Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-52845Highgithub.com/caddyserver/caddy/v2: Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`CVE-2026-52844Highgithub.com/caddyserver/caddy/v2: Caddy: Windows `file_server` path authorization bypass via encoded backslashCVE-2026-54321Highgithub.com/daytonaio/daytona: Daytona: Public sandbox previews remain accessible for up to one hour after being made privateCVE-2026-53622Highgithub.com/traefik/traefik/v2: Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hostsCVE-2026-50135Mediumgithub.com/gohugoio/hugo: Hugo: Symlink confinement bypass in resources.GetCVE-2026-50134Mediumgithub.com/gohugoio/hugo: Hugo: security.http.urls allow-list bypass via HTTP redirectsCVE-2026-50133Mediumgithub.com/gohugoio/hugo: Hugo: XSS via text/html content filesCVE-2026-48491Highgithub.com/traefik/traefik/v2: Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypassCVE-2026-50891Highgithub.com/mickael-kerjean/filestash: Filestash allows attackers to escalate privileges via sending a crafted requestCVE-2026-50884Highgithub.com/statping-ng/statping-ng: statping-ng allows attackers to escalate privileges to Administrator and access sensitive componentsCVE-2026-50879Highgithub.com/andreimarcu/linx-server: linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST…CVE-2026-11624Criticalgithub.com/googleapis/mcp-toolbox: MCP Toolbox for Databases has an Origin Validation ErrorCVE-2026-54090Highgithub.com/filebrowser/filebrowser/v2: File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter InjectionCVE-2026-54091Highgithub.com/filebrowser/filebrowser/v2: File Browser has incorrect access control for public directory shares via rule path rebasingCVE-2026-54093Mediumgithub.com/filebrowser/filebrowser/v2: File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesCVE-2026-54094Mediumgithub.com/filebrowser/filebrowser/v2: File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopeCVE-2026-54092Highgithub.com/filebrowser/filebrowser/v2: File Browser has a DoS Vulnerability via Public Login APICVE-2026-54096Highgithub.com/filebrowser/filebrowser/v2: File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent PathCVE-2026-54097Highgithub.com/filebrowser/filebrowser: File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixCVE-2026-46371Mediumgithub.com/fleetdm/fleet/v4: Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointCVE-2026-46370Mediumgithub.com/fleetdm/fleet/v4: Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointCVE-2026-53999Highgithub.com/radius-project/radius: Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)CVE-2026-6739Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't require system-level permission when patching protected default system rolesCVE-2026-3433Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channelCVE-2026-7387Highgithub.com/mattermost/mattermost-server: Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo