Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54719Highgithub.com/patrickhener/goshs: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)CVE-2026-62325Criticalgithub.com/patrickhener/goshs/v2: goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)CVE-2026-49446Mediumgithub.com/azukaar/cosmos-server: Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnelCVE-2026-49447Mediumgithub.com/azukaar/cosmos-server: Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokensCVE-2026-50568Lowgithub.com/fission/fission: Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escapeCVE-2026-50567Highgithub.com/fission/fission: Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directoryCVE-2026-50569Mediumgithub.com/fission/fission: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checksCVE-2026-50570Highgithub.com/fission/fission: Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node…CVE-2026-54332Mediumgithub.com/gopacket/gopacket: GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) ->…CVE-2026-54345Mediumgithub.com/gopacket/gopacket: GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)CVE-2026-54593Highpterodactyl/panel: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsCVE-2026-47427Highgithub.com/github/github-mcp-server: GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete HandlerGHSA-HP74-GM6M-2QM5Mediumgithub.com/pocket-id/pocket-id/backend: Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that…CVE-2026-43983Highgithub.com/pocket-id/pocket-id/backend: Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsCVE-2026-43871Highthrift: Apache Thrift Python, Go, PHP and Java bindings have an Infinite LoopCVE-2026-73500Highgo.etcd.io/etcd/v3: etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineCVE-2026-73502Mediumgithub.com/getkin/kin-openapi: kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has…CVE-2026-73499Highgo.etcd.io/etcd/v3: etcd: Watch API authorization bypass via open-ended range requestsCVE-2026-73505Highgithub.com/jandedobbeleer/oh-my-posh: Oh My Posh: Arbitrary command execution via template injection in the path segmentCVE-2026-73506Mediumgithub.com/jandedobbeleer/oh-my-posh: Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment dataCVE-2026-69160Mediumgithub.com/OpenListTeam/OpenList/v4: OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation APIGHSA-P6PH-3JX2-3337Mediumgithub.com/OpenListTeam/OpenList/v4: OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchCVE-2026-73509Highgithub.com/OpenListTeam/OpenList/v4: OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversalGHSA-V6W6-358X-2433Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requestsCVE-2026-73564Highgithub.com/fatedier/frp: frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo