# Go Advisories.

Every Go Advisory we hold (Go modules), newest first.

## Records, newest first (an older page)

- [Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For](https://agentprime.io/advisories/GHSA-7cgw-qmxx-7fc2.md)
  `GHSA-7cgw-qmxx-7fc2` · Go `github.com/go-chi/chi/v5`: affected `<=5.3.2`, no fixed version yet · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-348
- [Distrust compromised intermediate certificates in crypto/x509](https://agentprime.io/advisories/GO-2026-6809.md)
  `GO-2026-6809`, `BIT-golang-2026-111943`, `CVE-2026-111943`, `RUSTSEC-2026-0381`, `RUSTSEC-2026-0382`, `RUSTSEC-2026-0383` · Go `stdlib`: affected `<1.26.10 || >=1.27.0-0, <1.27.3`, fixed in `1.26.10`, `1.27.3` · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-299
- [Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress](https://agentprime.io/advisories/GHSA-259r-337f-4rfw.md)
  `GHSA-259r-337f-4rfw`, `CVE-2026-63209`, `GO-2026-5841` · Go `github.com/klauspost/compress`: affected `<1.18.7`, fixed in `1.18.7` · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core](https://agentprime.io/advisories/GHSA-5wf9-h793-w73c.md)
  `GHSA-5wf9-h793-w73c`, `GO-2026-6651` · Go `github.com/xtls/xray-core`: affected `>=1.260113.0, <1.260327.1-0.20260710210335-64fada32b5b9`, fixed in `1.260327.1-0.20260710210335-64fada32b5b9` · No CVSS score · Not analysed yet · Published 20 Oct 2026
- [agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable](https://agentprime.io/advisories/GHSA-953h-535j-jg2v.md)
  `GHSA-953h-535j-jg2v` · Go `github.com/envoyproxy/ai-gateway`: affected `>=0.4.0-rc1, <1.2.0-rc1`, fixed in `1.2.0-rc1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials, Broken access control
- [Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)](https://agentprime.io/advisories/GHSA-pw5q-rjx4-7f7p.md)
  `GHSA-pw5q-rjx4-7f7p`, `CVE-2026-96627`, `GO-2026-6807` · Go `github.com/getarcaneapp/arcane/backend/v2`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Privilege escalation
- [Arcane: Environment access token bypasses the admin-required authorization gate on \`/api/debug/pprof\`](https://agentprime.io/advisories/GHSA-mp22-58ff-6fhr.md)
  `GHSA-mp22-58ff-6fhr`, `CVE-2026-96628`, `GO-2026-6806` · Go `github.com/getarcaneapp/arcane/backend/v2`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content](https://agentprime.io/advisories/GHSA-74vm-87hj-r66f.md)
  `GHSA-74vm-87hj-r66f`, `CVE-2026-100349`, `GO-2026-6804` · Go `github.com/getkin/kin-openapi`: affected `<0.146.0`, fixed in `0.146.0` · CVSS 8.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [CoreDNS \`k8s_external\` headless AXFR can emit an empty transfer batch that panics the \`transfer\` plugin](https://agentprime.io/advisories/GHSA-74w3-63xv-x9mv.md)
  `GHSA-74w3-63xv-x9mv`, `CVE-2026-62994`, `GO-2026-6805` · Go `github.com/coredns/coredns`: affected `>=1.9.4, <1.14.5`, fixed in `1.14.5` · CVSS 3.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-248, CWE-755
- [gomarkdown/markdown IsSafeURL panics on short URLs](https://agentprime.io/advisories/GHSA-cv23-7vc5-jfh7.md)
  `GHSA-cv23-7vc5-jfh7`, `CVE-2026-102941` · Go `github.com/gomarkdown/markdown`: affected `<0.0.0-20260724235538-61af6e1e6971`, fixed in `0.0.0-20260724235538-61af6e1e6971` · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation](https://agentprime.io/advisories/GHSA-2cvf-wqm6-wr9g.md)
  `GHSA-2cvf-wqm6-wr9g`, `CVE-2026-94603`, `GO-2026-6770` · Go `github.com/containers/podman/v4` and 2 more: affected `>=4.4.0, <5.8.8`, fixed in `5.8.8` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [SFTPGo source-side file-pattern filter bypass during copy operations](https://agentprime.io/advisories/GHSA-wwv9-g5x4-966q.md)
  `GHSA-wwv9-g5x4-966q`, `CVE-2026-103028`, `GO-2026-6802` · Go `github.com/drakkan/sftpgo/v2`: affected `>=2.5.0, <2.7.6`, fixed in `2.7.6` · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [containerd: Unpack DoS via repeated opaque whiteouts](https://agentprime.io/advisories/GHSA-rp3h-jf77-q9p4.md)
  `GHSA-rp3h-jf77-q9p4`, `CVE-2026-95838`, `GO-2026-6796` · Go `github.com/containerd/containerd` and 1 more: affected `<1.7.35`, fixed in `1.7.35` · CVSS 4.6 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [Distribution: Client \`manifests.Get()\` does not verify returned content against requested digest](https://agentprime.io/advisories/GHSA-685w-q87j-wqw3.md)
  `GHSA-685w-q87j-wqw3`, `BIT-distribution-2026-85747`, `CVE-2026-85747`, `GO-2026-6778` · Go `github.com/distribution/distribution/v3` and 1 more: affected `<3.1.2`, fixed in `3.1.2` · CVSS 6.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-354
- [containerd CRI plugin: Checkpoint restore bypasses destination security context](https://agentprime.io/advisories/GHSA-p7v4-vr35-mj6f.md)
  `GHSA-p7v4-vr35-mj6f`, `CVE-2026-95837`, `GO-2026-6791` · Go `github.com/containerd/containerd/v2`: affected `>=2.1.0, <2.2.7 || >=2.3.0, <2.3.4`, fixed in `2.2.7`, `2.3.4` · CVSS 7.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation
- [kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter](https://agentprime.io/advisories/GHSA-vrcc-3ch7-hppw.md)
  `GHSA-vrcc-3ch7-hppw`, `CVE-2026-100353`, `GO-2026-6800` · Go `github.com/getkin/kin-openapi`: affected `>=0.136.0, <0.149.0`, fixed in `0.149.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Memory corruption
- [kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash](https://agentprime.io/advisories/GHSA-g8cf-rcjf-c8cf.md)
  `GHSA-g8cf-rcjf-c8cf`, `CVE-2026-100354`, `GO-2026-6785` · Go `github.com/getkin/kin-openapi`: affected `<0.149.0`, fixed in `0.149.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path](https://agentprime.io/advisories/GHSA-rj39-cv6w-8wv7.md)
  `GHSA-rj39-cv6w-8wv7`, `CVE-2026-100352`, `GO-2026-6795` · Go `github.com/getkin/kin-openapi`: affected `<0.148.0`, fixed in `0.148.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-754
- [Talos Linux: Support bundle does not redact registry credentials](https://agentprime.io/advisories/GHSA-7cxh-94cf-mfp6.md)
  `GHSA-7cxh-94cf-mfp6`, `CVE-2026-77564` · Go `github.com/siderolabs/talos`: affected `<1.14.0-alpha.0.0.20260513110206-76080416beee`, fixed in `1.14.0-alpha.0.0.20260513110206-76080416beee` · CVSS 3.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication](https://agentprime.io/advisories/GHSA-637c-6jxx-4rwm.md)
  `GHSA-637c-6jxx-4rwm`, `CVE-2026-77524`, `GO-2026-6776` · Go `github.com/kedacore/keda` and 1 more: affected `<=1.5.0`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation, Server-side request forgery (SSRF)
- [Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks](https://agentprime.io/advisories/GHSA-fmxq-cgp8-87wp.md)
  `GHSA-fmxq-cgp8-87wp`, `BIT-argo-cd-2026-77459`, `CVE-2026-77459`, `GO-2026-6784` · Go `github.com/argoproj/argo-cd/v2` and 1 more: affected `>=2.10.0, <=2.14.21`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion](https://agentprime.io/advisories/GHSA-23vg-4cjm-66q5.md)
  `GHSA-23vg-4cjm-66q5`, `CVE-2026-100351`, `GO-2026-6769` · Go `github.com/getkin/kin-openapi`: affected `>=0.144.0, <0.147.0`, fixed in `0.147.0` · CVSS 7.4 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-289, CWE-436
- [kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression](https://agentprime.io/advisories/GHSA-h4r5-mxv5-8mjc.md)
  `GHSA-h4r5-mxv5-8mjc`, `CVE-2026-100350`, `GO-2026-6787` · Go `github.com/getkin/kin-openapi`: affected `>=0.145.0, <0.146.0`, fixed in `0.146.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service, CWE-1050
- [Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service](https://agentprime.io/advisories/GHSA-qj98-gp63-54xj.md)
  `GHSA-qj98-gp63-54xj`, `CVE-2026-102748` · Go `github.com/dgraph-io/dgraph/v25`: affected `<25.4.0`, fixed in `25.4.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Vitess vttablet /twopcz reflected XSS](https://agentprime.io/advisories/GHSA-v75v-6fpf-gvw8.md)
  `GHSA-v75v-6fpf-gvw8`, `CVE-2026-104252`, `GO-2026-6798` · Go `vitess.io/vitess`: affected `<0.23.5 || >=0.24.0, <0.24.2`, fixed in `0.23.5`, `0.24.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)](https://agentprime.io/advisories/GHSA-mh7x-f8wq-4jhx.md)
  `GHSA-mh7x-f8wq-4jhx`, `CVE-2026-100348`, `GO-2026-6789` · Go `github.com/getkin/kin-openapi`: affected `<0.145.0`, fixed in `0.145.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Memory corruption
- [kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path](https://agentprime.io/advisories/GHSA-fh4f-47mf-f2gj.md)
  `GHSA-fh4f-47mf-f2gj`, `CVE-2026-100347`, `GO-2026-6783` · Go `github.com/getkin/kin-openapi`: affected `<0.145.0`, fixed in `0.145.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20, CWE-248
- [Gotify: Insufficiently Protected Password Change endpoint](https://agentprime.io/advisories/GHSA-3hcj-9m7p-wwm9.md)
  `GHSA-3hcj-9m7p-wwm9`, `CVE-2026-102603`, `GO-2026-6772` · Go `github.com/gotify/server/v2` and 1 more: affected `<=2.9.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-620
- [Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant](https://agentprime.io/advisories/GHSA-qjpp-gffx-2wm9.md)
  `GHSA-qjpp-gffx-2wm9`, `CVE-2026-100394`, `GO-2026-6794` · Go `github.com/nezhahq/nezha`: affected `>=0.0.0-20260628010923-fd31e5f1b0f8, <0.0.0-20260721131105-c893aa57867d`, fixed in `0.0.0-20260721131105-c893aa57867d` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Race condition, Memory corruption
- [kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items](https://agentprime.io/advisories/GHSA-p6wj-qrr4-pgh5.md)
  `GHSA-p6wj-qrr4-pgh5`, `CVE-2026-97394`, `GO-2026-6790` · Go `github.com/getkin/kin-openapi`: affected `>=0.136.0, <0.143.0`, fixed in `0.143.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Memory corruption, CWE-248
- [FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module](https://agentprime.io/advisories/GHSA-v3ph-cgqh-r8p5.md)
  `GHSA-v3ph-cgqh-r8p5`, `CVE-2026-82416`, `GO-2026-6797` · Go `github.com/dunglas/frankenphp`: affected `<1.12.5`, fixed in `1.12.5` · CVSS 7.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Race condition, CWE-488
- [SFTPGo: Denial of service via malformed SSH channel request](https://agentprime.io/advisories/GHSA-q7pc-356p-hggc.md)
  `GHSA-q7pc-356p-hggc`, `CVE-2026-77375`, `GO-2026-6792` · Go `github.com/drakkan/sftpgo/v2`: affected `<2.7.5`, fixed in `2.7.5` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-129
- [Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools](https://agentprime.io/advisories/GHSA-vc32-4gwf-77xp.md)
  `GHSA-vc32-4gwf-77xp`, `CVE-2026-84360`, `GO-2026-6799` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable](https://agentprime.io/advisories/GHSA-wq4w-vwvq-q3x9.md)
  `GHSA-wq4w-vwvq-q3x9`, `CVE-2026-84321`, `GO-2026-6801` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)](https://agentprime.io/advisories/GHSA-cf23-7qxj-xmhr.md)
  `GHSA-cf23-7qxj-xmhr`, `CVE-2026-84316`, `GO-2026-6782` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20, CWE-184
- [Nginx UI: Casdoor SSO callback uses a constant \`state\` parameter (login CSRF)](https://agentprime.io/advisories/GHSA-44xr-mrhh-qm78.md)
  `GHSA-44xr-mrhh-qm78`, `CVE-2026-84312`, `GO-2026-6773` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [Nginx UI OTP secure-session step-up is missing on sensitive mutation routes](https://agentprime.io/advisories/GHSA-5v7c-xpfp-p65m.md)
  `GHSA-5v7c-xpfp-p65m`, `CVE-2026-84315`, `GO-2026-6775` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Nginx UI: Account Takeover via Missing \`RequireSecureSession\` on User Management Endpoint](https://agentprime.io/advisories/GHSA-2gc7-j998-5xx6.md)
  `GHSA-2gc7-j998-5xx6`, `CVE-2026-84314`, `GO-2026-6771` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover](https://agentprime.io/advisories/GHSA-gfrc-g87h-7h5w.md)
  `GHSA-gfrc-g87h-7h5w`, `CVE-2026-84313`, `GO-2026-6786` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: MCP \`nginx_config_add\` Bypasses Directive Validation — Authenticated RCE](https://agentprime.io/advisories/GHSA-9jww-cxg5-rj9m.md)
  `GHSA-9jww-cxg5-rj9m`, `CVE-2026-84318`, `GO-2026-6781` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250506154222-1330888280a2, <1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)](https://agentprime.io/advisories/GHSA-76pm-mq2q-9gcr.md)
  `GHSA-76pm-mq2q-9gcr`, `CVE-2026-84317`, `GO-2026-6779` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20, CWE-693
- [Nginx UI: Auto backup name allows path traversal outside validated storage path](https://agentprime.io/advisories/GHSA-jrq7-xrjx-pcfw.md)
  `GHSA-jrq7-xrjx-pcfw`, `CVE-2026-84320`, `GO-2026-6788` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260715121709-f92218e01054`, fixed in `1.9.10-0.20260715121709-f92218e01054` · CVSS 6.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context](https://agentprime.io/advisories/GHSA-5r62-gj48-897x.md)
  `GHSA-5r62-gj48-897x`, `CVE-2026-84319`, `GO-2026-6774` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder](https://agentprime.io/advisories/GHSA-663m-7x7m-g4fw.md)
  `GHSA-663m-7x7m-g4fw`, `CVE-2026-77622`, `GO-2026-6777` · Go `github.com/BishopFox/sliver`: affected `<1.7.6`, fixed in `1.7.6` · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service
- [Terragrunt catalog predictable temp symlink clobber](https://agentprime.io/advisories/GHSA-wv6g-x823-wx9m.md)
  `GHSA-wv6g-x823-wx9m`, `CVE-2026-64672`, `GO-2026-6768` · Go `github.com/gruntwork-io/terragrunt`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-377
- [GitHub CLI allows attestation verification bypass through unescaped regex metacharacters](https://agentprime.io/advisories/GHSA-mm27-mwq9-fr5g.md)
  `GHSA-mm27-mwq9-fr5g`, `CVE-2026-64655`, `GO-2026-6767` · Go `github.com/cli/cli/v2`: affected `<2.97.0`, fixed in `2.97.0` · CVSS 2.1 Low · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-185
- [GitHub CLI allows path traversal through unescaped request URL components](https://agentprime.io/advisories/GHSA-4fjg-2h4q-fwg3.md)
  `GHSA-4fjg-2h4q-fwg3`, `CVE-2026-64653`, `GO-2026-6765` · Go `github.com/cli/cli/v2`: affected `<2.97.0`, fixed in `2.97.0` · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [GitHub CLI partially discloses authentication tokens in \`gh auth status\` output](https://agentprime.io/advisories/GHSA-cg6r-mpgc-h9mm.md)
  `GHSA-cg6r-mpgc-h9mm`, `CVE-2026-64652`, `GO-2026-6766` · Go `github.com/cli/cli/v2`: affected `<2.97.0`, fixed in `2.97.0` · CVSS 3.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Information disclosure
- [Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted](https://agentprime.io/advisories/GHSA-m687-p538-r5hp.md)
  `GHSA-m687-p538-r5hp`, `CVE-2026-111922`, `GO-2026-6739` · Go `code.vikunja.io/api`: affected `>=2.2.0, <=2.6.0`, no fixed version yet · CVSS 7.2 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-942
- [Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check](https://agentprime.io/advisories/GHSA-fmmf-xq98-g327.md)
  `GHSA-fmmf-xq98-g327`, `CVE-2026-111921`, `GO-2026-6730` · Go `code.vikunja.io/api`: affected `>=0.13.0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)](https://agentprime.io/advisories/GHSA-pjr3-86v4-5p7w.md)
  `GHSA-pjr3-86v4-5p7w`, `CVE-2026-111920`, `GO-2026-6745` · Go `code.vikunja.io/api`: affected `>=2.6.0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed](https://agentprime.io/advisories/GHSA-hjx8-qv73-f7cm.md)
  `GHSA-hjx8-qv73-f7cm`, `CVE-2026-111919`, `GO-2026-6733` · Go `code.vikunja.io/api`: affected `>=0.22.0, <=2.6.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants](https://agentprime.io/advisories/GHSA-fprf-r6rv-xg99.md)
  `GHSA-fprf-r6rv-xg99`, `CVE-2026-111918`, `GO-2026-6731` · Go `code.vikunja.io/api`: affected `>=1.0.0-rc0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes](https://agentprime.io/advisories/GHSA-4hv6-xc92-j86g.md)
  `GHSA-4hv6-xc92-j86g`, `CVE-2026-111917`, `GO-2026-6715` · Go `code.vikunja.io/api`: affected `>=2.3.0, <2.7.0`, fixed in `2.7.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage](https://agentprime.io/advisories/GHSA-j3hg-9rp3-5hw9.md)
  `GHSA-j3hg-9rp3-5hw9`, `CVE-2026-107805`, `GO-2026-6734` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20260729084040-acb59fdd81db, <1.9.10-0.20260901043436-8c9b9a1aff21`, fixed in `1.9.10-0.20260901043436-8c9b9a1aff21` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service
- [Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout](https://agentprime.io/advisories/GHSA-9h23-53f4-q947.md)
  `GHSA-9h23-53f4-q947`, `CVE-2026-107804`, `GO-2026-6724` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20251005005631-6de168c9454, <1.9.10-0.20260904075558-e30e331303fc`, fixed in `1.9.10-0.20260904075558-e30e331303fc` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal](https://agentprime.io/advisories/GHSA-w2ch-4xgr-22ww.md)
  `GHSA-w2ch-4xgr-22ww`, `GO-2026-6754` · Go `code.vikunja.io/api`: affected `>=0.9, <2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint](https://agentprime.io/advisories/GHSA-8wvg-r2j4-3737.md)
  `GHSA-8wvg-r2j4-3737`, `GO-2026-6723` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure
- [Vikunja: Cross-project task disclosure through subtask expansion](https://agentprime.io/advisories/GHSA-3hc7-r24j-rpwc.md)
  `GHSA-3hc7-r24j-rpwc`, `GO-2026-6714` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control
- [Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID](https://agentprime.io/advisories/GHSA-g38j-7v97-x298.md)
  `GHSA-g38j-7v97-x298`, `GO-2026-6732` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/go.md>
Older: <https://agentprime.io/advisories/ecosystem/go.md?cursor=WyIyMDI2LTEwLTA5VDIwOjU0OjQzLjAwMDAwMFoiLCJHSFNBLWczOGotN3Y5Ny14Mjk4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Go&cursor=WyIyMDI2LTEwLTIxVDE2OjI3OjU1LjAwMDAwMFoiLCJHSFNBLTU1ODgtcnA5OS01ZmpoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/go/?cursor=WyIyMDI2LTEwLTIxVDE2OjI3OjU1LjAwMDAwMFoiLCJHSFNBLTU1ODgtcnA5OS01ZmpoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.