Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44429Mediumgithub.com/modelcontextprotocol/registry: MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`CVE-2026-44671Highgithub.com/zitadel/zitadel: ZITADEL has LDAP Filter Injection in Login FlowCVE-2026-44428Lowgithub.com/modelcontextprotocol/registry: MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audienceCVE-2026-44427Mediumgithub.com/modelcontextprotocol/registry: MCP Registry has open redirect via protocol-relative path in trailing-slash middlewareCVE-2026-44670Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCEGHSA-FPW6-HRG5-Q5X5Highgithub.com/lin-snow/Ech0: ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTIGHSA-P64J-F4X9-WQ66Highgithub.com/lin-snow/Ech0: Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theftGHSA-8MC6-XJPR-H98XHighgithub.com/lin-snow/ech0: Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfoGHSA-PJ6Q-4VQ4-R8CGMediumgithub.com/lin-snow/Ech0: Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_countGHSA-RGJ7-VG8V-J4WRMediumgithub.com/lin-snow/ech0: Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric InflationGHSA-3V85-FQVH-7RXFMediumgithub.com/lin-snow/Ech0: Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribersGHSA-RJ4G-RQGH-RX9HMediumgithub.com/lin-snow/Ech0: Ech0 comment model's Email field returned on public /api/comments endpointsCVE-2026-44523Criticalgithub.com/enchant97/note-mark/backend: Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token ForgeryCVE-2026-44522Highgithub.com/enchant97/note-mark/backend: Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code ExecutionCVE-2026-44544Mediumgithub.com/gittuf/gittuf: gittuf's policy can be rolled back to prior valid versionsGHSA-MMPX-JH39-WRV6Mediumgithub.com/gtsteffaniak/filebrowser: FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)CVE-2026-44542Criticalgithub.com/gtsteffaniak/filebrowser: FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File DeletionCVE-2026-44283Lowgo.etcd.io/etcd/v3: etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requestsCVE-2026-44426Mediumgithub.com/shellhub-io/shellhub: ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership checkGHSA-258C-965C-P3HCMediumgithub.com/daptin/daptin: Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password ChangeGHSA-M38G-VWW2-MVGXHighgithub.com/siderolabs/talos: Talos Linux has a local privilege escalation from untrusted workloadsCVE-2026-44514Mediumgithub.com/kubetail-org/kubetail/modules/dashboard: Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated usersCVE-2026-42459Highgithub.com/free5gc/udm: Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive InformationCVE-2026-42328Mediumgithub.com/ipld/go-ipld-prime: go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depthCVE-2026-42083Highgithub.com/free5gc/pcf: Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo