Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-8276Lowgithub.com/bettercap/bettercap/v2: bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.goCVE-2026-44330Criticalgithub.com/free5gc/nef: free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptionsCVE-2026-44329Criticalgithub.com/free5gc/smf: free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlersCVE-2026-44328Highgithub.com/free5gc/smf: free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutatingCVE-2026-44327Criticalgithub.com/free5gc/nef: free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handlerCVE-2026-44326Criticalgithub.com/free5gc/nef: free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete…CVE-2026-44325Highgithub.com/free5gc/nrf: free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible typesCVE-2026-44324Mediumgithub.com/free5gc/udr: free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)CVE-2026-44323Mediumgithub.com/free5gc/udr: free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)CVE-2026-44322Highgithub.com/free5gc/nef: free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceCVE-2026-44321Highgithub.com/free5gc/smf: free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)CVE-2026-44320Highgithub.com/free5gc/nef: free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing pathCVE-2026-44319Highgithub.com/free5gc/nef: free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)CVE-2026-44318Mediumgithub.com/free5gc/bsf: free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on…CVE-2026-44317Mediumgithub.com/free5gc/pcf: free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceCVE-2026-44316Highgithub.com/free5gc/pcf: free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceCVE-2026-44315Criticalgithub.com/free5gc/nef: free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactionsCVE-2026-44309Mediumgithub.com/sigstore/gitsign: gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commitsGHSA-PMWQ-PJRM-6P5RMediumgithub.com/in-toto/in-toto-golang: in-toto-golang and in-toto-python have inconsistent negation behaviorCVE-2026-44247Mediumvolcano.sh/volcano: Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body sizeCVE-2026-44588Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)GHSA-7HGR-XVRR-XPW3Lowgithub.com/nhost/nhost: nhost has Session Persistence After Password ChangeCVE-2026-44310Mediumgithub.com/sigstore/gitsign: gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersCVE-2026-42876Mediumgithub.com/external-secrets/external-secrets/apis: ExternalSecrets vulnerable to privilege escalation with secret overwritingCVE-2026-44430Mediumgithub.com/modelcontextprotocol/registry: MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo