Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-46717Highgithub.com/nezhahq/nezha: Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notificationCVE-2026-48777Criticalgithub.com/gtsteffaniak/filebrowser/backend: FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directoryCVE-2026-46703Criticalboxlite: Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the HostCVE-2026-46695Criticalboxlite: BoxLite: Permission Bypass Allows Modification of Read-Only FilesCVE-2026-46680Highgithub.com/containerd/containerd: containerd user ID handling bypass allows runAsNonRoot evasionCVE-2026-46668Lowgithub.com/authzed/spicedb: SpiceDB: Caveat structures with nested lists can result in improper cache reuseCVE-2026-46618Mediumgithub.com/fission/fission: Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary…CVE-2026-46617Highgithub.com/fission/fission: Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code…CVE-2026-46614Criticalgithub.com/fission/fission: Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTriggerCVE-2026-46612Highgithub.com/fission/fission: Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archivesGHSA-763J-3P5V-JFC6Lowgithub.com/mvt-project/androidqf: androidqf: APK download Path Traversal in device APK pathsGHSA-JF2Q-463C-6F52Lowgithub.com/mvt-project/androidqf: androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)CVE-2026-46403Mediumgithub.com/klever-io/klever-go: Klever-Go KVM read-only execution can commit contract delete and upgrade side effectsCVE-2026-45760Highgithub.com/apache/camel-k/v2: Apache Camel K: Kubernetes namespace authorized users can create a Build resourceCVE-2026-4858Highgithub.com/mattermost/mattermost-server: Mattermost has a Path Traversal issueCVE-2026-4055Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost has an Incorrect Authorization issueGHSA-PXH5-6RRC-8RJVLowgithub.com/opentofu/opentofu: OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled serverCVE-2026-46431Mediumgithub.com/xyproto/algernon: Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *CVE-2026-46430Mediumgithub.com/xyproto/algernon: Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOSCVE-2026-46415Highpkg.jsn.cam/caddy-defender: Caddy Defender trusted proxy client IP bypassCVE-2026-46410Highgithub.com/gtsteffaniak/filebrowser/backend: FileBrowser Quantum: unauthenticated user share share info CVE-2026-46378Highgithub.com/tomwright/dasel/v3: Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literalCVE-2026-46377Highgithub.com/tomwright/dasel/v3: Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringCVE-2026-46354Criticalgithub.com/coder/coder/v2: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theftCVE-2026-45796Mediumgithub.com/coder/coder/v2: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo