Go - OSV

GO-2026-6910

Go/github.com/mattermost/mattermost/server/public

Path traversal in API route construction in... 15 hours ago

Fix available

GO-2026-6917

Go/github.com/canonical/lxd

LXD allows cross-guest volume hijack via DevLXD device patch in... 15 hours ago

Fix available

GO-2026-6888

Go/github.com/andybalholm/brotli

Excessive memory allocation when decompressing crafted streams in... 16 hours ago

Fix available

GO-2026-6893

Go/github.com/google/go-eventlog

Event type spoofing via UntrustedType in github.com/google/go-eventlog 16 hours ago

Fix available

GO-2026-6905

Go/github.com/blakesmith/ar

Panic on negative member size in Reader.Read in github.com/blakesmith/ar 16 hours ago

No fix available

GO-2026-6909

Go/github.com/crewjam/saml

Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in... 16 hours ago

No fix available

GO-2026-6911

Go/github.com/mark3labs/mcp-go

SSRF and credential leak via unvalidated Location header in... 16 hours ago

No fix available

GO-2026-6902

Go/github.com/chainguard-dev/kaniko

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR... 16 hours ago

Fix available

GO-2026-6906

Go/github.com/tinfoil-factory/netfoil

Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoil 16 hours ago

Fix available

GO-2026-6907

Go/github.com/basekick-labs/arc

Arc has unauthenticated application log disclosure via `/api/v1/logs` in... 16 hours ago

Fix available

GO-2026-6908

Go/github.com/mtzanidakis/praktor

praktor: Path traversal in Telegram file uploads allows writing outside the... 16 hours ago

Fix available

GO-2026-6912

Go/kubevirt.io/kubevirt

KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory... 16 hours ago

No fix available

GO-2026-6913

Go/github.com/basekick-labs/arc

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in... 16 hours ago

Fix available

GO-2026-6914

Go/kubevirt.io/kubevirt

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host... 16 hours ago

No fix available

GO-2026-6889

Go/github.com/cert-manager/cert-manager

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver... 16 hours ago

Fix available

GO-2026-6894

Go/github.com/anacrolix/torrent

anacrolix torrent has unbounded recursion in the bencode decoder that causes... 16 hours ago

Fix available

Vulnerabilities