Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44332Mediumgithub.com/gofiber/fiber/v3: GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default AuthorizerCVE-2026-50139Mediumgoshs.de/goshs/v2: goshs: Share-link ?token=… redemption races past download limitCVE-2026-50138Highgoshs.de/goshs/v2: goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flagsGHSA-VH4V-2XQ2-G5CGMediumoras.land/oras-go/v2: ORAS Go forwards registry credentials across registry redirectsCVE-2026-50163Highoras.land/oras-go/v2: `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50162Mediumoras.land/oras-go/v2: oras-go has file store write outside workingDir via symlink traversalCVE-2026-50151Highoras.land/oras-go/v2: oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-48978Loworas.land/oras-go/v2: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-41052Criticalgithub.com/rancher/rancher: Rancher has Privilege Escalation from Project Owner to HostCVE-2026-48824Mediumgithub.com/axllent/mailpit: Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release…CVE-2026-41053Highgithub.com/rancher/rancher: Rancher has over-inclusive team membership expansion in GitHub App authentication providerCVE-2026-44935Criticalgithub.com/rancher/fleet: Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerCVE-2026-44936Mediumgithub.com/rancher/fleet: Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlCVE-2026-44939Criticalgithub.com/rancher/rancher: Rancher vulnerable to command injection through unsanitized YAML parameterCVE-2026-44937Highgithub.com/rancher/fleet: Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL ComponentsCVE-2026-44938Highgithub.com/rancher/fleet: Fleet has PSS Bypass through addLabelsFromOptions in Fleet AgentCVE-2026-49998Highgithub.com/centrifugal/centrifugo/v6: Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypassCVE-2026-49826Lowgithub.com/concourse/concourse: Concourse login flow has an open redirect issueGHSA-3CCM-4QQ2-5WRPMediumgithub.com/edgelesssys/contrast: Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertextsGHSA-6C87-G9PW-78FXLowgithub.com/edgelesssys/contrast: Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain…CVE-2026-49835Mediumgithub.com/sigstore/timestamp-authority/v2: Sigstore Timestamp Authority has OOM due to unbounded metric label cardinalityCVE-2026-49478Highgithub.com/sigstore/fulcio: Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token…CVE-2026-49820Mediumgo.probo.inc/probo: Probo has an open redirect bypass via path normalizationCVE-2026-58167Highgithub.com/ccfos/nightingale/v6: Nightingale exposes datasource credentials to low-privilege usersCVE-2026-50566Criticalgithub.com/fission/fission: Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo