Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-52879Highgithub.com/klever-io/klever-go: klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSCVE-2026-49343Mediumgithub.com/klever-io/klever-go: Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSCVE-2026-47680Mediumgithub.com/fluxcd/source-controller: Source controller: Improper path handling allows traversalCVE-2026-47249Highgithub.com/klever-io/klever-go: Klever-Go KVM: Hash-array amplification in P2P resolver request handlingCVE-2026-45726Highgithub.com/siderolabs/omni: Omni: Reader-level users can retrieve imported cluster CA keys via ResourceServiceCVE-2026-45723Lowgithub.com/siderolabs/omni: Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematicCVE-2026-45720Highgithub.com/siderolabs/omni: Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session tokenCVE-2026-47703Mediumgithub.com/AdguardTeam/AdGuardHome: AdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleCVE-2026-8462Mediumgithub.com/openmeterio/openmeter: OpenMeter: SQL injection through meter creationCVE-2026-10814Lowgithub.com/milvus-io/milvus: milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgeryCVE-2026-47671Mediumgithub.com/nhost/nhost: Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secretsGHSA-74M6-4HJP-7226Highgithub.com/klever-io/klever-go: Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)CVE-2026-47215Mediumgithub.com/sylabs/singularity/v4: Singluarity: Incorrect path matching for 'limit container paths' directiveCVE-2026-45730Highgithub.com/nuclio/nuclio: Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any projectCVE-2026-40898Mediumgithub.com/quic-go/quic-go: quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVE-2026-37462Highgithub.com/osrg/gobgp/v4: GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes functionCVE-2026-10722Lowgithub.com/cilium/ebpf: ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReaderCVE-2026-48119Highgithub.com/nezhahq/nezha: Nezha's authenticated agents can forge service-monitor results for other users' servicesCVE-2026-10517Mediumgithub.com/quay/claircore: Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpointsCVE-2026-10219Mediumgithub.com/nextlevelbuilder/goclaw: GoClaw has a Command Injection issueCVE-2026-47268Mediumgithub.com/nezhahq/nezha: Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard hostCVE-2026-47203Lowgithub.com/authelia/authelia/v4: Authelia Missing Username Canonicalization in Basic Auth (LDAP)CVE-2026-47201Highgoauthentik.io: authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated userGHSA-W5PP-99CH-QJ29Mediumgithub.com/go-git/go-git/v5: go-git: Malformed Git object data may cause panics or resource exhaustionGHSA-RF84-WR5G-M3RPMediumgithub.com/metal3-io/cluster-api-provider-metal3: CAPM3 vulnerable to Cross-Namespace resource access

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo