Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63405Mediumgithub.com/anycable/anycable: AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary BodyCVE-2026-58197Highgithub.com/stacklok/toolhive: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movementCVE-2026-61682Criticalgithub.com/kcp-dev/kcp: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and…CVE-2026-61833Highzotregistry.dev/zot/v2: zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionCVE-2026-61795Mediumgithub.com/projectcapsule/capsule: Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook…CVE-2026-61672Highgithub.com/projectcapsule/capsule: Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcementCVE-2026-61794Mediumgithub.com/projectcapsule/capsule: Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panicCVE-2026-77281Mediumgithub.com/caddyserver/caddy/v2: Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypassCVE-2026-86003Highgithub.com/coredns/coredns: CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCPCVE-2026-82399Highgithub.com/coredns/coredns: CoreDNS: Unauthenticated memory exhaustion in custom transportsCVE-2026-81871Mediumgo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81870Lowgo.opentelemetry.io/otel/sdk: OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsCVE-2026-85732Mediumoras.land/oras-go/v2: oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probingCVE-2026-85731Highoras.land/oras-go/v2: oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)CVE-2026-86043Highgithub.com/zalando/skipper: Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)CVE-2026-77412Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP ClientCVE-2026-77411Criticalgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrCVE-2026-77410Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationCVE-2026-77408Criticalgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer OverflowCVE-2026-77407Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct FieldsCVE-2026-77406Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos ConfigurationCVE-2026-77405Criticalgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI ParserCVE-2026-77404Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter InjectionCVE-2026-77403Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationCVE-2026-82410Highgithub.com/pocketbase/pocketbase: Pocketbase: Unhandled panic in worker goroutines

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo