Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-24692Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly enforce read permissions in search API endpoints CVE-2026-4265Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to validate team-specific upload_file permissions CVE-2026-21386Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to use consistent error responses when handling the /mute command CVE-2026-2456Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to limit the size of responses from integration action endpoints CVE-2026-2461Mediumgithub.com/mattermost/mattermost-plugin-boards: Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications CVE-2026-2476Highgithub.com/mattermost/mattermost-plugin-msteams: Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values CVE-2026-2458Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows a removed team member to enumerate all public channels within a private team CVE-2026-2463Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to filter invite IDs based on user permissions CVE-2026-2578Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to preserve the redacted state of burn-on-read posts during deletion CVE-2026-2457Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows attackers to spoof permalink embeds CVE-2026-26246Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to bound memory allocation when processing PSD image files CVE-2026-25783Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly validate User-Agent header tokens CVE-2026-24458Highgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly handle very long passwords CVE-2026-25780Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to bound memory allocation when processing DOC files CVE-2026-32720Highgithub.com/ctfer-io/monitoring: github.com/ctfer-io/monitoring Vulnerable to Improper Access Control CVE-2026-32704Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB GHSA-Q926-C743-49QJLowgithub.com/centrifugal/centrifugo/v6: Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning CVE-2026-32301Criticalgithub.com/centrifugal/centrifugo/v6: Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVE-2026-30961Mediumgithub.com/forceu/gokapi: Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload CVE-2026-30955Mediumgithub.com/forceu/gokapi: Gokapi vulnerable to DoS in E2E Metadata Parser CVE-2026-30943Mediumgithub.com/forceu/gokapi: Gokapi vulnerable to Privilege Escalation in File Replace CVE-2026-30915Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo improperly sanitizes placeholders in group home directories/key prefixes CVE-2026-30914Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy CVE-2026-32614Criticalgithub.com/emmansun/gmsm: SM9 Infinity-Point Ciphertext Forgery Vulnerability CVE-2026-31886Criticalgithub.com/dagu-org/dagu: Dagu: Path Traversal via `dagRunId` in Inline DAG Execution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo