Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-G53W-W6MJ-HRPPCriticalgithub.com/Kuadrant/mcp-gateway: MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" pathCVE-2026-45803Lowgithub.com/cli/cli/v2: GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injectionGHSA-GX7W-56W6-G48XMediumgithub.com/caddyserver/caddy/v2: Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path MatchingGHSA-WWHQ-W58M-W29CMediumgithub.com/caddyserver/caddy/v2: Caddy CVE-2026-30852 Fix BypassGHSA-M23H-6MWM-39M8Mediumgithub.com/kong/kubernetes-ingress-controller/v3: Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing…GHSA-3278-C88V-XRH4Mediumgithub.com/kong/kubernetes-ingress-controller/v2: Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpointCVE-2026-45695Criticalgithub.com/kopia/kopia: Kopia: RCE via SSH ProxyCommand InjectionGHSA-4GPH-2HHR-5MWGMediumgithub.com/envoyproxy/ai-gateway: Envoy AI Proxy - MCP Message Smuggling VulnerabilityCVE-2026-45738Highgithub.com/argoproj/argo-cd/v3: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalationCVE-2026-45737Mediumgithub.com/argoproj/argo-cd/v3: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotationsCVE-2026-45713Highgithub.com/axllent/mailpit: Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesCVE-2026-45712Mediumgithub.com/axllent/mailpit: Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)CVE-2026-45711Mediumgithub.com/axllent/mailpit: Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDsCVE-2026-45709Mediumgithub.com/axllent/mailpit: Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialerCVE-2026-45692Mediumgithub.com/caddyserver/caddy/v2: Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index NormalizationCVE-2026-45781Lowgithub.com/modelcontextprotocol/registry: MCP Registry: OCI validator skips ownership check on upstream rate limitsCVE-2026-45576Highgithub.com/openziti/zrok/v2: zrok copy writes attacker-controlled WebDAV paths outside the destination rootCVE-2026-45571Mediumgithub.com/go-git/go-git/v5: go-git: Crafted repositories may modify main and submodule .git directoriesCVE-2025-70950Highgithub.com/itang/gohttp: gohttp is vulnerable to directory traversal via a crafted requestCVE-2026-45570Lowgithub.com/go-git/go-git/v5: go-git: Improper single-quote escaping in go-git SSH transportGHSA-9V4J-7G44-QCQWMediumgithub.com/xyproto/algernon: Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authenticationCVE-2026-45721Criticalgithub.com/xyproto/algernon: Algernon: handler.lua discovery walks parent directories above the server rootCVE-2026-45728Highgithub.com/xyproto/algernon: Algernon: Single-file mode unconditionally enables debug modeCVE-2026-45686Highgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBICVE-2026-45685Highgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo