Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-100348Mediumgithub.com/getkin/kin-openapi: kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)CVE-2026-100347Mediumgithub.com/getkin/kin-openapi: kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathCVE-2026-102603Mediumgithub.com/gotify/server/v2: Gotify: Insufficiently Protected Password Change endpointCVE-2026-100394Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantCVE-2026-97394Highgithub.com/getkin/kin-openapi: kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsCVE-2026-82416Highgithub.com/dunglas/frankenphp: FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleCVE-2026-77375Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo: Denial of service via malformed SSH channel requestCVE-2026-84360Highgithub.com/0xJacky/Nginx-UI: Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsCVE-2026-84321Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableCVE-2026-84316Highgithub.com/0xJacky/Nginx-UI: Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive…CVE-2026-84312Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)CVE-2026-84315Highgithub.com/0xJacky/Nginx-UI: Nginx UI OTP secure-session step-up is missing on sensitive mutation routesCVE-2026-84314Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointCVE-2026-84313Highgithub.com/0xJacky/Nginx-UI: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverCVE-2026-84318Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCECVE-2026-84317Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)CVE-2026-84320Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Auto backup name allows path traversal outside validated storage pathCVE-2026-84319Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx…CVE-2026-77622Highgithub.com/BishopFox/sliver: Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderCVE-2026-64672Mediumgithub.com/gruntwork-io/terragrunt: Terragrunt catalog predictable temp symlink clobberCVE-2026-64655Lowgithub.com/cli/cli/v2: GitHub CLI allows attestation verification bypass through unescaped regex metacharactersCVE-2026-64653Lowgithub.com/cli/cli/v2: GitHub CLI allows path traversal through unescaped request URL componentsCVE-2026-64652Lowgithub.com/cli/cli/v2: GitHub CLI partially discloses authentication tokens in `gh auth status` outputGHSA-M687-P538-R5HPHighcode.vikunja.io/api: Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trustedGHSA-FMMF-XQ98-G327Mediumcode.vikunja.io/api: Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo