bufanyun HotGo

• CVE-2026-120447 High 8.1 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code 0.5%
• CVE-2026-5253 Low 3.5 bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting 0.2%
• CVE-2026-3683 Medium 6.3 bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery 0.2%