Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-45684Mediumgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersCVE-2026-45682Mediumgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removalsCVE-2026-45683Lowgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosureCVE-2026-45681Mediumgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeCVE-2026-45680Mediumgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPUCVE-2026-45678Highgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsCVE-2026-45679Mediumgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesCVE-2026-45676Mediumgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentCVE-2026-42306Highgithub.com/docker/docker: Docker: Race condition in docker cp allows bind mount redirection to host pathCVE-2026-41568Mediumgithub.com/docker/docker: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41567Highgithub.com/moby/moby/v2: Docker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-45327Highgithub.com/DatanoiseTV/tinyice: TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injectionCVE-2026-45298Highgithub.com/amir20/dozzle: Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)CVE-2026-46385Highgithub.com/iskorotkov/avro/v2: iskorotkov/avro: CPU Exhaustion in DecoderCVE-2026-46384Highgithub.com/iskorotkov/avro/v2: iskorotkov/avro: Integer Overflow in DecoderCVE-2026-45627Highgithub.com/getarcaneapp/arcane/backend: Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeoverCVE-2026-45626Mediumgithub.com/getarcaneapp/arcane/backend: Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameterCVE-2026-45625Criticalgithub.com/getarcaneapp/arcane/backend: Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and…CVE-2026-45135Highgithub.com/caddyserver/caddy/v2: Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesGHSA-MX64-MJ3Q-7PRJHighgithub.com/iskorotkov/avro/v2: iskorotkov/avro: Denial-of-Service Vulnerability in DecoderCVE-2026-6347Highgithub.com/mattermost/mattermost-server: Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin CVE-2026-5163Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't verify channel membership when processing AI-assisted message rewritesCVE-2026-6343Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check public/private permissionsCVE-2026-6339Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpointCVE-2026-6333Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate the Host header when constructing response URLs for custom slash command

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo