agentprime Advisories: Go

SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go

Thu, 05 Nov 2026 22:55:15 GMT

github.com/mark3labs/mcp-go *, no fixed version yet. Published by OSV. Not analysed by agentprime yet.

Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Thu, 05 Nov 2026 22:55:15 GMT

github.com/crewjam/saml *, no fixed version yet. Published by OSV. Not analysed by agentprime yet.

Panic on negative member size in Reader.Read in github.com/blakesmith/ar

Thu, 05 Nov 2026 22:55:15 GMT

github.com/blakesmith/ar *, no fixed version yet. Published by OSV. Not analysed by agentprime yet.

Event type spoofing via UntrustedType in github.com/google/go-eventlog

Thu, 05 Nov 2026 22:55:15 GMT

github.com/google/go-eventlog <0.0.3-0.20261001001437-1991f15bc4b0, fixed in 0.0.3-0.20261001001437-1991f15bc4b0. Published by OSV. Not analysed by agentprime yet.

Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

Thu, 05 Nov 2026 22:55:15 GMT

github.com/andybalholm/brotli <1.2.7, fixed in 1.2.7. CVSS 9.2 (Critical). Critical: In CISA’s KEV catalogue since 27 Oct 2026: it is known to be exploited. CVSS score 9.2: 9.0 or more. CVSS score 9.2 (7.0 or more) and EPSS 0.83 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Thu, 05 Nov 2026 17:48:54 GMT

github.com/chainguard-dev/kaniko <1.25.20, fixed in 1.25.20. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

lxd allows Cross-guest volume hijack via DevLXD device patch

Thu, 05 Nov 2026 17:40:59 GMT

github.com/canonical/lxd >=0.0.0-20250721152936-fe86ceb2c3fa, <0.0.0-20260626085133-7cb96ac80a6d, fixed in 0.0.0-20260626085133-7cb96ac80a6d. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Wed, 04 Nov 2026 17:02:37 GMT

github.com/basekick-labs/arc <0.0.0-20260610131716-5dc8f53b70a3, fixed in 0.0.0-20260610131716-5dc8f53b70a3. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

Tue, 03 Nov 2026 17:27:25 GMT

github.com/mtzanidakis/praktor <0.9.1, fixed in 0.9.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Netfoil doesn't decrement TTL

Tue, 03 Nov 2026 16:48:29 GMT

github.com/tinfoil-factory/netfoil >=0.3.0, <0.6.1, fixed in 0.6.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Arc has unauthenticated application log disclosure via `/api/v1/logs`

Tue, 03 Nov 2026 16:29:38 GMT

github.com/basekick-labs/arc <0.0.0-20260615165136-bb7d9761ad98, fixed in 0.0.0-20260615165136-bb7d9761ad98. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Fri, 30 Oct 2026 23:13:38 GMT

github.com/kubeflow/pipelines <0.0.0-20260831164314-ba9ae72cc860, fixed in 0.0.0-20260831164314-ba9ae72cc860. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Fri, 30 Oct 2026 23:13:29 GMT

github.com/kubeflow/pipelines <0.0.0-20260904182349-be4723e33727, fixed in 0.0.0-20260904182349-be4723e33727. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

Fri, 30 Oct 2026 22:58:05 GMT

github.com/gofiber/fiber/v2 >=2.52.1, <2.52.3, fixed in 2.52.3. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

Fri, 30 Oct 2026 22:57:00 GMT

github.com/imgproxy/imgproxy >=4.0.0, <4.0.16, fixed in 4.0.16. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

Fri, 30 Oct 2026 22:56:14 GMT

github.com/imgproxy/imgproxy/v3 >=3.3.0, <4.0.17, fixed in 4.0.17. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

Fri, 30 Oct 2026 22:55:49 GMT

github.com/imgproxy/imgproxy/v3 >=3.3.0, <4.0.16, fixed in 4.0.16. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

Fri, 30 Oct 2026 22:55:09 GMT

github.com/anacrolix/torrent <1.61.1-0.20260911233437-76452a2c8a2f, fixed in 1.61.1-0.20260911233437-76452a2c8a2f. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users

Fri, 30 Oct 2026 14:53:57 GMT

github.com/charmbracelet/soft-serve >=0.6.0, <0.12.3, fixed in 0.12.3. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories

Fri, 30 Oct 2026 14:42:35 GMT

github.com/charmbracelet/soft-serve >=0.5.0, <0.12.3, fixed in 0.12.3. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

Thu, 29 Oct 2026 16:39:41 GMT

github.com/cert-manager/cert-manager >=1.18.0, <1.19.6 || >=1.20.0-alpha.0, <1.20.3, fixed in 1.19.6, 1.20.3. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

Thu, 29 Oct 2026 16:33:09 GMT

github.com/daptin/daptin <=0.12.15, no fixed version yet. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

Wed, 28 Oct 2026 21:20:53 GMT

knative.dev/pkg <0.0.0-20260531000007-52dbd5ece63f, fixed in 0.0.0-20260531000007-52dbd5ece63f. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Go JOSE: Panics in JSON parsing

Wed, 28 Oct 2026 21:14:08 GMT

github.com/go-jose/go-jose/v3 <=3.0.5, no fixed version yet. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Go JOSE: Panic during CBC-HMAC processing

Wed, 28 Oct 2026 21:14:00 GMT

github.com/go-jose/go-jose/v3 <=3.0.5, no fixed version yet. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Wed, 28 Oct 2026 21:04:52 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo static file middleware route protection bypass via encoded dot-dot traversal

Wed, 28 Oct 2026 21:04:46 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo has a Static Middleware Double-Unescape Path Traversal

Wed, 28 Oct 2026 21:04:39 GMT

github.com/labstack/echo/v4 <4.15.3, fixed in 4.15.3. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

Wed, 28 Oct 2026 21:04:22 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Wed, 28 Oct 2026 21:04:10 GMT

github.com/labstack/echo/v4 <4.15.2, fixed in 4.15.2. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Wed, 28 Oct 2026 19:54:20 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Wed, 28 Oct 2026 19:54:05 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Wed, 28 Oct 2026 19:53:47 GMT

github.com/labstack/echo/v4 >=4.0.0, <=4.16.2, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Wed, 28 Oct 2026 19:53:36 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Wed, 28 Oct 2026 19:53:24 GMT

github.com/labstack/echo/v4 >=4.0.0, <=4.16.2, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Wed, 28 Oct 2026 19:49:33 GMT

github.com/caddyserver/caddy/v2 <2.11.5, fixed in 2.11.5. CVSS 2.9 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

Tue, 27 Oct 2026 21:16:18 GMT

golang.org/x/net <0.62.0, fixed in 0.62.0. CVSS 6.1 (Medium). Published by OSV. Not analysed by agentprime yet.

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

Tue, 27 Oct 2026 21:16:18 GMT

golang.org/x/net <0.62.0, fixed in 0.62.0. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.

Neko: Authorization bypass in legacy WebRTC input handling

Tue, 27 Oct 2026 21:04:57 GMT

github.com/m1k1o/neko/server >=0.0.0-20250401220545-fe94c999c6af, <0.0.0-20260805142851-395ca1a6f62b, fixed in 0.0.0-20260805142851-395ca1a6f62b. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Tue, 27 Oct 2026 21:04:50 GMT

github.com/runatlantis/atlantis >=0.4.0, <0.47.1, fixed in 0.47.1. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Tue, 27 Oct 2026 21:04:40 GMT

github.com/gtsteffaniak/filebrowser/backend <0.0.0-20260814233832-4126edeb07a0, fixed in 0.0.0-20260814233832-4126edeb07a0. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Go JOSE: DoS when parsing JWKs that contain RSA keys

Tue, 27 Oct 2026 19:01:30 GMT

github.com/go-jose/go-jose/v3 <=3.0.5, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

Tue, 27 Oct 2026 19:00:50 GMT

github.com/ctfer-io/terraform-provider-ctfd >=0.1.5, <=1.1.0, no fixed version yet. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

compress zstd: Panic on two-block frames

Tue, 27 Oct 2026 15:38:14 GMT

github.com/klauspost/compress/zstd <1.20.2, fixed in 1.20.2. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

Tue, 27 Oct 2026 14:43:57 GMT

github.com/siyuan-note/siyuan/kernel <0.0.0-20260808051406-3542530c505f, fixed in 0.0.0-20260808051406-3542530c505f. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Tue, 27 Oct 2026 13:29:47 GMT

github.com/wailsapp/wails/v2 >=2.0.0, <2.13.0, fixed in 2.13.0. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Fri, 23 Oct 2026 20:56:46 GMT

github.com/go-chi/chi/v5 <5.4.0, fixed in 5.4.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Fri, 23 Oct 2026 20:50:25 GMT

github.com/labstack/echo/v5 >=5.0.0, <5.4.1, fixed in 5.4.1. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Fri, 23 Oct 2026 20:50:17 GMT

github.com/labstack/echo/v4 >=4.15.0, <4.16.1, fixed in 4.16.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Echo: Decompress permits unbounded gzip expansion in v4

Fri, 23 Oct 2026 20:49:49 GMT

github.com/labstack/echo/v4 >=4.0.0, <4.16.1, fixed in 4.16.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.