [CVE-2026-52831](https://erroneo.us/security/cve/CVE-2026-52831/index.md) Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE — github.com/nuclio/nuclio < 0.0.0-20260601075854-3356b86a8bfa → 0.0.0-20260601075854-3356b86a8bfa
- 2026-07-07 [CVE-2026-59707](https://erroneo.us/security/cve/CVE-2026-59707/index.md) LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs — github.com/mudler/LocalAI < 1.40.1-0.20260703213242-2cbb3c96b34d → 1.40.1-0.20260703213242-2cbb3c96b34d
- 2026-07-07 [CVE-2026-53552](https://erroneo.us/security/cve/CVE-2026-53552/index.md) Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers — github.com/zhenorzz/goploy <= 1.17.5 → no fix
- 2026-07-06 [CVE-2026-49445](https://erroneo.us/security/cve/CVE-2026-49445/index.md) Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access — github.com/cilium/cilium >= 1.19.0, < 1.19.2 → 1.19.2; github.com/cilium/cilium >= 1.18.0, < 1.18.8 → 1.18.8; github.com/cilium/cilium < 1.17.14 → 1.17.14
- 2026-07-03 [CVE-2026-27780](https://erroneo.us/security/cve/CVE-2026-27780/index.md) Gitea pre-receive hook scanner errors allow branch-protection bypass — code.gitea.io/gitea < 1.26.0 → 1.26.0
- 2026-07-03 [CVE-2026-26292](https://erroneo.us/security/cve/CVE-2026-26292/index.md) Gitea LFS mirror operations bypass migration HTTP transport protections — code.gitea.io/gitea < 1.25.5 → 1.25.5
- 2026-07-03 [CVE-2026-26247](https://erroneo.us/security/cve/CVE-2026-26247/index.md) Gitea OAuth2 PKCE S256 verifier bypass — code.gitea.io/gitea < 1.25.5 → 1.25.5
- 2026-07-03 [CVE-2026-25718](https://erroneo.us/security/cve/CVE-2026-25718/index.md) Gitea template repository generation follows unsafe filesystem paths — code.gitea.io/gitea < 1.25.5 → 1.25.5
- 2026-07-03 [CVE-2026-22547](https://erroneo.us/security/cve/CVE-2026-22547/index.md) Gitea repository creation accepts insufficiently validated fields — code.gitea.io/gitea < 1.25.5 → 1.25.5
- 2026-07-03 [CVE-2026-26232](https://erroneo.us/security/cve/CVE-2026-26232/index.md) Gitea OAuth2 authorization codes can be reused after expiry — code.gitea.io/gitea < 1.25.5 → 1.25.5
- 2026-07-01 [CVE-2026-44935](https://erroneo.us/security/cve/CVE-2026-44935/index.md) Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer — github.com/rancher/fleet >= 0.15.0, < 0.15.2 → 0.15.2; github.com/rancher/fleet >= 0.14.0, < 0.14.6 → 0.14.6; github.com/rancher/fleet >= 0.13.0, < 0.13.11 → 0.13.11
- 2026-07-01 [CVE-2026-41052](https://erroneo.us/security/cve/CVE-2026-41052/index.md) Rancher has Privilege Escalation from Project Owner to Host — github.com/rancher/rancher >= 2.14.0, < 2.14.2 → 2.14.2; github.com/rancher/rancher >= 2.13.0, < 2.13.6 → 2.13.6; github.com/rancher/rancher >= 2.12.0, < 2.12.10 → 2.12.10
- 2026-07-01 [CVE-2026-44939](https://erroneo.us/security/cve/CVE-2026-44939/index.md) Rancher vulnerable to command injection through unsanitized YAML parameter — github.com/rancher/rancher >= 2.14.0, < 2.14.2 → 2.14.2; github.com/rancher/rancher >= 2.13.0, < 2.13.6 → 2.13.6; github.com/rancher/rancher >= 2.12.0, < 2.12.10 → 2.12.10
- 2026-06-30 [CVE-2026-50545](https://erroneo.us/security/cve/CVE-2026-50545/index.md) Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover — github.com/fission/fission <= 1.23.0 → 1.24.0
- 2026-06-30 [CVE-2026-50563](https://erroneo.us/security/cve/CVE-2026-50563/index.md) Fission Container Executor Function PodSpec Injection Leading to Node Escape — github.com/fission/fission <= 1.23.0 → 1.24.0
- 2026-06-30 [CVE-2026-50566](https://erroneo.us/security/cve/CVE-2026-50566/index.md) Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation — github.com/fission/fission <= 1.23.0 → 1.24.0
- 2026-06-30 [CVE-2026-50564](https://erroneo.us/security/cve/CVE-2026-50564/index.md) Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape — github.com/fission/fission <= 1.23.0 → 1.24.0
- 2026-06-29 [CVE-2026-11720](https://erroneo.us/security/cve/CVE-2026-11720/index.md) MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints — github.com/googleapis/mcp-toolbox < 1.3.0 → 1.3.0
- 2026-06-26 [CVE-2026-48752](https://erroneo.us/security/cve/CVE-2026-48752/index.md) Incus has arbitrary file read+write on host via templates/ symlink in malicious image — github.com/lxc/incus/v7/cmd/incusd < 7.2.0 → 7.2.0
- 2026-06-26 [CVE-2026-48755](https://erroneo.us/security/cve/CVE-2026-48755/index.md) Incus has an argument injection in backup compression algorithm leading to AFW and ACE — github.com/lxc/incus/v7/cmd/incusd < 7.2.0 → 7.2.0
- 2026-06-26 [GHSA-q6xx-5vr8-p898](https://erroneo.us/security/ghsa/GHSA-q6xx-5vr8-p898/index.md) Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check — github.com/nezhahq/nezha >= 1.14.13, <= 1.14.14 → no fix; github.com/nezhahq/nezha >= 2.0.0, <= 2.0.9 → 2.0.10
- 2026-06-26 [CVE-2026-48769](https://erroneo.us/security/cve/CVE-2026-48769/index.md) Incus has an arbitrary file write on its client due to trusted image hash — github.com/lxc/incus/v7/cmd/incusd < 7.2.0 → 7.2.0
- 2026-06-26 [CVE-2026-48753](https://erroneo.us/security/cve/CVE-2026-48753/index.md) Incus has an arbitrary file write via path traversal in S3 multipart upload — github.com/lxc/incus/v7/cmd/incusd < 7.1.0 → 7.1.0
- 2026-06-26 [CVE-2026-48750](https://erroneo.us/security/cve/CVE-2026-48750/index.md) Incus has an arbitrary file write on host via `exec-output` symlink in crafted image — github.com/lxc/incus/v7/cmd/incusd < 7.2.0 → 7.2.0
- 2026-06-26 [CVE-2026-53519](https://erroneo.us/security/cve/CVE-2026-53519/index.md) Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key — github.com/nezhahq/nezha < 2.0.13 → 2.0.13
- 2026-06-26 [CVE-2026-48751](https://erroneo.us/security/cve/CVE-2026-48751/index.md) Incus has a restricted project bypass leading to arbitrary command execution — github.com/lxc/incus/v7/cmd/incusd < 7.2.0 → 7.2.0
- 2026-06-26 [CVE-2026-48749](https://erroneo.us/security/cve/CVE-2026-48749/index.md) Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image — github.com/lxc/incus/v7/cmd/incusd < 7.2.0 → 7.2.0
- 2026-06-25 [CVE-2026-46595](https://erroneo.us/security/cve/CVE-2026-46595/index.md) golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-25 [CVE-2026-39830](https://erroneo.us/security/cve/CVE-2026-39830/index.md) golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-25 [CVE-2026-39834](https://erroneo.us/security/cve/CVE-2026-39834/index.md) golang.org/x/crypto vulnerable to infinite loop on large channel writes — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-25 [CVE-2026-39833](https://erroneo.us/security/cve/CVE-2026-39833/index.md) golang.org/x/crypto doesn't enforce invoking key constraints — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-25 [CVE-2026-39832](https://erroneo.us/security/cve/CVE-2026-39832/index.md) golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-25 [CVE-2026-39831](https://erroneo.us/security/cve/CVE-2026-39831/index.md) golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-25 [CVE-2026-42508](https://erroneo.us/security/cve/CVE-2026-42508/index.md) golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status — golang.org/x/crypto < 0.52.0 → 0.52.0
- 2026-06-23 [CVE-2026-52806](https://erroneo.us/security/cve/CVE-2026-52806/index.md) Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge — gogs.io/gogs < 0.14.3 → 0.14.3
- 2026-06-23 [CVE-2026-52813](https://erroneo.us/security/cve/CVE-2026-52813/index.md) Gogs has Path Traversal in organization name that results in RCE through Git hooks — gogs.io/gogs < 0.14.3 → 0.14.3
- 2026-06-23 [CVE-2026-52811](https://erroneo.us/security/cve/CVE-2026-52811/index.md) Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym — gogs.io/gogs < 0.14.3 → 0.14.3
- 2026-06-22 [CVE-2026-12249](https://erroneo.us/security/cve/CVE-2026-12249/index.md) Canonical ADSys Uses a Less Trusted Source — github.com/ubuntu/adsys < 0.16.3-0.20250318112551-8b1939f96d38 → 0.16.3-0.20250318112551-8b1939f96d38
- 2026-06-19 [GHSA-wfqx-gjrf-g28r](https://erroneo.us/security/ghsa/GHSA-wfqx-gjrf-g28r/index.md) Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag — github.com/crossplane/crossplane/v2 >= 2.3.0-rc.0, <= 2.3.2 → 2.3.3; github.com/crossplane/crossplane/v2 <= 2.2.2 → 2.2.3; github.com/crossplane/crossplane <= 1.21.0-rc.0 → no fix

Pages: https://erroneo.us/security/ecosystem/go/index.md · https://erroneo.us/security/ecosystem/go/2/index.md · https://erroneo.us/security/ecosystem/go/3/index.md · https://erroneo.us/security/ecosystem/go/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/go/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt