Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-42127Highgithub.com/grafana/grafana: Grafana: Pre-authentication denial of service in the public dashboard query handlerCVE-2026-8823Lowgithub.com/mattermost/mattermost-server: Mattermost has an Incorrect Authorization issueCVE-2026-25119Highgogs.io/gogs: Gogs has an Authentication Bypass via Unvalidated Reverse Proxy HeadersCVE-2025-64719Mediumgogs.io/gogs: Gogs has a Denial of Service in repository/wiki file listing web pagesCVE-2026-8074Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce bot-specific permission checks on the user active status endpointCVE-2026-9029Highgithub.com/grafana/grafana: Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bugCVE-2026-9162Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocationCVE-2026-6062Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate channel ownership of an existing subscription before applying editsCVE-2026-6673Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue…CVE-2026-5139Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handlerCVE-2026-42129Highgithub.com/grafana/grafana: Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.CVE-2026-10601Mediumgithub.com/grafana/grafana: Grafana: Path traversal in the Tempo and Loki data source pluginsGHSA-6VXV-WG6J-5QWPHighgogs.io/gogs: Gogs: XSS in .ipynb files renderer due to outdated notebookjsCVE-2026-55866Lowgithub.com/authzed/spicedb: SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expectedCVE-2026-55776Mediumgithub.com/openbao/openbao: OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesCVE-2026-55775Lowgithub.com/openbao/openbao: OpenBao's System Backend allows Unauthorized Management of the containing NamespaceCVE-2026-55774Lowgithub.com/openbao/openbao: OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808CVE-2026-55770Mediumgithub.com/openbao/openbao: OpenBao: LDAPi ldaputil (wrong escape func)CVE-2026-27878Mediumgithub.com/grafana/tempo: Grafana Tempo vulnerable to an out-of-memory crashCVE-2026-55187Mediumgithub.com/axllent/mailpit: Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanismsCVE-2026-55185Mediumminiflux.app/v2: Open Redirect Bypass in miniflux-v2CVE-2026-54762Mediumgithub.com/traefik/traefik/v3: Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution failsCVE-2026-55828Mediumgo.qbee.io/transport: go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)CVE-2026-11769Mediumgithub.com/grafana/grafana-operator/v5: Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileNameGHSA-WFQX-GJRF-G28RCriticalgithub.com/crossplane/crossplane/v2: Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo