Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63132Criticalgithub.com/openbao/openbao: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackCVE-2026-71543Highgithub.com/openbao/openbao: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersCVE-2026-77285Lowgithub.com/openbao/openbao: OpenBao Agent Writes Secrets to StdoutCVE-2026-62182Highgithub.com/kubeedge/kubeedge: KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodesCVE-2026-77322Highgithub.com/emiago/sipgo: SIPGO: DoS via unvalidated WebSocket frame lengthCVE-2026-62987Mediumgithub.com/fabiolb/fabio: Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection…CVE-2026-63342Mediumgithub.com/hatchet-dev/hatchet: Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckCVE-2026-61681Mediumgithub.com/hatchet-dev/hatchet: Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerCVE-2026-58268Highgithub.com/emiago/sipgo: SIPGO: DoS via unvalidated Content-Length in the stream parserCVE-2026-62866Mediumgithub.com/tomwright/dasel/v3: Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`CVE-2026-59168Mediumgithub.com/tomwright/dasel/v3: Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSCVE-2026-61628Highgithub.com/lucasdillmann/nginx-ignition: nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionCVE-2026-61629Highgithub.com/lucasdillmann/nginx-ignition: nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in…CVE-2026-61630Mediumgithub.com/lucasdillmann/nginx-ignition: nginx ignition has TOTP Reuse During Validity WindowGHSA-JHJP-4C2Q-XMX4Mediumgithub.com/falcosecurity/plugins/plugins/k8saudit: k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containersCVE-2026-61687Highgithub.com/hatchet-dev/hatchet: Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStateGHSA-JGH3-FGGC-MCPMHighgithub.com/obot-platform/obot: Obot: Server-Side Request Forgery via remote MCP server URLGHSA-PR6H-VR44-XQ8JMediumgithub.com/obot-platform/obot: Obot: MCP Registry API readable without authenticationGHSA-XWMW-PRC4-V3CRHighgithub.com/obot-platform/obot: Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience ConfusionCVE-2026-63445Highgithub.com/perses/perses: Perses's unvalidated project parameter enables filesystem path traversalCVE-2026-63199Highgithub.com/perses/perses: Perses's missing authorization in datasource proxy allows cross-scope secret disclosureCVE-2026-63458Highgithub.com/perses/perses: Perses's project query parameter authorization bypass exposes cross-project resourcesCVE-2026-77339Mediumgithub.com/f1bonacc1/process-compose: Process Compose: Browser DNS rebinding lets websites control local process-compose MCP toolsCVE-2026-81505Highgithub.com/frain-dev/convoy: Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker CredentialsCVE-2026-63406Mediumgithub.com/anycable/anycable: AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo