Advisories · Technology

bufanyun HotGo.

Every CVE that names bufanyun HotGo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120447 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
- bufanyun HotGo
- Authentication bypass
Not analysed yet 2 Nov 2026
CVE-2026-5253 CVE record

CVSS 5.1 Medium

bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting
- bufanyun HotGo
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 1 Apr 2026
CVE-2026-3683 CVE record

CVSS 5.3 Medium

bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery
- bufanyun HotGo
- Server-side request forgery (SSRF)
Not analysed yet 7 Mar 2026