pwned.coffeeUpdated 6 min ago

The menu

Go

Major outage

1 live incident affecting Go, 1 critical, 1 not fully patched.

Today's specials

  1. criticalpartial fix Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go) Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD… fixed in github.com/argoproj/argo-cd/v3 3.3.15 +3CVE-2026-774595 sources

4 spills in 2026 for Go

Week of 21 Sept 2026: 1 newWeek of 28 Sept 2026: 1 newWeek of 5 Oct 2026: 1 newWeek of 12 Oct 2026: 1 new
Worst week: 21 Sept 2026, 1 new spill.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite github.com/0xJacky/Nginx-UI (go) An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2(523) 6c86e5a5 in the local Docker container uozi/nginx-ui:latest. ##… fixed in github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591CVE-2026-1078065 sources
  2. criticalpatched gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled gitea.com/gitea/runner (go) act_runner appends workflow-controlled jobs.<job>.container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A… fixed in gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022CVE-2026-738024 sources
  3. criticalpartial fix ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0CVE-2026-616045 sources

More in Web & runtimes

Follow Go

RSS: /feed.xml?stack=go. JSON: /incidents.json?stack=go. Or add it to your usual for delivery.