Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-X845-2F78-7V36Highgithub.com/0xERR0R/blocky: Blocky DNSSEC validation bypass and validation-cache scope pollutionCVE-2026-53492Highgithub.com/containerd/containerd/v2: containerd CRI checkpoint restore CDI annotation smugglingCVE-2026-53489Highgithub.com/containerd/containerd/v2: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreCVE-2026-53488Highgithub.com/containerd/containerd: containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pullCVE-2026-50195Mediumgithub.com/containerd/containerd/v2: containerd: CRI checkpoint import allows local image tag poisoningCVE-2026-47262Mediumgithub.com/containerd/containerd/v2: containerd image-triggered runtime DoS via unbounded group parsingGHSA-R46F-3RPW-HXRVHighgithub.com/gohugoio/hugo: Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)GHSA-C3WQ-J5VH-68RCMediumgithub.com/gohugoio/hugo: Hugo: Symlink confinement bypass in os.ReadFileGHSA-Q76J-GCG9-VXC6Mediumgithub.com/gohugoio/hugo: Hugo: XSS via unescaped code-fence language in default code block rendererGHSA-Q7J3-V8QV-22VQHighgithub.com/opentofu/opentofu: OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URLGHSA-2H46-9X5W-4WF7Mediumgithub.com/entireio/cli: Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindCVE-2026-55689Mediumgithub.com/openfga/openfga: OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetCVE-2026-55884Criticalgithub.com/tilt-dev/tilt: Tilt: Missing authentication on the network-exposed Tilt HUD serverCVE-2026-55883Highgithub.com/tilt-dev/tilt: Tilt: Cross-site WebSocket hijacking of the Tilt HUD streamCVE-2026-55882Highgithub.com/tilt-dev/tilt: Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD serverCVE-2026-10720Mediumgithub.com/canonical/microceph/microceph: Canonical MicroCeph: path traversal issue in the remote-import APCVE-2026-54319Mediumgithub.com/daytonaio/daytona: Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escapeCVE-2026-11719Highgithub.com/googleapis/mcp-toolbox: MCP Toolbox for Databases: authenticated authorization bypassCVE-2026-11718Criticalgithub.com/googleapis/mcp-toolbox: googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)CVE-2026-11717Criticalgithub.com/googleapis/mcp-toolbox: googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)CVE-2026-55170Lowgithub.com/openfga/openfga: OpenFGA Improper Policy EnforcementCVE-2026-55701Mediumgithub.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver: opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authenticationCVE-2026-47256Mediumgithub.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged…CVE-2026-55686Mediumgithub.com/containers/podman/v5: Podman: WORKDIR symlink traversal vulnerabilityCVE-2026-57209Highgithub.com/dadrus/heimdall: Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo