TI-2026-37902 CVE-2026-52792 · GHSA-mm6c-5j6x-hq8m
Algernon: Server-side script source disclosure on Windows via NTFS filename
Priority HIGH 77
Algernon is a small self-contained pure-Go web server.
xyproto
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
xyproto records in CISA KEVNo xyproto vulnerabilities are listed in CISA KEV.
Records
8 records
TI-2026-35564 CVE-2026-48126 · GHSA-jc3j-x6pg-4hmv
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Priority HIGH 75
Algernon is a small self-contained pure-Go web server.
TI-2026-33460 CVE-2026-45721 · GHSA-xwcr-wm99-g9jc
Algernon: handler.lua discovery walks parent directories above the server root
Priority HIGH 74
Algernon is a small self-contained pure-Go web server.
TI-2026-33466 CVE-2026-45728 · GHSA-fwqx-8365-9983
Algernon: Single-file mode unconditionally enables debug mode
Priority HIGH 72
Algernon is a small self-contained pure-Go web server.
TI-2026-34142 CVE-2026-46431 · GHSA-hw27-4v2q-5qff
Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *
Priority MEDIUM 53
Algernon is a small self-contained pure-Go web server.
TI-2026-34141 CVE-2026-46430 · GHSA-gj84-924c-48fx
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS
Priority MEDIUM 53
Algernon is a small self-contained pure-Go web server.
Priority MEDIUM 44
Algernon is a small self-contained pure-Go web server.
Priority LOW 37
Algernon is a small self-contained pure-Go web server.