Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49445Criticalgithub.com/cilium/cilium: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket accessCVE-2026-27779Highcode.gitea.io/gitea: Gitea forwarded-proto validation allows canonical URL spoofingCVE-2026-27780Criticalcode.gitea.io/gitea: Gitea pre-receive hook scanner errors allow branch-protection bypassCVE-2026-28705Mediumcode.gitea.io/gitea: Gitea release asset dumps permit path traversal through crafted namesCVE-2026-27660Highcode.gitea.io/gitea: Gitea draft releases and attachments are exposed without write permissionCVE-2026-26307Highcode.gitea.io/gitea: Gitea git grep searches allow server resource exhaustionCVE-2026-25782Mediumcode.gitea.io/gitea: Gitea tracked-time deletion is not scoped to the requested issueCVE-2026-25718Criticalcode.gitea.io/gitea: Gitea template repository generation follows unsafe filesystem pathsCVE-2026-25712Highcode.gitea.io/gitea: Gitea organization permission APIs expose hidden membership and private organization dataCVE-2026-24690Highcode.gitea.io/gitea: Gitea pull request branch permission checks allow unauthorized updates and rebasesCVE-2026-26232Criticalcode.gitea.io/gitea: Gitea OAuth2 authorization codes can be reused after expiryCVE-2026-20909Mediumcode.gitea.io/gitea: Gitea exposes tracked time entries without repository authorizationCVE-2026-27657Highcode.gitea.io/gitea: Gitea primary email ownership bypass allows cross-user email changesCVE-2026-26292Criticalcode.gitea.io/gitea: Gitea LFS mirror operations bypass migration HTTP transport protectionsCVE-2026-26247Criticalcode.gitea.io/gitea: Gitea OAuth2 PKCE S256 verifier bypassCVE-2026-22547Criticalcode.gitea.io/gitea: Gitea repository creation accepts insufficiently validated fieldsCVE-2026-46599Highgolang.org/x/image: golang.org/x/image/tiff has excessive resource consumption in PackBits decompressionCVE-2026-52792Highgithub.com/xyproto/algernon: Algernon vulnerable to server-side script source disclosure on Windows via NTFS filenameCVE-2026-49254Lowd7y.io/dragonfly/v2: Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauthCVE-2026-49245Lowgithub.com/drakkan/sftpgo/v2: SFTPGo has stored XSS via inline parameter on public shares and user file downloadCVE-2026-49244Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo has path confinement bypass in public browsable share partial ZIP downloadCVE-2026-44454Highgithub.com/coder/coder/v2: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consentCVE-2026-50192Mediumgithub.com/kerberos-io/agent/machinery: Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without…CVE-2026-50149Mediumgithub.com/projectcontour/contour: Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate EnabledCVE-2026-45045Mediumgithub.com/gofiber/fiber/v3: GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo