Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-42297Highgithub.com/argoproj/argo-workflows/v4: Argo has Missing Authorization in its Sync ConfigMap Provider CVE-2026-41685Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus is affected by unbounded binary import disk exhaustion CVE-2026-41684Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Nil Dereferences on Restore via Malformed YAML CVE-2026-41648Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Unbounded YAML Metadata Decode via Parsing CVE-2026-41647Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Nil-Pointer Dereference via S3 Bucket Import CVE-2026-41326Highgithub.com/kata-containers/kata-containers: Kata Container has CopyFile Policy Subversion via Symlinks CVE-2026-41181Mediumgithub.com/traefik/traefik/v2: Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service CVE-2026-40893Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move CVE-2026-40251Highgithub.com/lxc/incus/v6/cmd/incusd: Incus Vulnerable to Panic via Snapshot Bounds Check CVE-2026-40243Lowgithub.com/lxc/incus/v6/cmd/incusd: Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots CVE-2026-37461Highgithub.com/osrg/gobgp/v4: GoBGP has an out-of-bounds read in the ParseIP6Extended function CVE-2026-40197Highgithub.com/lxc/incus/v6/cmd/incusd: Incus has a Nil-Pointer Dereference via Custom Volume Import CVE-2026-40195Highgithub.com/lxc/incus/v6/cmd/incusd: Incus has a Nil-Pointer Dereference Panic via Bucket Metadata CVE-2026-35527Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Blind SSRF via Image Import Preflight HEAD CVE-2026-7482Highgithub.com/ollama/ollama: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader CVE-2026-7736Mediumgithub.com/osrg/gobgp/v4: GoBGP has an Integer Underflow Issue CVE-2026-7737Mediumgithub.com/osrg/gobgp: GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-7734Mediumgithub.com/osrg/gobgp/v4: GoBGP has an Improper Resource Shutdown or Release GHSA-RH99-WC69-C255Highgithub.com/edgelesssys/contrast: Contras Affected by CopyFile Policy Subversion via Symlinks CVE-2026-42461Highgithub.com/getarcaneapp/arcane/backend: Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CVE-2026-42560Criticalgithub.com/go-pkgz/auth: auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation GHSA-28XX-PPPM-VQFFLowgithub.com/ydb-platform/ydb-go-sdk/v3: ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction CVE-2026-40281Criticalgithub.com/gotenberg/gotenberg/v8: Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)CVE-2026-39383Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL CVE-2026-40280Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo