Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44973Highgithub.com/go-git/go-billy/v5: go-billy has path traversal vulnerabilitiesCVE-2026-44884Mediumgithub.com/portainer/portainer: Portainer missing authorization on custom template file endpoint, which exposes template contentCVE-2026-44883Highgithub.com/portainer/portainer: Portainer: JWT accepted in URL query leaks tokens to logs and referersCVE-2026-44849Criticalgithub.com/portainer/portainer: Portainer has an endpoint security bypass via Swarm service create/updateCVE-2026-44882Highgithub.com/portainer/portainer: Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorizationCVE-2026-44881Highgithub.com/portainer/portainer: Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateCVE-2026-44850Highgithub.com/portainer/portainer: Portainer has a bind-mount restriction bypass via HostConfig.MountsCVE-2026-44885Mediumgithub.com/portainer/portainer: Portainer has a path traversal in backup archive extraction that allows arbitrary file writeCVE-2026-44848Criticalgithub.com/portainer/portainer: Portainer missing authorization on Docker plugin endpoints, which allows host RCECVE-2026-43644Mediumgithub.com/stefanprodan/podinfo: podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpointsCVE-2026-46356Mediumgithub.com/fleetdm/fleet/v4: Fleet: IP spoofing allows bypassing API rate limitingCVE-2026-26191Mediumgithub.com/fleetdm/fleet/v4: Fleet vulnerable to OS command injection in software packagesCVE-2026-26062Highgithub.com/fleetdm/fleet/v4: Fleet server may terminate unexpectedly when handling certain gRPC requestsCVE-2026-24899Highgithub.com/fleetdm/fleet/v4: Fleet Windows MDM Azure AD JWT Authentication BypassCVE-2026-24000Mediumgithub.com/fleetdm/fleet/v4: Fleet has a rate limiting bypass via untrusted client IP headersCVE-2026-23998Highgithub.com/fleetdm/fleet/v4: Fleet has a Windows MDM management endpoint authentication bypassCVE-2026-33381Mediumgithub.com/grafana/grafana: Grafana: Users can generate Service Account tokens after permissions removalCVE-2026-33380Mediumgithub.com/grafana/grafana: Grafana: SQL Expressions Read File From DiskCVE-2026-45375Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionCVE-2026-45371Highgithub.com/siyuan-note/siyuan/kernel: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIsCVE-2026-45152Highgitlab.com/uniget-org/cli: uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code ExecutionCVE-2026-45148Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-modeCVE-2026-45147Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to diskGHSA-VW82-7FV8-R6GPCriticalgithub.com/obot-platform/obot: Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP serverCVE-2026-44774Mediumgithub.com/traefik/traefik/v3: Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo