Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-MMPX-JH39-WRV6Mediumgithub.com/gtsteffaniak/filebrowser: FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)CVE-2026-44542Criticalgithub.com/gtsteffaniak/filebrowser: FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion CVE-2026-44283Lowgo.etcd.io/etcd/v3: etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests CVE-2026-44426Mediumgithub.com/shellhub-io/shellhub: ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check GHSA-258C-965C-P3HCMediumgithub.com/daptin/daptin: Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change GHSA-M38G-VWW2-MVGXHighgithub.com/siderolabs/talos: Talos Linux has a local privilege escalation from untrusted workloads CVE-2026-44514Mediumgithub.com/kubetail-org/kubetail/modules/dashboard: Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users CVE-2026-42459Highgithub.com/free5gc/udm: Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information CVE-2026-42328Mediumgithub.com/ipld/go-ipld-prime: go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth CVE-2026-42083Highgithub.com/free5gc/pcf: Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI CVE-2026-42880Criticalgithub.com/argoproj/argo-cd/v3: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVE-2026-42082Lowgithub.com/free5gc/amf: Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover CVE-2026-42081Mediumgithub.com/free5gc/amf: Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest CVE-2026-44503Highcom.microsoft.kiota:microsoft-kiota-abstractions: Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-41050Criticalgithub.com/rancher/fleet: Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVE-2026-25705Highgithub.com/rancher/rancher: Rancher Extensions have arbitrary file access via path traversal GHSA-FC67-C4HG-Q653Highgithub.com/aws/amazon-ecs-agent: Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure CVE-2026-42597Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme CVE-2026-42596Criticalgithub.com/gotenberg/gotenberg/v8: Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42594Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine CVE-2026-42593Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes CVE-2026-42592Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes CVE-2026-42591Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has a Server-Side Request Forgery (SSRF) Issue CVE-2026-42590Highgithub.com/gotenberg/gotenberg/v8: Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist CVE-2026-42589Criticalgithub.com/gotenberg/gotenberg/v8: Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo