# Go Advisories.

Every Go Advisory we hold (Go modules), newest first.

## Records, newest first (an older page)

- [Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow](https://agentprime.io/advisories/GHSA-wp2g-vpjj-g53r.md)
  `GHSA-wp2g-vpjj-g53r`, `CVE-2026-107216`, `GO-2026-6688` · Go `github.com/xuri/excelize/v2`: affected `>=2.8.1, <2.11.1-0.20260911060113-ea12859e43c6`, fixed in `2.11.1-0.20260911060113-ea12859e43c6` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files](https://agentprime.io/advisories/GHSA-mjcv-p78q-w5fw.md)
  `GHSA-mjcv-p78q-w5fw`, `CVE-2026-61801`, `GO-2026-6686` · Go `github.com/moby/sys/user`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 5.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service
- [Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows](https://agentprime.io/advisories/GHSA-c85p-xxjj-2r75.md)
  `GHSA-c85p-xxjj-2r75`, `CVE-2026-107217`, `GO-2026-6677` · Go `github.com/xuri/excelize` and 1 more: affected `>=1.1.0, <=1.4.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-129
- [Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics](https://agentprime.io/advisories/GHSA-8jjq-8j9w-m2v6.md)
  `GHSA-8jjq-8j9w-m2v6`, `CVE-2026-107218`, `GO-2026-6675` · Go `github.com/xuri/excelize/v2`: affected `>=2.10.1, <2.11.1-0.20260908032718-ecd99d761fe0`, fixed in `2.11.1-0.20260908032718-ecd99d761fe0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-129
- [Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile](https://agentprime.io/advisories/GHSA-jrfj-fhj2-jjvm.md)
  `GHSA-jrfj-fhj2-jjvm`, `CVE-2026-107219`, `GO-2026-6681` · Go `github.com/xuri/excelize/v2`: affected `>=2.3.1, <2.11.1-0.20260906004932-2badfcd5841d`, fixed in `2.11.1-0.20260906004932-2badfcd5841d` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref](https://agentprime.io/advisories/GHSA-g27h-8qhm-6pff.md)
  `GHSA-g27h-8qhm-6pff`, `CVE-2026-107220`, `GO-2026-6680` · Go `github.com/xuri/excelize/v2`: affected `>=2.7.1, <2.11.1-0.20260820023833-99903a3240e5`, fixed in `2.11.1-0.20260820023833-99903a3240e5` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-129
- [Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API](https://agentprime.io/advisories/GHSA-8mcq-6wmr-jrjv.md)
  `GHSA-8mcq-6wmr-jrjv`, `CVE-2026-107221`, `GO-2026-6676` · Go `github.com/xuri/excelize/v2`: affected `>=2.0.0, <2.11.1-0.20260816084418-46a5eb289448`, fixed in `2.11.1-0.20260816084418-46a5eb289448` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check](https://agentprime.io/advisories/GHSA-rxcj-4pj5-74gr.md)
  `GHSA-rxcj-4pj5-74gr`, `CVE-2026-107222`, `GO-2026-6682` · Go `github.com/xuri/excelize/v2`: affected `>=2.7.0, <2.11.1-0.20260812075026-be7a16390fa6`, fixed in `2.11.1-0.20260812075026-be7a16390fa6` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-129
- [Excelize: Unbounded \<col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process](https://agentprime.io/advisories/GHSA-fq3v-74gv-27gm.md)
  `GHSA-fq3v-74gv-27gm`, `CVE-2026-107223`, `GO-2026-6678` · Go `github.com/xuri/excelize/v2`: affected `>=2.1.0, <2.11.1-0.20260807015645-a54c578af309`, fixed in `2.11.1-0.20260807015645-a54c578af309` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service
- [Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader](https://agentprime.io/advisories/GHSA-fw94-4wwp-w8pw.md)
  `GHSA-fw94-4wwp-w8pw`, `CVE-2026-107224`, `GO-2026-6679` · Go `github.com/xuri/excelize/v2`: affected `>=2.1.0, <2.11.1-0.20260805032953-db93f8d89de7`, fixed in `2.11.1-0.20260805032953-db93f8d89de7` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption, CWE-681
- [Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml](https://agentprime.io/advisories/GHSA-5h23-36rv-pm65.md)
  `GHSA-5h23-36rv-pm65`, `CVE-2026-107225`, `GO-2026-6674` · Go `github.com/xuri/excelize/v2`: affected `>=2.8.0, <2.11.1-0.20260731010303-ae2113b410e5`, fixed in `2.11.1-0.20260731010303-ae2113b410e5` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-20, CWE-129
- [Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query](https://agentprime.io/advisories/GHSA-f46q-3v67-fmm4.md)
  `GHSA-f46q-3v67-fmm4`, `CVE-2026-62251`, `GO-2026-6672` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625085520-a7d027dc684b`, fixed in `0.0.0-20260625085520-a7d027dc684b` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login](https://agentprime.io/advisories/GHSA-6xp5-7rcx-xfgx.md)
  `GHSA-6xp5-7rcx-xfgx`, `CVE-2026-62252`, `GO-2026-6671` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625091610-b2e942031ff8`, fixed in `0.0.0-20260625091610-b2e942031ff8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Hard-coded credentials
- [Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)](https://agentprime.io/advisories/GHSA-rqcc-94gv-wjm9.md)
  `GHSA-rqcc-94gv-wjm9`, `CVE-2026-62253`, `GO-2026-6673` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625093330-5e90809657c9`, fixed in `0.0.0-20260625093330-5e90809657c9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Panic parsing crafted input in x/text/secure/precis in golang.org/x/text](https://agentprime.io/advisories/GO-2026-6629.md)
  `GO-2026-6629`, `CVE-2026-56851` · Go `golang.org/x/text`: affected `<0.41.0`, fixed in `0.41.0` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding](https://agentprime.io/advisories/GHSA-6r3q-mjv7-xr8m.md)
  `GHSA-6r3q-mjv7-xr8m`, `CVE-2026-41510`, `GO-2026-6668` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.1`, fixed in `3.8.1` · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service, CWE-693
- [Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling](https://agentprime.io/advisories/GHSA-r3rm-qphw-hh76.md)
  `GHSA-r3rm-qphw-hh76`, `CVE-2026-41508`, `GO-2026-6670` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.4.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-20, CWE-693, CWE-755
- [Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields](https://agentprime.io/advisories/GHSA-prpw-wwv7-xjjr.md)
  `GHSA-prpw-wwv7-xjjr`, `CVE-2026-41504`, `GO-2026-6669` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Other injection
- [External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration](https://agentprime.io/advisories/GHSA-q7hv-xx6h-q2x8.md)
  `GHSA-q7hv-xx6h-q2x8`, `CVE-2026-26287`, `GO-2026-6667` · Go `github.com/external-secrets/external-secrets`: affected `>=0.10.0, <1.3.2`, fixed in `1.3.2` · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-696
- [Snowflake drivers writes sensitive information to logs](https://agentprime.io/advisories/GHSA-qqj6-54q6-cxv6.md)
  `GHSA-qqj6-54q6-cxv6`, `CVE-2026-86597`, `GO-2026-6665`, `PYSEC-2026-4301` · Go `github.com/snowflakedb/gosnowflake` and 6 more: affected `<=1.19.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)](https://agentprime.io/advisories/GHSA-4wwp-f6gw-6qm5.md)
  `GHSA-4wwp-f6gw-6qm5`, `CVE-2026-85175`, `GO-2026-6663` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260819144130-256d73aa7f94`, fixed in `0.0.0-20260819144130-256d73aa7f94` · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [SiYuan: /history/\*path and /repo/diff/\*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/\*](https://agentprime.io/advisories/GHSA-3cm4-ccvw-6xr6.md)
  `GHSA-3cm4-ccvw-6xr6`, `CVE-2026-82651`, `GO-2026-6662` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260816034002-035bf9a8c311`, fixed in `0.0.0-20260816034002-035bf9a8c311` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled](https://agentprime.io/advisories/GHSA-x4q3-gcj3-m6cf.md)
  `GHSA-x4q3-gcj3-m6cf`, `CVE-2026-73802`, `GO-2026-6656` · Go `gitea.com/gitea/runner`: affected `<1.0.9-0.20260731160927-34bfa1915022`, fixed in `1.0.9-0.20260731160927-34bfa1915022` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Privilege escalation
- [SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)](https://agentprime.io/advisories/GHSA-x8gv-g2g3-65fj.md)
  `GHSA-x8gv-g2g3-65fj`, `CVE-2026-82234`, `GO-2026-6657` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260813142806-dd2778b70d02`, fixed in `0.0.0-20260813142806-dd2778b70d02` · CVSS 8.4 High · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)](https://agentprime.io/advisories/GHSA-p23f-cm6q-2qp8.md)
  `GHSA-p23f-cm6q-2qp8`, `CVE-2026-82233`, `GO-2026-6655` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260813142104-b26a4a307b8a`, fixed in `0.0.0-20260813142104-b26a4a307b8a` · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers](https://agentprime.io/advisories/GHSA-4vpg-gwqq-w44c.md)
  `GHSA-4vpg-gwqq-w44c`, `CVE-2026-74904`, `GO-2026-6654` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260804015139-bd067a4fe9b2`, fixed in `0.0.0-20260804015139-bd067a4fe9b2` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, CWE-204
- [SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (\`/ws/network/proxy\`) via explicit \`CheckOrigin: true\` bypass](https://agentprime.io/advisories/GHSA-3cc2-h3v6-rqpq.md)
  `GHSA-3cc2-h3v6-rqpq`, `CVE-2026-74802`, `GO-2026-6650` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260803045322-cb67e0b4fab5`, fixed in `0.0.0-20260803045322-cb67e0b4fab5` · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF), CWE-346
- [Anubis: Policy bypass via client controlled X-Original-URI header](https://agentprime.io/advisories/GHSA-6wcg-mqvh-fcvg.md)
  `GHSA-6wcg-mqvh-fcvg`, `CVE-2026-62314`, `GO-2026-6639` · Go `github.com/TecharoHQ/anubis`: affected `>=1.22.0, <1.26.0`, fixed in `1.26.0` · CVSS 5.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium](https://agentprime.io/advisories/GHSA-w7c2-w76w-5hmj.md)
  `GHSA-w7c2-w76w-5hmj`, `BIT-cilium-2026-56742`, `BIT-cilium-operator-2026-56742`, `BIT-hubble-relay-2026-56742`, `CVE-2026-56742`, `GO-2026-6596` · Go `github.com/cilium/cilium`: affected `<1.17.17 || >=1.18.0, <1.18.11 || >=1.19.0, <1.19.5`, fixed in `1.17.17`, `1.18.11`, `1.19.5` · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block](https://agentprime.io/advisories/GHSA-vg99-7gj7-2fr5.md)
  `GHSA-vg99-7gj7-2fr5`, `CVE-2026-73606`, `GO-2026-6635` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route](https://agentprime.io/advisories/GHSA-9cqf-hhrq-7v45.md)
  `GHSA-9cqf-hhrq-7v45`, `CVE-2026-73608`, `GO-2026-6632` · Go `github.com/siyuan-note/siyuan/kernel`: affected `>=0.0.0-20260726161145-9b8e8956f997, <0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering](https://agentprime.io/advisories/GHSA-j4ph-9xwf-wcj4.md)
  `GHSA-j4ph-9xwf-wcj4`, `CVE-2026-73609`, `GO-2026-6634` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem](https://agentprime.io/advisories/GHSA-hf8h-97gm-4x2p.md)
  `GHSA-hf8h-97gm-4x2p`, `CVE-2026-73605`, `GO-2026-6626` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check](https://agentprime.io/advisories/GHSA-53fp-9jmv-227g.md)
  `GHSA-53fp-9jmv-227g`, `CVE-2026-73607`, `GO-2026-6624` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan discloses an administrator's open documents and search terms to anonymous readers](https://agentprime.io/advisories/GHSA-hgfg-j9pg-43xw.md)
  `GHSA-hgfg-j9pg-43xw`, `CVE-2026-72788`, `GO-2026-6622` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking](https://agentprime.io/advisories/GHSA-33jq-p8c2-q3q4.md)
  `GHSA-33jq-p8c2-q3q4`, `CVE-2026-69085`, `GO-2026-6621` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721043339-eef10568384e`, fixed in `0.0.0-20260721043339-eef10568384e` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: SQL injection
- [OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full](https://agentprime.io/advisories/GHSA-hjf4-fphr-2h65.md)
  `GHSA-hjf4-fphr-2h65`, `CVE-2026-81872`, `GO-2026-6615` · Go `go.opentelemetry.io/otel/sdk/log`: affected `<0.21.0`, fixed in `0.21.0` · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service
- [OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation](https://agentprime.io/advisories/GHSA-p9f8-wvj8-2fg8.md)
  `GHSA-p9f8-wvj8-2fg8`, `CVE-2026-81869`, `GO-2026-6616` · Go `go.opentelemetry.io/otel/sdk`: affected `>=1.10.0, <1.33.0`, fixed in `1.33.0` · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service, CWE-176
- [Containerd has image-pull DoS via crafted OCI index graph amplification](https://agentprime.io/advisories/GHSA-pg57-6jwg-q645.md)
  `GHSA-pg57-6jwg-q645`, `CVE-2026-53493`, `GO-2026-6597` · Go `github.com/containerd/containerd` and 1 more: affected `<1.7.36`, fixed in `1.7.36` · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Podman: Malformed Image can trick podman run into leaking host environment variables into the container](https://agentprime.io/advisories/GHSA-4hq8-gpf5-8p68.md)
  `GHSA-4hq8-gpf5-8p68`, `CVE-2026-57231`, `GO-2026-6594` · Go `github.com/containers/podman` and 5 more: affected `>=1.8.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure
- [ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass](https://agentprime.io/advisories/GHSA-w3rp-4cm2-4wgc.md)
  `GHSA-w3rp-4cm2-4wgc`, `CVE-2026-61604`, `GO-2026-6595` · Go `github.com/ixofoundation/ixo-blockchain` and 6 more: affected `<=1.6.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control
- [ZITADEL: MFA bypass via session reuse in Login V2](https://agentprime.io/advisories/GHSA-9993-rfwp-rhwf.md)
  `GHSA-9993-rfwp-rhwf`, `CVE-2026-85056`, `GO-2026-6589` · Go `github.com/zitadel/zitadel`: affected `<1.80.0-v2.20.0.20260717062356-56f4798ed31f`, fixed in `1.80.0-v2.20.0.20260717062356-56f4798ed31f` · CVSS 8.2 High · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass
- [ZITADEL: Actions V1 sandbox escape: host file read via require()](https://agentprime.io/advisories/GHSA-fgmf-7rf8-m6vf.md)
  `GHSA-fgmf-7rf8-m6vf`, `CVE-2026-85057`, `GO-2026-6591` · Go `github.com/zitadel/zitadel`: affected `<1.80.0-v2.20.0.20260717062331-baf6ed501b68`, fixed in `1.80.0-v2.20.0.20260717062331-baf6ed501b68` · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control
- [Dozzle label filters do not restrict container event and statistics streams](https://agentprime.io/advisories/GHSA-xcw9-qmmf-vqxj.md)
  `GHSA-xcw9-qmmf-vqxj`, `CVE-2026-62286`, `GO-2026-6592` · Go `github.com/amir20/dozzle`: affected `<1.29.1-0.20260622172006-19c01e0fb491`, fixed in `1.29.1-0.20260622172006-19c01e0fb491` · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control
- [podman quadlet install --replace does not fully replace the old file](https://agentprime.io/advisories/GHSA-fx76-2j3w-2mx6.md)
  `GHSA-fx76-2j3w-2mx6`, `CVE-2026-19730`, `GO-2026-6588` · Go `github.com/containers/podman/v5`: affected `>=5.7.0, <5.8.6`, fixed in `5.8.6` · CVSS 4.2 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-20, CWE-459
- [Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS](https://agentprime.io/advisories/GHSA-9wh6-9hq7-9688.md)
  `GHSA-9wh6-9hq7-9688`, `CVE-2026-82407`, `GO-2026-6586` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 7.0 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-20
- [Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery](https://agentprime.io/advisories/GHSA-7c7c-373r-gfjj.md)
  `GHSA-7c7c-373r-gfjj`, `CVE-2026-82409`, `GO-2026-6585` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 8.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-116
- [Klever-Go: Zombie-order theft: \`Buy\` missing \`IsClaimed\` guard in native marketplace](https://agentprime.io/advisories/GHSA-26r5-4mm2-px5c.md)
  `GHSA-26r5-4mm2-px5c`, `CVE-2026-82406`, `GO-2026-6584` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-841
- [Klever-Go Account takeover: \`kleverUpdateAccountPermission\` authorizes on attacker-controlled \`RecipientAddr\` instead of the authenticated caller](https://agentprime.io/advisories/GHSA-97cv-x867-6xhm.md)
  `GHSA-97cv-x867-6xhm`, `CVE-2026-82405`, `GO-2026-6582` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)](https://agentprime.io/advisories/GHSA-4fwh-wrm6-97xm.md)
  `GHSA-4fwh-wrm6-97xm`, `CVE-2026-86065`, `GO-2026-6581` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service
- [Klever-Go: /log controls global node logging](https://agentprime.io/advisories/GHSA-9v8p-frvj-2pcm.md)
  `GHSA-9v8p-frvj-2pcm`, `CVE-2026-86064`, `GO-2026-6583` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure, Authentication bypass
- [Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle](https://agentprime.io/advisories/GHSA-8fcf-v89g-xpg6.md)
  `GHSA-8fcf-v89g-xpg6`, `CVE-2026-88010`, `GO-2026-6558` · Go `github.com/traefik/traefik` and 1 more: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter](https://agentprime.io/advisories/GHSA-992g-9cr3-vm5x.md)
  `GHSA-992g-9cr3-vm5x`, `CVE-2026-88978`, `GO-2026-6560` · Go `github.com/hatchet-dev/hatchet`: affected `<0.106.1`, fixed in `0.106.1` · CVSS 4.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher](https://agentprime.io/advisories/GHSA-9q4h-f4x5-ffq8.md)
  `GHSA-9q4h-f4x5-ffq8`, `CVE-2026-84298`, `GO-2026-6561` · Go `github.com/hatchet-dev/hatchet`: affected `<0.95.3`, fixed in `0.95.3` · CVSS 3.1 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses](https://agentprime.io/advisories/GHSA-jvh5-97xg-v99f.md)
  `GHSA-jvh5-97xg-v99f`, `CVE-2026-79913`, `GO-2026-6572` · Go `github.com/cloudreve/Cloudreve/v4`: affected `<4.0.0-20260715072853-1c5cad6dec7e`, fixed in `4.0.0-20260715072853-1c5cad6dec7e` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-697
- [Gardener: Authorization Bypass via Group Subject Injection](https://agentprime.io/advisories/GHSA-gfjv-gqf2-c888.md)
  `GHSA-gfjv-gqf2-c888`, `CVE-2026-79767`, `GO-2026-6568` · Go `github.com/gardener/gardener`: affected `<1.142.6 || >=1.143.0, <1.143.3 || >=1.144.0, <1.144.2`, fixed in `1.142.6`, `1.143.3`, `1.144.2` · CVSS 5.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope](https://agentprime.io/advisories/GHSA-w89x-c962-c44g.md)
  `GHSA-w89x-c962-c44g`, `CVE-2026-77637`, `GO-2026-6576` · Go `github.com/cloudreve/Cloudreve/v4`: affected `<4.0.0-20260715070110-bce08f88e9d8`, fixed in `4.0.0-20260715070110-bce08f88e9d8` · CVSS 3.8 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service](https://agentprime.io/advisories/GHSA-xj3h-wwxq-gfcj.md)
  `GHSA-xj3h-wwxq-gfcj`, `CVE-2026-77633`, `GO-2026-6578` · Go `github.com/cloudreve/Cloudreve/v4`: affected `<4.0.0-20260715025621-7329602751c0`, fixed in `4.0.0-20260715025621-7329602751c0` · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Race condition, Denial of service
- [Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode](https://agentprime.io/advisories/GHSA-jpvm-9frm-hjcq.md)
  `GHSA-jpvm-9frm-hjcq`, `CVE-2026-76805`, `GO-2026-6571` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure
- [Nuclei: Local File Read via Workflow File-Protocol Gate Bypass](https://agentprime.io/advisories/GHSA-qgw5-7j4f-fg97.md)
  `GHSA-qgw5-7j4f-fg97`, `CVE-2026-76804`, `GO-2026-6574` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 5.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/go.md>
Older: <https://agentprime.io/advisories/ecosystem/go.md?cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjIxLjAwMDAwMFoiLCJHSFNBLXFndzUtN2o0Zi1mZzk3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Go&cursor=WyIyMDI2LTEwLTA4VDE2OjMxOjI2LjAwMDAwMFoiLCJHSFNBLXgycTMtOGNqaC03NjZmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/go/?cursor=WyIyMDI2LTEwLTA4VDE2OjMxOjI2LjAwMDAwMFoiLCJHSFNBLXgycTMtOGNqaC03NjZmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.