Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-9804Highkubevirt.io/kubevirt: KubeVirt has a Link Following issue CVE-2026-9739Criticalgithub.com/googleapis/mcp-toolbox: MCP Toolbox for Databases vulnerable to DNS rebinding attacks CVE-2026-47243Highgithub.com/kata-containers/kata-containers: Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs CVE-2026-44982Highgithub.com/crowdsecurity/crowdsec: CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests CVE-2026-44981Mediumgithub.com/crowdsecurity/crowdsec: CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression CVE-2026-36045Highgithub.com/sipeed/picoclaw: picoclaw is vulnerable to OS command injection via the ExecTool component CVE-2026-44210Mediumgithub.com/kata-containers/kata-containers: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations CVE-2026-7374Criticalkubevirt.io/kubevirt: KubeVirt has a Link Following vulnerability CVE-2026-4915Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing CVE-2026-9300Lowgithub.com/omec-project/amf: omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-9301Lowgithub.com/omec-project/amf: omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-9299Lowgithub.com/omec-project/amf: omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-28735Mediumgithub.com/mattermost/mattermost-server: Mattermost allows authenticated users to gain access to private repositories CVE-2026-25680Mediumgolang.org/x/net: Go Net HTML parser is vulnerable to denial of service CVE-2026-5308Highgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce request body size limits on plugin HTTP endpoints CVE-2026-3473Highgithub.com/mattermost/mattermost-server: Mattermost doesn't validate file ownership and access control CVE-2026-5740Highgithub.com/mattermost/mattermost-server: Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation CVE-2026-4646Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate user-supplied input in API request handlers CVE-2026-4635Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't archive the channel before removing persistent notifications CVE-2026-3636Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions CVE-2026-5755Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory CVE-2026-47124Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members CVE-2026-46716Criticalgithub.com/nezhahq/nezha: Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVE-2026-47125Highgithub.com/getarcaneapp/arcane/backend: Arcane: Missing admin authorization on global variables endpoint CVE-2026-47120Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo