Go Vulnerability Database

• CVE-2026-56854
• Affects: golang.org/x/crypto
• Published: Aug 28, 2026

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

• CVE-2026-42350, GHSA-g7gw-m874-7rmf
• Affects: github.com/akuity/kargo
• Published: Aug 27, 2026
• Unreviewed

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo

• CVE-2026-50891, GHSA-rcqf-cpv9-g5jf
• Affects: github.com/mickael-kerjean/filestash
• Published: Aug 27, 2026
• Unreviewed

Filestash allows attackers to escalate privileges via sending a crafted request in github.com/mickael-kerjean/filestash

• CVE-2026-50884, GHSA-5442-mh7f-72px
• Affects: github.com/statping-ng/statping-ng
• Published: Aug 27, 2026
• Unreviewed

statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng

• CVE-2026-54563, GHSA-w5fv-7x5q-g8qp
• Affects: github.com/cloudreve/Cloudreve, github.com/cloudreve/Cloudreve/v3, and 1 more
• Published: Aug 27, 2026
• Unreviewed

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root in github.com/cloudreve/Cloudreve