Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-V5MH-H5HX-7V92Mediumgithub.com/cloudnativelabs/kube-router: kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route InjectionCVE-2026-44301Mediumgithub.com/gohugoio/hugo: Hugo's Node tool execution allows file system access outside the project directoryCVE-2025-71261Highgithub.com/harvester/harvester: Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOSGHSA-6447-269V-G68MHighgithub.com/mezo-org/mezod: Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drainCVE-2026-6863Mediumwww.velocidex.com/golang/velociraptor: Velocidex Velociraptor has an Incorrect Authorization issueCVE-2026-42339Highgithub.com/QuantumNous/new-api: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0CVE-2026-42283Highgithub.com/loft-sh/devspace: DevSpace UI Server WebSocket CheckOrigin does not validate sourceCVE-2026-42238Criticalgithub.com/0xJacky/nginx-ui: Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup RestoreCVE-2026-42223Mediumgithub.com/0xJacky/nginx-ui: Nginx-UI Settings API Exposes Protected SecretsCVE-2026-42222Highgithub.com/0xJacky/nginx-ui: Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverCVE-2026-42221Highgithub.com/0xJacky/Nginx-UI: Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimCVE-2026-7573Mediumwww.velocidex.com/golang/velociraptor: Velocidex Velociraptor has an authorization bypass vulnerabilityCVE-2026-7572Mediumwww.velocidex.com/golang/velociraptor: Velocidex Velociraptor has an off-by-one errorCVE-2026-6970Highgithub.com/canonical/authd: authd: Primary group ID is incorrectly set to value of UID CVE-2026-44903Mediumgithub.com/prometheus/prometheus: Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap displayCVE-2026-42541Mediumgithub.com/kubewarden/kubewarden-controller: Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability callCVE-2026-44166Mediumgithub.com/pocketbase/pocketbase: PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgradeGHSA-9FW6-XGG2-MQ9QHighgithub.com/apernet/hysteria/core/v2: Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabledCVE-2026-42300Criticalgithub.com/l3montree-dev/devguard: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` headerCVE-2026-42285Highgithub.com/osrg/gobgp/v4: GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)CVE-2026-42220Mediumgithub.com/0xJacky/Nginx-UI: Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and…CVE-2026-42554Mediumgithub.com/gofiber/fiber/v3: Fiber vulnerable to XSS in AutoFormat Content NegotiationCVE-2026-42600Mediumgithub.com/minio/minio: MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST EndpointCVE-2026-42186Lowgithub.com/openbao/openbao: OpenBao's Namespace Deletion May Not Delete Data ProperlyCVE-2026-42154Highgithub.com/prometheus/prometheus: Prometheus: Remote read endpoint allows denial of service via crafted snappy payload

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo