go

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 7.3HighOct 29, 2026go github.com/cert-manager/cert-manager Auth bypass / access controlCVE-2026-62290## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses `Challenge.spec.solver` as the DNS01 provider configuration. When the direct Challenge references a `ClusterIssuer`, cert-manager derives the DNS provider secret namespace and
• 8.0HighOct 29, 2026go github.com/daptin/daptin Denial of serviceCVE-2026-62160### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though t
• 6.5MediumOct 28, 2026go knative.dev/pkg Denial of serviceISSUE-GHSA2hw4c9m4f2fj## ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — **4.5× amplification observed** (worse than the advisory's conservative 2× claim) Built a Go PoC ([`cmd/poc-c2/main.go`](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/cmd/poc-c2/main.go)) that runs the exact 8-line vulnerable snippet from [`webhook/admission.go:109-117`](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/webhook/admission.go#L109-L117) verbatim under the
• 5.9MediumOct 28, 2026go github.com/labstack/echo/v5 Auth bypass / access controlCVE-2026-118657## Description `Context.Scheme()` unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted headers (checked in this order of precedence): 1. `X-Forwarded-Proto` 2. `X-Forwarded-Protocol` 3. `X-Forwarded-Ssl` 4. `X-Url-Scheme` ### Threat model **Scenario A — Directly exposed application (vul
• 5.9MediumOct 28, 2026go github.com/labstack/echo/v5 Path traversal / file handlingCVE-2026-118654## Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as `%2F` and `%5C` before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-dot segments. A request such as `/public/%2E%2E/admin/secret.txt` passes the encoded-separator guard, is unescaped to `public/../admin/secret.txt`, then `path.Clean` resolves it to `admin/secret.
• 5.9MediumOct 28, 2026go github.com/labstack/echo/v5 Path traversal / file handlingCVE-2026-118655## Summary Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. ## Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again: ```go // BEFORE (vulnerable) pathUnescape := true ``` This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e
• 7.5HighOct 28, 2026go github.com/labstack/echo/v5CVE-2026-118650## Summary When `middleware.Static` is mounted globally (`e.Use(middleware.Static(...))`) and an application relies on a **route- or group-level middleware guard** to restrict a path that also falls under the served static root, a `%2F`-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for `StaticFS`/`StaticDirectoryHandler` in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the `middleware.Static` path. In addi
• 6.1MediumOct 28, 2026go github.com/labstack/echo/v5 XSSCVE-2026-118652### Summary The `Context.JSONP`, `Context.JSONPBlob`, and internal `jsonPBlob` helper in `context.go` directly concatenate the caller-supplied `callback` parameter into a JavaScript response **without any validation, escaping, or allow-listing**. This creates a high-impact **reflected XSS** that can be triggered by any route passing attacker-controlled data (query string, form, header, path param, etc.) into the callback. **Present in current master and v5.1.0 (latest release).** ### Vulne
• 5.3MediumOct 28, 2026go github.com/labstack/echo/v5 Auth bypass / access controlCVE-2026-118653## Summary When `echo.New()` is used without explicitly setting `Echo#IPExtractor`, the `RealIP()` method falls back to reading the client-supplied `X-Forwarded-For` (or `X-Real-IP`) header without any proxy-origin validation. The default `RateLimiter()` middleware derives its per-client identifier from `ctx.RealIP()`, so an attacker can rotate arbitrary values in the `X-Forwarded-For` header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. ## Affect
• 5.3MediumOct 28, 2026go github.com/labstack/echo/v5 CSRFCVE-2026-118266## Summary The `MethodOverride` middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When `MethodOverride` is registered before `CSRF` in the post-routing middleware chain (`e.Use()`), it rewrites the request method to a safe method before `CSRF` evaluates it. The CSRF middleware then skips token validation for the now-safe method, allowing state-changing POST handlers to execute without any C
• 5.3MediumOct 28, 2026go github.com/labstack/echo/v5 Auth bypass / access controlCVE-2026-118651## Summary The Echo proxy middleware (`middleware/proxy.go`) preserves an incoming `X-Real-IP` header verbatim and forwards it to the upstream service when `Echo#IPExtractor` is not configured — which is the default. Because any HTTP client can supply an arbitrary `X-Real-IP` value, an attacker can cause Echo to relay a spoofed client IP address to every upstream service behind the proxy, undermining upstream IP-based access controls, rate limiting, audit logging, and geo-restriction. ## Affec
• 2.5LowOct 28, 2026go github.com/caddyserver/caddy/v2CVE-2026-55458### AI Disclosure This vulnerability was discovered via deepseek-v4-pro[1m] for finding potential vulnerabilities / inconsistencies in the code base. I made the AI check if Caddy is compliant with various RFCs, incl. 7230. I also used it to help write the PoC, since it was honestly much faster than writing it by hand. I also let it write parts of this advisory text for brevity's sake, but had to rewrite half of it by hand. ### Summary Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop h
• 8.0HighOct 27, 2026go github.com/ctfer-io/terraform-provider-ctfdCVE-2026-116683### Impact CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or remote attacker, who can have access to the Terraform state, can read team passwords without the need for the state password for decryption. ### Patches Patched in v2.8.2. ### Workarounds No workaround exist, yet CTFer.io recommends you keep your state in safe environments with a limited set of users who can access it as a good practice to avoid exploitation of this vulner
• 4.9MediumOct 27, 2026go github.com/siyuan-note/siyuan/kernel Auth bypass / access controlCVE-2026-60083## Summary `kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its sensitive-path blocklist is meant to align with the HTTP file API's established blacklist (`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8 ("Unauthenticated Administrator takeover exfiltrated via the MCP"), which specifically recommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the 4 static blocklist entries the HTTP
• 8.0HighOct 27, 2026go github.com/wailsapp/wails/v2CVE-2026-34157# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | **Product** | wailsapp/wails (v2) | | **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` | | **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) | | **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` | | **CWE** | CWE-625: Permissive Regular Expression | | **Platforms** | Windows /
• 4.8MediumOct 23, 2026github.com/go-chi/chi/v5 Auth bypass / access controlCVE-2026-114437### Summary `ClientIPFromXFF` skips any `X-Forwarded-For` entry in a configured trusted CIDR but never verifies that the direct TCP peer in `http.Request.RemoteAddr` belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by `middleware.GetClientIP`. The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions an
• 5.3MediumOct 23, 2026go github.com/labstack/echo/v5ISSUE-GHSAh53frm2ww7rg## Impact In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options. Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Expl
• 8.0HighOct 23, 2026go github.com/labstack/echo/v4 Denial of serviceISSUE-GHSA9969667649h5## Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the prox
• 8.0HighOct 23, 2026go github.com/labstack/echo/v4 Denial of serviceISSUE-GHSAh7wr284f5qvc## Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service. The middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already app
• 9.5CriticalOct 23, 2026go github.com/labstack/echo/v4 Auth bypass / access controlISSUE-GHSAcxf39h377rr8## Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only at Echo's routes. Exploitation
• 5.5MediumOct 23, 2026go github.com/labstack/echo/v5ISSUE-GHSAx9ff22gv65f4## Impact Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded. The handler could consequently process a truncated request and return success even though the original body
• 8.0HighOct 23, 2026go github.com/labstack/echo/v4 Denial of serviceISSUE-GHSAf48pc9v4h7xv## Impact Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation. Repeated or concurrent requests can exhaust process memory and cause denial of se
• 6.6MediumOct 23, 2026go github.com/siyuan-note/siyuan/kernel Auth bypass / access controlCVE-2026-62204## Summary `installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept `packageName`, `repoURL`, and `repoHash` as independent request fields with no validation that they refer to the same package. `packageName` alone determines the install destination; `repoURL`/`repoHash` alone determine what content gets downloaded and written there. A request can name an already-installed, already-enabled plugin as `packageName` while pointing `repoURL`/ `repoHash` at diff
• 7.5HighOct 23, 2026go github.com/siyuan-note/siyuan/kernel Auth bypass / access controlCVE-2026-73054### Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity. The result is that an unauthenticated remote caller connects to the kernel WebSocket
• 5.8MediumOct 23, 2026go github.com/siyuan-note/siyuan/kernel Information disclosureCVE-2026-73630### Summary `/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier. Sepa
• 5.8MediumOct 23, 2026go github.com/siyuan-note/siyuan/kernel Auth bypass / access controlCVE-2026-73049### Summary `/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that
• 5.8MediumOct 23, 2026go github.com/siyuan-note/siyuan/kernel Auth bypass / access controlISSUE-GHSAxp3qr38wvgqm### Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit `63c7d5474` resolved it by removing `FilterUILayoutByPublishIgnore` and nulling `Conf.UILayout` for readers. That fix is correct and complete for the live layout. This report concerns a different endpoint, a different filter function and a different storage backing. `/api/storage/getLocalStorage` reads `data/storage/local.json` rather than `Conf.UILayout`, and its filter `FilterLocalS

See every go entry on the dashboard.

Top products

• github.com/labstack/echo/v510 CVEs in the last year
• github.com/siyuan-note/siyuan/kernel6 CVEs in the last year
• github.com/labstack/echo/v44 CVEs in the last year, 1 critical
• knative.dev/pkg1 CVE in the last year
• github.com/wailsapp/wails/v21 CVE in the last year
• github.com/go-chi/chi/v51 CVE in the last year
• github.com/daptin/daptin1 CVE in the last year
• github.com/ctfer-io/terraform-provider-ctfd1 CVE in the last year
• github.com/cert-manager/cert-manager1 CVE in the last year
• github.com/caddyserver/caddy/v21 CVE in the last year