MEDIUMGo
GHSA-8jqm-8qm3-qgqm· CVE-2025-65754, GO-2025-4228Algernon Cross-Site Scripting vulnerability
Modified: 12/18/2025
package
Go/github.com/xyproto/algernon
pkg:go/github.com/xyproto/algernon
MEDIUM5.3Go
GHSA-9v4j-7g44-qcqw· GO-2026-5300Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication
Modified: 6/25/2026
HIGH7.5Go
GHSA-fwqx-8365-9983· CVE-2026-45728, GO-2026-5385Algernon: Single-file mode unconditionally enables debug mode
Modified: 6/25/2026
MEDIUM6.1Go
GHSA-g47h-fgcw-g4ph· CVE-2023-26131Algernon engine and themes vulnerable to Cross-site Scripting
Modified: 11/8/2023
MEDIUM4.3Go
GHSA-gj84-924c-48fx· CVE-2026-46430, GO-2026-5401Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS
Modified: 6/25/2026
MEDIUM4.3Go
GHSA-hw27-4v2q-5qff· CVE-2026-46431, GO-2026-5440Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *
Modified: 6/25/2026
HIGH8.2Go
GHSA-jc3j-x6pg-4hmv· CVE-2026-48126, GO-2026-5460Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Modified: 6/25/2026
HIGHGo
GHSA-mm6c-5j6x-hq8m· CVE-2026-52792, GO-2026-5903Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename
Modified: 7/7/2026
CRITICAL9.0Go
GHSA-xwcr-wm99-g9jc· CVE-2026-45721, GO-2026-5772Algernon: handler.lua discovery walks parent directories above the server root
Modified: 6/25/2026
—Go
GO-2025-4228· CVE-2025-65754, GHSA-8jqm-8qm3-qgqmAlgernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon
Modified: 3/3/2026
—Go
GO-2026-5300· GHSA-9v4j-7g44-qcqwAlgernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon
Modified: 6/25/2026
—Go
GO-2026-5385· CVE-2026-45728, GHSA-fwqx-8365-9983Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon
Modified: 6/25/2026
—Go
GO-2026-5401· CVE-2026-46430, GHSA-gj84-924c-48fxAlgernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
Modified: 6/25/2026
—Go
GO-2026-5440· CVE-2026-46431, GHSA-hw27-4v2q-5qffAlgernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon
Modified: 6/25/2026
—Go
GO-2026-5460· CVE-2026-48126, GHSA-jc3j-x6pg-4hmvAlgernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
Modified: 6/25/2026
—Go
GO-2026-5772· CVE-2026-45721, GHSA-xwcr-wm99-g9jcAlgernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
Modified: 6/25/2026
—Go
GO-2026-5903· CVE-2026-52792, GHSA-mm6c-5j6x-hq8mAlgernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Modified: 7/7/2026