Skip to content
OpenAdvisories

Vendor

xyproto

8 known vulnerabilities.

Products

algernon 8
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-46431

    Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not s…

    xyproto algernon github.com/xyproto/algernon Go
  • Medium 4.3
    CVE-2026-46430

    Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHost…

    xyproto algernon github.com/xyproto/algernon Go