Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-47190Mediumgithub.com/metal3-io/ip-address-manager: IPAM controller service account granted unnecessary full access to SecretsGHSA-HFC8-W5F4-3X6MMediumgithub.com/metal3-io/ironic-standalone-operator: Ironic Standalone Operator's controller modifies user-owned resources without consentGHSA-7CWM-FPFH-RRCHMediumgithub.com/metal3-io/ironic-standalone-operator: Ironic Standalone Operator's prometheus metrics exporter bound to all interfacesCVE-2026-45742Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has a Race Condition via Multipart `downloadFrom` HandlingCVE-2026-45741Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesCVE-2026-44829Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has path traversal in zip entry name via Windows-style separators in upload filenameCVE-2026-48501Highgithub.com/cli/cli/v2: GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and…CVE-2026-47179Highgithub.com/getarcaneapp/arcane/backend: Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include DirectivesCVE-2026-46405Mediumgithub.com/openbao/openbao: OpenBao's Kerberos Auth Method Accumulates Unaccessible TokensCVE-2026-9097Criticalgithub.com/casdoor/casdoor: Casdoor doesn't verify that a JWT used for token exchange is still activeCVE-2026-9094Criticalgithub.com/casdoor/casdoor: Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature checkCVE-2026-9096Highgithub.com/casdoor/casdoor: Casdoor doesn't enforce SAML assertion time boundsCVE-2026-9098Criticalgithub.com/casdoor/casdoor: Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequestCVE-2026-6720Highgithub.com/projectcalico/calicoctl/v3: Calico Inserts Sensitive Information into Log FileCVE-2026-9093Criticalgithub.com/casdoor/casdoor: Casdoor does not validate the AudienceRestriction element in SAML assertionsCVE-2026-9090Criticalgithub.com/casdoor/casdoor: Casdoor has an authentication bypassCVE-2026-41184Mediumgithub.com/projectcalico/calico: Calico Inserts Sensitive Information into Log FileCVE-2026-9091Mediumgithub.com/casdoor/casdoor: Casdoor allows users to bypass configured MFA requirementsCVE-2026-41185Mediumgithub.com/projectcalico/calico: Calico Inserts Sensitive Information into Log FileCVE-2026-46358Mediumgithub.com/openbao/openbao: OpenBao's Inline Auth Incorrectly Redacted HeadersCVE-2026-45808Highgithub.com/openbao/openbao: OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLCVE-2026-45287Lowgo.opentelemetry.io/otel/schema/v1.1: opentelemetry-go's Schema ParseFile leaks file descriptors on each parseCVE-2026-41178Mediumgo.opentelemetry.io/otel/baggage: opentelemetry-go's baggage parsing no longer caps raw header lengthCVE-2026-22872Mediumgithub.com/projectcapsule/capsule: Capsule TenantResource RawItems Cluster-Scoped Resource Creation VulnerabilityCVE-2026-30963Lowgithub.com/projectcapsule/capsule: Capsule Namespace Hijacking via subresource

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo