Perses CVE-2026-63458

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there

Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by

Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and

Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa

Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash

Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker

Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r

Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and

Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only