Security
فارسی
All products

github.com/xyproto/algernon

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filenameCVE-2026-52792 · GHSA-MM6C-5J6X-HQ8MVersion ranges need review. github.com/xyproto/algernon Go High Fix reported
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirCVE-2026-48126 · GHSA-JC3J-X6PG-4HMVVersion ranges need review. github.com/xyproto/algernon Go High Fix reported
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOSCVE-2026-46430 · GHSA-GJ84-924C-48FXVersion ranges need review. github.com/xyproto/algernon Go Medium Fix reported
Algernon: handler.lua discovery walks parent directories above the server rootCVE-2026-45721 · GHSA-XWCR-WM99-G9JCVersion ranges need review. github.com/xyproto/algernon Go Critical Fix reported
Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *CVE-2026-46431 · GHSA-HW27-4V2Q-5QFFVersion ranges need review. github.com/xyproto/algernon Go Medium Fix reported
Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authenticationGHSA-9V4J-7G44-QCQW · GO-2026-5300Version ranges need review. github.com/xyproto/algernon Go Medium Fix reported
Algernon: Single-file mode unconditionally enables debug modeCVE-2026-45728 · GHSA-FWQX-8365-9983Version ranges need review. github.com/xyproto/algernon Go High Fix reported
Algernon Cross-Site Scripting vulnerabilityCVE-2025-65754 · GHSA-8JQM-8QM3-QGQMVersion ranges need review. github.com/xyproto/algernon Go Medium Fix reported
Algernon engine and themes vulnerable to Cross-site ScriptingCVE-2023-26131 · GHSA-G47H-FGCW-G4PH github.com/xyproto/algernon Go Medium No fix reported