Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-118652Mediumgithub.com/labstack/echo/v5: Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118653Mediumgithub.com/labstack/echo/v5: Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118266Mediumgithub.com/labstack/echo/v5: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118651Mediumgithub.com/labstack/echo/v5: Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-55458Lowgithub.com/caddyserver/caddy/v2: Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through CVE-2026-116679Mediumgithub.com/m1k1o/neko/server: Neko: Authorization bypass in legacy WebRTC input handling CVE-2026-116676Highgithub.com/runatlantis/atlantis: Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan CVE-2026-116682Highgithub.com/gtsteffaniak/filebrowser/backend: FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory CVE-2026-116587Highgithub.com/go-jose/go-jose/v4: Go JOSE: DoS when parsing JWKs that contain RSA keys CVE-2026-116683Highgithub.com/ctfer-io/terraform-provider-ctfd: CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values CVE-2026-116591Highgithub.com/klauspost/compress/zstd: compress zstd: Panic on two-block frames CVE-2026-60083Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and…CVE-2026-34157Highgithub.com/wailsapp/wails/v2: Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins CVE-2026-114437Mediumgithub.com/go-chi/chi/v5: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For CVE-2026-118265Mediumgithub.com/labstack/echo/v5: Echo: X-Real-IP extractor trusts the header value instead of the sending peer CVE-2026-118262Highgithub.com/labstack/echo/v4: Echo: WebSocket proxy can retain connections and handlers after client disconnect CVE-2026-118261Highgithub.com/labstack/echo/v4: Echo: Decompress permits unbounded gzip expansion in v4 CVE-2026-118264Criticalgithub.com/labstack/echo/v4: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls CVE-2026-118263Mediumgithub.com/labstack/echo/v5: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests CVE-2026-118260Highgithub.com/labstack/echo/v4: Echo: BodyDump captures request and response bodies without size limits in v4 CVE-2026-62204Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing,…CVE-2026-73054Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the…CVE-2026-73630Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth…CVE-2026-73049Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier…GHSA-XP3Q-R38W-VGQMMediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo