Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-57210Highhttps://github.com/dadrus/heimdall: Heimdall: IP Spoofing via Unvalidated Forwarding HeadersCVE-2026-55669Mediumgithub.com/zitadel/zitadel: ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP ProviderCVE-2026-56664Mediumgithub.com/zitadel/zitadel: ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderCVE-2026-55672Highgithub.com/zitadel/zitadel: ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)CVE-2026-55670Lowgithub.com/zitadel/zitadel: ZITADEL: Cross-Tenant User Leakage via Recycled IdentifiersCVE-2026-55887Highgithub.com/docker/mcp-gateway: Docker MCP Gateway: Argument injection via OCI image label YAMLCVE-2026-55229Highgithub.com/gotenberg/gotenberg/v8: Gotenberg: SSRF via LibreOffice document processingCVE-2026-55671Lowgithub.com/zitadel/zitadel: ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP ComponentsCVE-2026-55636Mediumgithub.com/projectcapsule/capsule: Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotectedCVE-2026-25779Mediumgithub.com/go-gitea/gitea: Gitea: Open Redirect via redirect_toCVE-2026-28737Highcode.gitea.io/gitea: Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File ViewerCVE-2026-24791Highcode.gitea.io/gitea: Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesCVE-2026-22555Highcode.gitea.io/gitea: Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret ExfiltrationCVE-2026-54324Mediumgithub.com/daytonaio/daytona: Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId joinCVE-2026-54761Mediumgithub.com/traefik/traefik/v3: Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik servicesCVE-2026-20706Mediumcode.gitea.io/gitea: Gitea: Token scope bypass on web archive download endpointCVE-2026-27783Mediumcode.gitea.io/gitea: Gitea: Missing repository-unit authorization on issue-template API endpointsCVE-2026-25714Mediumcode.gitea.io/gitea: Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flawCVE-2026-26231Highcode.gitea.io/gitea: Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repoCVE-2026-28699Highcode.gitea.io/gitea: Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authenticationCVE-2026-52797Highgogs.io/gogs: Gogs: Overwriting critical files results in a denial of serviceCVE-2026-49980Criticalgithub.com/rclone/rclone: Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixCVE-2026-28744Highcode.gitea.io/gitea: Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer TokensCVE-2026-54322Highgithub.com/daytonaio/daytona: Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's rolesCVE-2026-52846Mediumgithub.com/caddyserver/caddy/v2: Caddy: stripHTML template function bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo