Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44740Mediumgithub.com/go-git/go-billy/v5: go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionCVE-2026-44697Highgithub.com/klever-io/klever-go: Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payloadCVE-2026-44594Highgithub.com/esm-dev/esm.sh: esm.sh: Path Traversal via package.json browser field allows reading arbitrary server filesCVE-2026-44593Highgithub.com/esm-dev/esm.sh: esm.sh: Legacy Route Path Traversal Can Lead to RCECVE-2026-7474Highgithub.com/hashicorp/nomad: HashiCorp Nomad vulnerable to a path traversalCVE-2026-6959Mediumgithub.com/hashicorp/nomad: HashiCorp Nomad vulnerable to symlink attackCVE-2026-8052Mediumgithub.com/hashicorp/nomad-driver-exec2: HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attackCVE-2026-45090Highgithub.com/hahwul/dalfox/v2: Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)CVE-2026-45089Highgithub.com/hahwul/dalfox/v2: Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` OptionCVE-2026-45088Highgithub.com/hahwul/dalfox/v2: Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`CVE-2026-45087Criticalgithub.com/hahwul/dalfox/v2: Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`CVE-2026-8349Lowgithub.com/omec-project/amf: omec-project amf crashes when processing malformed LocationReportsCVE-2026-45224Mediumgithub.com/openclaw/crabbox: Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolutionCVE-2026-45046Mediumgithub.com/safedep/gryph: Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive ContentCVE-2026-6815Mediumgithub.com/casdoor/casdoor: Casdoor: Arbitrary file write possible through Local File System storage providerCVE-2026-45047Highgithub.com/xddxdd/bird-lg-go: Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON DecodingCVE-2026-44543Highgithub.com/rancher/local-path-provisioner: Local Path Provisioner Vulnerable to HelperPod Template InjectionCVE-2026-44477Criticalgithub.com/cloudnative-pg/cloudnative-pg: CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCECVE-2026-44474Lowgithub.com/ellanetworks/core: Ella Core has handover failures during concurrent Security Mode CommandCVE-2026-44475Mediumgithub.com/ellanetworks/core: Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequestCVE-2026-44473Highgithub.com/ellanetworks/core: Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponseCVE-2026-45022Highgithub.com/go-git/go-git/v6: go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream GitCVE-2026-44985Highgithub.com/amir20/dozzle: Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authenticationCVE-2026-42595Highgithub.com/gotenberg/gotenberg/v8: Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List BypassCVE-2026-8275Lowgithub.com/bettercap/bettercap/v2: bettercap Has an Integer Coercion Error in the ippReadChunkedBody Function

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo