Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-113727Highgithub.com/openchoreo/openchoreo: OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsCVE-2026-113729Highgithub.com/moov-io/signedxml: Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationCVE-2026-63209Highgithub.com/klauspost/compress: Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressGHSA-953H-535J-JG2VMediumgithub.com/envoyproxy/ai-gateway: agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeableCVE-2026-96627Highgithub.com/getarcaneapp/arcane/backend/v2: Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)CVE-2026-96628Mediumgithub.com/getarcaneapp/arcane/backend/v2: Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`CVE-2026-100349Highgithub.com/getkin/kin-openapi: kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentCVE-2026-62994Lowgithub.com/coredns/coredns: CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginCVE-2026-102941Highgithub.com/gomarkdown/markdown: gomarkdown/markdown IsSafeURL panics on short URLsCVE-2026-94603Criticalgo.podman.io/podman/v6: Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationCVE-2026-103028Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo source-side file-pattern filter bypass during copy operationsCVE-2026-95838Mediumgithub.com/containerd/containerd/v2: containerd: Unpack DoS via repeated opaque whiteoutsCVE-2026-85747Mediumgithub.com/docker/distribution: Distribution: Client `manifests.Get()` does not verify returned content against requested digestCVE-2026-95837Highgithub.com/containerd/containerd/v2: containerd CRI plugin: Checkpoint restore bypasses destination security contextCVE-2026-100353Highgithub.com/getkin/kin-openapi: kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterCVE-2026-100354Highgithub.com/getkin/kin-openapi: kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process CrashCVE-2026-100352Highgithub.com/getkin/kin-openapi: kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathCVE-2026-77564Lowgithub.com/siderolabs/talos: Talos Linux: Support bundle does not redact registry credentialsCVE-2026-77524Criticalgithub.com/kedacore/keda: KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationCVE-2026-77459Criticalgithub.com/argoproj/argo-cd/v2: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksCVE-2026-100351Highgithub.com/getkin/kin-openapi: kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionCVE-2026-100350Mediumgithub.com/getkin/kin-openapi: kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressionCVE-2026-102748Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of ServiceCVE-2026-104252Criticalvitess.io/vitess: Vitess vttablet /twopcz reflected XSSCVE-2026-100348Mediumgithub.com/getkin/kin-openapi: kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo