Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-6345Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't prevent disclosure of created user password CVE-2026-6346Highgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation CVE-2026-28732Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't enforce slash command trigger-word uniqueness during command updates CVE-2026-4286Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check if {{team_id}} was being changed when updating playbooks CVE-2026-4273Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation CVE-2026-6340Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate 7zip archive structure before processing CVE-2026-6334Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow CVE-2026-28759Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost does not verify remote cluster channel access when processing shared channel membership removals CVE-2026-2325Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't limit the size of the request body on the start meeting API endpoint CVE-2026-3495Lowgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't escape some variables that could contain malicious content during error page composition CVE-2026-3637Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't check the create_post channel permission during post edit operations CVE-2026-8783Lowgithub.com/omec-project/amf: AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8780Lowgithub.com/omec-project/amf: AMF Improperly Restricts Operations within the Bounds of a Memory Buffer CVE-2026-8779Lowgithub.com/omec-project/amf: AMF Improperly Restricts Operations within the Bounds of a Memory Buffer CVE-2026-8781Lowgithub.com/omec-project/amf: AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8782Lowgithub.com/omec-project/amf: AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-4053Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields CVE-2026-4054Mediumgithub.com/mattermost/mattermost-server: Mattermost doesn't validate the response body of proxied images GHSA-RC6V-5RMX-W5MVMediumgithub.com/arnika-project/arnika: arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS GHSA-MXG3-432P-MR72Highgoshs.de/goshs/v2: goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request CVE-2026-45062Highgithub.com/dunglas/frankenphp: FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files CVE-2026-8634Criticalgithub.com/openclaw/crabbox: Crabbox: environment variable exposure vulnerability CVE-2026-8621Highgithub.com/openclaw/crabbox: Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers GHSA-GXHX-2686-5H9GMediumgithub.com/slack-go/slack: slack-go `SecretsVerifier` accepts empty signing secret without precondition CVE-2026-45021Mediumgithub.com/kumahq/kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo