Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55098Mediumgithub.com/basekick-labs/arc: Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735CVE-2026-62331Highgithub.com/mtzanidakis/praktor: praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction…GHSA-9PPR-WFW9-XVR2Mediumgithub.com/tinfoil-factory/netfoil: Netfoil doesn't decrement TTLGHSA-M3QR-FVP4-78XJLowgithub.com/basekick-labs/arc: Arc has unauthenticated application log disclosure via `/api/v1/logs`CVE-2026-118761Highgithub.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryCVE-2026-118759Highgithub.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsCVE-2026-119285Mediumgithub.com/gofiber/fiber/v2: Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGHSA-HFF9-5PQW-6W9FCriticalgithub.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGHSA-494M-4556-WF5PHighgithub.com/imgproxy/imgproxy/v3: imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashGHSA-MMQ5-XM89-9PFGHighgithub.com/imgproxy/imgproxy/v3: imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldGHSA-2WRX-84QJ-4PCGMediumgithub.com/anacrolix/torrent: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSGHSA-F3FJ-9625-RV3MMediumgithub.com/charmbracelet/soft-serve: charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGHSA-FGXM-5HVV-X4VHMediumgithub.com/charmbracelet/soft-serve: charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesCVE-2026-62290Highgithub.com/cert-manager/cert-manager: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialsCVE-2026-62160Highgithub.com/daptin/daptin: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGHSA-2HW4-C9M4-F2FJMediumknative.dev/pkg: knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-116586Mediumgithub.com/go-jose/go-jose/v4: Go JOSE: Panics in JSON parsingCVE-2026-116585Mediumgithub.com/go-jose/go-jose/v4: Go JOSE: Panic during CBC-HMAC processingCVE-2026-118657Mediumgithub.com/labstack/echo/v5: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersCVE-2026-118654Mediumgithub.com/labstack/echo/v5: Echo static file middleware route protection bypass via encoded dot-dot traversalCVE-2026-118655Mediumgithub.com/labstack/echo/v5: Echo has a Static Middleware Double-Unescape Path TraversalCVE-2026-118656Mediumgithub.com/labstack/echo/v5: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURICVE-2026-118658Mediumgithub.com/labstack/echo/v5: Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoCVE-2026-118650Highgithub.com/labstack/echo/v5: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathCVE-2026-118652Mediumgithub.com/labstack/echo/v5: Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo