pwned.coffeeUpdated 8 min ago

The menu

Go

Major outage

2 live incidents affecting Go, 2 critical, 2 not fully patched.

Today's specials

  1. criticalpartial fix Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go) ### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD… fixed in github.com/argoproj/argo-cd/v3 3.3.15 +3CVE-2026-774595 sources
  2. criticalpartial fix ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and… fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0CVE-2026-616045 sources

4 spills in 2026 for Go

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite github.com/0xJacky/Nginx-UI (go) ## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ##… fixed in github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591CVE-2026-1078065 sources
  2. criticalpatched gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled gitea.com/gitea/runner (go) ### Summary act_runner appends workflow-controlled `jobs.<job>.container.options` directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only `Privileged` is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A… fixed in gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022CVE-2026-738024 sources

More in Web & runtimes

Follow Go

RSS: /feed.xml?stack=go. JSON: /incidents.json?stack=go. Or add it to your usual for delivery.