GitHub Advisories (Go)
Printed in Security Desk · github.com
Publishes about 4 a week · last piece Oct 15, 2026
How often
about 4 a week, by the archive: 17 pieces since Sep 17, 2026.
12 weeks agothis week
Latest pieces
- Critical: Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
- Critical: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
- Critical: KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
- Critical: Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- Critical: Vitess vttablet /twopcz reflected XSS
- Critical: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- Critical: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
- Critical: Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
- Critical: Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
- Critical: gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
- Critical: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
- Critical: ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
- Critical: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
- Critical: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
- Critical: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
In these topics
Pick one in My Edition to read it with its neighbors.