Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-6961Highgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file syncCVE-2026-7184Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize the Remote Cluster API response on PATCH operationsCVE-2026-6046Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate that a username returned during bot registration belongs to a bot accountCVE-2026-6689Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creationGHSA-6VGG-XHVH-38FFLowgithub.com/juev/nebula-mesh: nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-storeCVE-2026-48154Mediumgithub.com/pilinux/gorest: gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)CVE-2026-12681Highgithub.com/google/go-attestation: Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()CVE-2026-48113Highgithub.com/jpillora/chisel: Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData InjectionCVE-2026-11401Highgithub.com/aws/aws-advanced-go-wrapper/awssql/v2: AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instanceCVE-2026-48096Mediumgithub.com/openfga/openfga: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision…CVE-2026-48089Highgithub.com/l3montree-dev/devguard: DevGuard has improper authorization on public assetsCVE-2026-48050Highgithub.com/basekick-labs/arc: Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSCVE-2026-48020Highgithub.com/traefik/traefik/v2: Traefik has a StripPrefix Route-Level Auth Bypass via Path NormalizationCVE-2026-47780Mediumgithub.com/free5gc/udr: free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistenceCVE-2026-47768Mediumgithub.com/juev/nebula-mesh: nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)CVE-2026-47753Mediumgithub.com/lxc/incus/v7: Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)CVE-2026-48058Mediumgithub.com/juev/nebula-mesh: nebula-mesh: Session and OIDC state cookies lack the Secure attributeCVE-2026-48025Mediumgithub.com/juev/nebula-mesh: nebula-mesh: Decrypted CA private key persists in heap after signingCVE-2026-25700Highgithub.com/apache/incubator-answer: Apache Answer: AdminToken not invalidated after admin deactivationCVE-2026-47701Highgithub.com/open-telemetry/opentelemetry-operator: OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authCVE-2026-47253Highgithub.com/julien040/anyquery: Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory DeletionCVE-2026-53469Criticalgithub.com/kubev2v/migration-planner: Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources APICVE-2026-53476Criticalgithub.com/kubev2v/assisted-migration-agent: Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code executionCVE-2026-53470Criticalgithub.com/kubev2v/migration-planner: Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTsCVE-2026-53474Criticalgithub.com/kubev2v/migration-planner: Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo