Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-42880Criticalgithub.com/argoproj/argo-cd/v3: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVE-2026-42082Lowgithub.com/free5gc/amf: Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover CVE-2026-42081Mediumgithub.com/free5gc/amf: Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest CVE-2026-44503Highcom.microsoft.kiota:microsoft-kiota-abstractions: Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-41050Criticalgithub.com/rancher/fleet: Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVE-2026-25705Highgithub.com/rancher/rancher: Rancher Extensions have arbitrary file access via path traversal GHSA-FC67-C4HG-Q653Highgithub.com/aws/amazon-ecs-agent: Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure CVE-2026-42597Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme CVE-2026-42596Criticalgithub.com/gotenberg/gotenberg/v8: Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42594Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine CVE-2026-42593Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes CVE-2026-42592Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes CVE-2026-42591Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has a Server-Side Request Forgery (SSRF) Issue CVE-2026-42590Highgithub.com/gotenberg/gotenberg/v8: Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist CVE-2026-42589Criticalgithub.com/gotenberg/gotenberg/v8: Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection CVE-2026-44425Mediumgithub.com/shellhub-io/shellhub: ShellHub has crash-DoS via field injection in filter and sort-by parameters CVE-2026-44423Mediumgithub.com/shellhub-io/shellhub: ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data CVE-2026-44424Mediumgithub.com/shellhub-io/shellhub: ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace GHSA-MHC4-QQ83-FMRRMediumgithub.com/getaxonflow/axonflow-sdk-go/v5: axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification GHSA-9H64-2846-7X7FCriticalgithub.com/getaxonflow/axonflow: Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening GHSA-2CCX-CJJH-R2J8Lowgithub.com/bluenviron/mediamtx: MediaMTX affected by CVE-2026-27143 due to vulnerable dependency CVE-2026-42602Highgithub.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension: opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay CVE-2026-44245Mediumgithub.com/kyverno/policy-reporter-ui: Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component CVE-2026-44349Highgithub.com/daptin/daptin: Daptin fuzzy search injects unvalidated column name into raw SQL CVE-2026-42572Mediumgithub.com/hatchet-dev/hatchet: Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo