# Go Advisories. Every Go Advisory we hold (Go modules), newest first. ## Records, newest first (an older page) - [Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API](https://agentprime.io/advisories/GHSA-wq92-8x3r-fm38.md) `GHSA-wq92-8x3r-fm38`, `CVE-2026-91970`, `GO-2026-6757` · Go `code.vikunja.io/api`: affected `>=2.5.0, <2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Unbounded CSV row cardinality permits API process termination](https://agentprime.io/advisories/GHSA-pqf9-h8g4-8gmh.md) `GHSA-pqf9-h8g4-8gmh`, `CVE-2026-91969`, `GO-2026-6746` · Go `code.vikunja.io/api`: affected `>=2.5.0, <2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Unbounded nested task-filter recursion permits API process termination](https://agentprime.io/advisories/GHSA-xxc3-xpmc-vmvr.md) `GHSA-xxc3-xpmc-vmvr`, `CVE-2026-91968`, `GO-2026-6759` · Go `code.vikunja.io/api`: affected `>=2.5.0, <2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Denial of service via decompression bomb in the data import](https://agentprime.io/advisories/GHSA-w7jp-mf2v-8342.md) `GHSA-w7jp-mf2v-8342`, `CVE-2026-91979`, `GO-2026-6756` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-409 - [Vikunja: Link-share token can enumerate users through the v2 API](https://agentprime.io/advisories/GHSA-vfxw-3x8p-2vjr.md) `GHSA-vfxw-3x8p-2vjr`, `CVE-2026-91981`, `GO-2026-6752` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project](https://agentprime.io/advisories/GHSA-39p5-2wrr-xh29.md) `GHSA-39p5-2wrr-xh29`, `CVE-2026-91980`, `GO-2026-6713` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification](https://agentprime.io/advisories/GHSA-4vh2-39rq-rq8j.md) `GHSA-4vh2-39rq-rq8j`, `CVE-2026-91971`, `GO-2026-6717` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords](https://agentprime.io/advisories/GHSA-m469-88xx-8rx2.md) `GHSA-m469-88xx-8rx2`, `CVE-2026-91973`, `GO-2026-6737` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass - [Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)](https://agentprime.io/advisories/GHSA-9rg3-v78m-26q8.md) `GHSA-9rg3-v78m-26q8`, `CVE-2026-91983`, `GO-2026-6726` · Go `code.vikunja.io/api`: affected `>=1.0.0, <2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control - [Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)](https://agentprime.io/advisories/GHSA-w39f-h553-h2mx.md) `GHSA-w39f-h553-h2mx`, `CVE-2026-91984`, `GO-2026-6755` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control - [Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level](https://agentprime.io/advisories/GHSA-qfwc-vx6f-3g6g.md) `GHSA-qfwc-vx6f-3g6g`, `CVE-2026-91985`, `GO-2026-6747` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Vikunja: TOTP secret is readable after enrollment, no step-up auth](https://agentprime.io/advisories/GHSA-88f6-4rjv-x774.md) `GHSA-88f6-4rjv-x774`, `CVE-2026-91982`, `GO-2026-6722` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Hard-coded credentials - [Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited](https://agentprime.io/advisories/GHSA-6rvj-qwjf-3m4q.md) `GHSA-6rvj-qwjf-3m4q`, `CVE-2026-91972`, `GO-2026-6721` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass - [Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access](https://agentprime.io/advisories/GHSA-r6w9-259g-gwrv.md) `GHSA-r6w9-259g-gwrv`, `CVE-2026-62376`, `GO-2026-6748` · Go `code.vikunja.io/api`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Weak cryptography or TLS - [Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover](https://agentprime.io/advisories/GHSA-xv7q-fvmc-jx96.md) `GHSA-xv7q-fvmc-jx96`, `CVE-2026-62367`, `GO-2026-6758` · Go `code.vikunja.io/api`: affected `>=1.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, CWE-345 - [Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite](https://agentprime.io/advisories/GHSA-p393-cf76-4jmr.md) `GHSA-p393-cf76-4jmr`, `CVE-2026-107806`, `GO-2026-6741` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20260421071512-7864e378f5cf, <1.9.10-0.20260728074146-a467ed652591`, fixed in `1.9.10-0.20260728074146-a467ed652591` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection - [ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud \`getFileURL\` Endpoint Leads to Remote Denial of Service](https://agentprime.io/advisories/GHSA-4jfq-pmq9-257h.md) `GHSA-4jfq-pmq9-257h`, `CVE-2026-107839`, `GO-2026-6716` · Go `github.com/luskaner/ageLANServer/server`: affected `<1.8.2-0.20260809203301-1dd40166a593`, fixed in `1.8.2-0.20260809203301-1dd40166a593` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure](https://agentprime.io/advisories/GHSA-32r8-5843-4qw2.md) `GHSA-32r8-5843-4qw2`, `CVE-2026-76216`, `GO-2026-6711` · Go `code.vikunja.io/api`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 7.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control, Memory corruption - [yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels](https://agentprime.io/advisories/GHSA-6r69-c6wg-7g8m.md) `GHSA-6r69-c6wg-7g8m`, `CVE-2026-107840`, `GO-2026-6720` · Go `github.com/jhaals/yopass`: affected `<0.0.0-20260727191436-61e31ead04a4`, fixed in `0.0.0-20260727191436-61e31ead04a4` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service - [Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)](https://agentprime.io/advisories/GHSA-rj9j-8772-4h6c.md) `GHSA-rj9j-8772-4h6c`, `CVE-2026-68582`, `GO-2026-6749` · Go `code.vikunja.io/api`: affected `>=0.24.0, <2.4.0`, fixed in `2.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control - [Vikunja: Link-share principal ID collision allows cross-account API token issuance and management](https://agentprime.io/advisories/GHSA-vvcv-vpph-h844.md) `GHSA-vvcv-vpph-h844`, `CVE-2026-68581`, `GO-2026-6753` · Go `code.vikunja.io/api`: affected `>=0.22.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.6 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control - [Vikunja: Scoped API token can mint unrestricted OAuth session credentials](https://agentprime.io/advisories/GHSA-v3p6-34mc-hj7v.md) `GHSA-v3p6-34mc-hj7v`, `CVE-2026-57458`, `GO-2026-6750` · Go `code.vikunja.io/api`: affected `>=2.3.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation - [Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM](https://agentprime.io/advisories/GHSA-662p-52hx-cmh2.md) `GHSA-662p-52hx-cmh2`, `CVE-2026-107812`, `GO-2026-6705` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728114330-580585516dd8`, fixed in `1.9.10-0.20260728114330-580585516dd8` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-494 - [Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)](https://agentprime.io/advisories/GHSA-45gv-9wjv-xh7p.md) `GHSA-45gv-9wjv-xh7p`, `CVE-2026-107808`, `GO-2026-6704` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814`, fixed in `1.9.10-0.20260728074558-95cd21b70814` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, CWE-305, CWE-308 - [Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs](https://agentprime.io/advisories/GHSA-33rr-wq23-g6gg.md) `GHSA-33rr-wq23-g6gg`, `CVE-2026-107809`, `GO-2026-6703` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site request forgery (CSRF) - [Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up](https://agentprime.io/advisories/GHSA-h246-wpgf-vmq5.md) `GHSA-h246-wpgf-vmq5`, `CVE-2026-107813`, `GO-2026-6706` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control - [0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser](https://agentprime.io/advisories/GHSA-32gc-wf3m-78w9.md) `GHSA-32gc-wf3m-78w9`, `CVE-2026-107811`, `GO-2026-6702` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728091109-0ecbd106c37b`, fixed in `1.9.10-0.20260728091109-0ecbd106c37b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Nginx UI: Node Secret Credential Exposure via URL Query Parameter](https://agentprime.io/advisories/GHSA-pvgv-gcp7-v38g.md) `GHSA-pvgv-gcp7-v38g`, `CVE-2026-107807`, `GO-2026-6708` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, CWE-598 - [Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied](https://agentprime.io/advisories/GHSA-p8v3-89rh-jxc7.md) `GHSA-p8v3-89rh-jxc7`, `CVE-2026-107810`, `GO-2026-6707` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074146-a467ed652591`, fixed in `1.9.10-0.20260728074146-a467ed652591` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal, CWE-61 - [Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL](https://agentprime.io/advisories/GHSA-j6cw-g6p4-7hch.md) `GHSA-j6cw-g6p4-7hch`, `BIT-argo-cd-2026-55797`, `CVE-2026-55797`, `GO-2026-6701` · Go `github.com/argoproj/argo-cd/v2` and 1 more: affected `>=2.11.0, <=2.14.21`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Command injection - [HTTP/2 server crash due to HPACK encoder race in net/http](https://agentprime.io/advisories/GO-2026-6617.md) `GO-2026-6617`, `BIT-golang-2026-97032`, `CVE-2026-97032` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition - [HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http](https://agentprime.io/advisories/GO-2026-6613.md) `GO-2026-6613`, `BIT-golang-2026-94439`, `CVE-2026-94439` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: HTTP request smuggling - [Double flow control refund on HTTP/2 server streams in net/http](https://agentprime.io/advisories/GO-2026-6612.md) `GO-2026-6612`, `BIT-golang-2026-78663`, `CVE-2026-78663` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-675 - [Excessive CPU consumption from repeated initial window changes in net/http](https://agentprime.io/advisories/GO-2026-6611.md) `GO-2026-6611`, `BIT-golang-2026-78669`, `CVE-2026-78669` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-405 - [HTTP/2 transport accepts malformed framing-related headers in net/http](https://agentprime.io/advisories/GO-2026-6610.md) `GO-2026-6610`, `BIT-golang-2026-78660`, `CVE-2026-78660` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: HTTP request smuggling - [Lack of limit on size of parsed Range headers in net/http](https://agentprime.io/advisories/GO-2026-6609.md) `GO-2026-6609`, `BIT-golang-2026-78667`, `CVE-2026-78667` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart](https://agentprime.io/advisories/GO-2026-6608.md) `GO-2026-6608`, `BIT-golang-2026-94440`, `CVE-2026-94440` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Reject malformed ECH outer extension references in crypto/tls](https://agentprime.io/advisories/GO-2026-6607.md) `GO-2026-6607`, `BIT-golang-2026-97031`, `CVE-2026-97031` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-405 - [HTTP/1 client connection desynchronization after CONNECT rejection in net/http](https://agentprime.io/advisories/GO-2026-6605.md) `GO-2026-6605`, `BIT-golang-2026-56866`, `CVE-2026-56866` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: HTTP request smuggling - [Root.Mkdir(All) can follow junctions out of the root on Windows in os](https://agentprime.io/advisories/GO-2026-6604.md) `GO-2026-6604`, `BIT-golang-2026-56857`, `CVE-2026-56857` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-1386 - [HTTP/2 server memory exhaustion due to Trailer headers in net/http](https://agentprime.io/advisories/GO-2026-6603.md) `GO-2026-6603`, `BIT-golang-2026-78659`, `CVE-2026-78659` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-405 - [Checksum database bypass for golang.org/toolchain in cmd/go](https://agentprime.io/advisories/GO-2026-6602.md) `GO-2026-6602`, `BIT-golang-2026-94447`, `CVE-2026-94447` · Go `toolchain`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-354 - [Checksum bypass for golang.org/fips140 in cmd/go](https://agentprime.io/advisories/GO-2026-6601.md) `GO-2026-6601`, `BIT-golang-2026-94444`, `CVE-2026-94444` · Go `toolchain`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-354 - [Recognize yield as regexp preceder keyword in html/template](https://agentprime.io/advisories/GO-2026-6600.md) `GO-2026-6600`, `BIT-golang-2026-97030`, `CVE-2026-97030` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS) - [Reset context tracking on consecutive template expressions in html/template](https://agentprime.io/advisories/GO-2026-6599.md) `GO-2026-6599`, `BIT-golang-2026-94448`, `CVE-2026-94448` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS) - [amqp091-go: Pre-negotiation frame limit is not enforced to 4KB](https://agentprime.io/advisories/GHSA-w6r9-248c-frg8.md) `GHSA-w6r9-248c-frg8`, `CVE-2026-107386`, `GO-2026-6700` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.14.0`, fixed in `1.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic](https://agentprime.io/advisories/GHSA-mx22-3794-2vpv.md) `GHSA-mx22-3794-2vpv`, `CVE-2026-107211`, `GO-2026-6695` · Go `github.com/xuri/excelize/v2`: affected `>=2.8.1, <2.11.1-0.20261003002531-6258dcebc4e2`, fixed in `2.11.1-0.20261003002531-6258dcebc4e2` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-129 - [Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor](https://agentprime.io/advisories/GHSA-rp9v-7xv3-r6g3.md) `GHSA-rp9v-7xv3-r6g3`, `CVE-2026-107834`, `GO-2026-6697` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection](https://agentprime.io/advisories/GHSA-w253-m66g-rx24.md) `GHSA-w253-m66g-rx24`, `CVE-2026-114100`, `GO-2026-6698` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.4, <3.8.1`, fixed in `3.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436 - [Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion](https://agentprime.io/advisories/GHSA-3c6w-j9xm-8h2h.md) `GHSA-3c6w-j9xm-8h2h`, `CVE-2026-107833`, `GO-2026-6690` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Coraza: Multipart filename\* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules](https://agentprime.io/advisories/GHSA-3wr7-993q-jrff.md) `GHSA-3wr7-993q-jrff`, `CVE-2026-114101`, `GO-2026-6691` · Go `github.com/corazawaf/coraza/v3`: affected `<3.8.1`, fixed in `3.8.1` · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436 - [Coraza has Cookie Parser Confusion](https://agentprime.io/advisories/GHSA-g4qm-m288-5cp9.md) `GHSA-g4qm-m288-5cp9`, `CVE-2026-107835`, `GO-2026-6694` · Go `github.com/corazawaf/coraza/v3`: affected `<3.8.1`, fixed in `3.8.1` · CVSS 4.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-436 - [Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations](https://agentprime.io/advisories/GHSA-x26q-wvhg-fh4m.md) `GHSA-x26q-wvhg-fh4m`, `CVE-2026-107825`, `GO-2026-6699` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 4.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436 - [Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass](https://agentprime.io/advisories/GHSA-pc5q-qfxp-ggqv.md) `GHSA-pc5q-qfxp-ggqv`, `CVE-2026-104774`, `GO-2026-6696` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-172, CWE-193, CWE-693 - [Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)](https://agentprime.io/advisories/GHSA-6gcq-wc29-5xf2.md) `GHSA-6gcq-wc29-5xf2`, `CVE-2026-107826`, `GO-2026-6693` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.1`, fixed in `3.8.1` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection](https://agentprime.io/advisories/GHSA-5gj4-9gm7-2fx2.md) `GHSA-5gj4-9gm7-2fx2`, `CVE-2026-114099`, `GO-2026-6692` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.1`, fixed in `3.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436 - [Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days](https://agentprime.io/advisories/GHSA-jw42-f3rr-4cc3.md) `GHSA-jw42-f3rr-4cc3`, `CVE-2026-107212`, `GO-2026-6685` · Go `github.com/xuri/excelize/v2`: affected `>=2.1.0, <2.11.1-0.20260930021559-01a9ff32fb3c`, fixed in `2.11.1-0.20260930021559-01a9ff32fb3c` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service - [Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element](https://agentprime.io/advisories/GHSA-r7x5-4969-99p7.md) `GHSA-r7x5-4969-99p7`, `CVE-2026-107213`, `GO-2026-6687` · Go `github.com/xuri/excelize/v2`: affected `>=2.9.0, <2.11.1-0.20260929015830-8ffeb07ec9a3`, fixed in `2.11.1-0.20260929015830-8ffeb07ec9a3` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption - [Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks](https://agentprime.io/advisories/GHSA-2j4c-ffch-9f23.md) `GHSA-2j4c-ffch-9f23`, `CVE-2026-107214`, `GO-2026-6684` · Go `github.com/xuri/excelize/v2`: affected `>=2.3.1, <2.11.1-0.20260915055537-22f76f9acb94`, fixed in `2.11.1-0.20260915055537-22f76f9acb94` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-248 - [Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS](https://agentprime.io/advisories/GHSA-x2q3-8cjh-766f.md) `GHSA-x2q3-8cjh-766f`, `CVE-2026-107215`, `GO-2026-6689` · Go `github.com/xuri/excelize/v2`: affected `>=2.3.1, <2.11.1-0.20260912113515-5f636f9dcde5`, fixed in `2.11.1-0.20260912113515-5f636f9dcde5` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .