Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-53475Criticalgithub.com/kubev2v/assisted-migration-agent: Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communicationCVE-2026-53471Criticalgithub.com/kubev2v/migration-planner: Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulationCVE-2026-49397Mediumgithub.com/nezhahq/nezha: Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing dataCVE-2026-49396Highgithub.com/nezhahq/nezha: Nezha has cross-site GET request that can trigger stored cron commands on a victim's agentsCVE-2026-48031Criticalgithub.com/dhax/go-base: Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token ForgeryGHSA-7QJX-GP9H-65QJHighgithub.com/dexidp/dex: Dex: Token-exchange endpoint is missing AllowedConnectors enforcementCVE-2026-25688Mediumgithub.com/apache/incubator-answer: Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerabilityCVE-2026-34033Mediumgithub.com/apache/incubator-answer: Apache Answer vulnerable to Cross-site ScriptingCVE-2026-34905Mediumgithub.com/apache/incubator-answer: Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2026-33582Mediumgithub.com/apache/incubator-answer: Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerabilityCVE-2026-34031Mediumgithub.com/apache/incubator-answer: Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerabilityCVE-2026-25699Mediumgithub.com/apache/incubator-answer: Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerabilityCVE-2026-47735Highgithub.com/basekick-labs/arc: Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checksCVE-2026-47726Highgithub.com/juev/nebula-mesh: nebula-mesh: GET /api/v1/audit-log discloses all entries to any operatorCVE-2026-47725Highgithub.com/juev/nebula-mesh: nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpointsCVE-2026-47724Criticalgithub.com/juev/nebula-mesh: nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalationCVE-2026-47723Highgithub.com/juev/nebula-mesh: nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)CVE-2026-47722Highgithub.com/juev/nebula-mesh: nebula-mesh: Host advanced overrides allow YAML injection into agent config.ymlCVE-2026-47252Criticalgithub.com/julien040/anyquery/plugins/chrome: Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome PluginCVE-2026-11500Lowgithub.com/weaviate/weaviate: Weaviate has an Improper Authorization issueCVE-2026-11481Lowgithub.com/yoanbernabeu/grepai: grepai Uses a Broken or Risky Cryptographic AlgorithmCVE-2026-11479Lowgithub.com/yoanbernabeu/grepai: grepai Uses a Broken or Risky Cryptographic AlgorithmCVE-2026-11465Lowgithub.com/songquanpeng/one-api: songquanpeng one-api has an issue that results in business logic errorsCVE-2026-52878Highgithub.com/klever-io/klever-go: Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData)…CVE-2026-52880Highgithub.com/klever-io/klever-go: klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo