Go to main page
Versions in this module
v1
Jul 4, 2026
May 29, 2026
May 24, 2026 GO-2026-5903
GO-2026-5903: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
May 12, 2026 GO-2026-5460 +1 more
GO-2026-5460: Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
GO-2026-5903: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Apr 25, 2026 GO-2026-5300 +6 more
GO-2026-5300: Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon
GO-2026-5385: Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon
GO-2026-5401: Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
GO-2026-5440: Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon
GO-2026-5460: Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
GO-2026-5772: Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
GO-2026-5903: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Changes in this version
Nov 13, 2025 GO-2026-5300 +6 more
GO-2026-5300: Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon
GO-2026-5385: Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon
GO-2026-5401: Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
GO-2026-5440: Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon
GO-2026-5460: Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
GO-2026-5772: Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
GO-2026-5903: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Aug 7, 2025 GO-2025-4228 +7 more
GO-2025-4228: Algernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon
GO-2026-5300: Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon
GO-2026-5385: Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon
GO-2026-5401: Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
GO-2026-5440: Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon
GO-2026-5460: Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
GO-2026-5772: Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
GO-2026-5903: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Feb 26, 2025 GO-2025-4228 +7 more
GO-2025-4228: Algernon Cross-Site Scripting vulnerability in github.com/xyproto/algernon
GO-2026-5300: Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon
GO-2026-5385: Algernon: Single-file mode unconditionally enables debug mode in github.com/xyproto/algernon
GO-2026-5401: Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon
GO-2026-5440: Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * in github.com/xyproto/algernon
GO-2026-5460: Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir in github.com/xyproto/algernon
GO-2026-5772: Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
GO-2026-5903: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon
Changes in this version