Go - OSV

GHSA-46r4-q7wv-32fc

Go/github.com/openchoreo/openchoreo

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project... yesterday

Fix available
Severity - 7.4 (High)

GHSA-5588-rp99-5fjh

Go/github.com/moov-io/signedxml

Moov signedxml: Unauthenticated denial of service in exclusive XML... yesterday

Fix available
Severity - 7.5 (High)

GO-2026-6809

Go/stdlib

Distrust compromised intermediate certificates in crypto/x509 2 days ago

Fix available

GHSA-259r-337f-4rfw

Go/github.com/klauspost/compress

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress 2 days ago

Fix available
Severity - 7.5 (High)

GO-2026-6671

Go/github.com/sipcapture/homer-app

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on... 3 days ago

No fix available

GO-2026-6672

Go/github.com/sipcapture/homer-app

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in... 3 days ago

No fix available

GO-2026-6673

Go/github.com/sipcapture/homer-app

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty... 3 days ago

No fix available

GO-2026-6667

Go/github.com/external-secrets/external-secrets

External Secrets Operator: label enforcement bypass in webhook generator... 3 days ago

Fix available

GO-2026-6668

Go/github.com/corazawaf/coraza
Go/github.com/corazawaf/coraza/v2
Go/github.com/corazawaf/coraza/v3

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted... 3 days ago

Fix available

GO-2026-6669

Go/github.com/corazawaf/coraza
Go/github.com/corazawaf/coraza/v2
Go/github.com/corazawaf/coraza/v3

Coraza: Native audit-log format allows CRLF injection and log forgery via... 3 days ago

Fix available

GO-2026-6670

Go/github.com/corazawaf/coraza
Go/github.com/corazawaf/coraza/v2
Go/github.com/corazawaf/coraza/v3

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003)... 3 days ago

Fix available

GO-2026-6651

Go/github.com/xtls/xray-core

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of... 3 days ago

Fix available

GO-2026-6773

Go/github.com/0xJacky/Nginx-UI

Casdoor SSO callback uses a constant state parameter (login CSRF) in... 3 days ago

No fix available

GO-2026-6786

Go/github.com/0xJacky/Nginx-UI

TOTP / passkey enrolment requires no re-authentication, enabling persistent... 3 days ago

No fix available

GO-2026-6765

Go/github.com/cli/cli
Go/github.com/cli/cli/v2

GitHub CLI allows path traversal through unescaped request URL components in... 3 days ago

Fix available

GO-2026-6766

Go/github.com/cli/cli
Go/github.com/cli/cli/v2

GitHub CLI partially discloses authentication tokens in `gh auth status` output... 3 days ago

Fix available

Vulnerabilities