Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-42151Highgithub.com/prometheus/prometheus: Prometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42882Criticalgithub.com/oxyno-zeta/s3-proxy: S3-Proxy has Security Issues in its Resource Path Matching ImplementationCVE-2026-42875Mediumgithub.com/external-secrets/external-secrets: External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreGHSA-H5FQ-653G-GXRMMediumgithub.com/Luzifer/ots: ots has a negative expire override that can bypass its secret retention policyCVE-2026-41164Mediumgithub.com/nuts-foundation/nuts-node: nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access tokenCVE-2026-7776Highgithub.com/hashicorp/boundary: Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakesCVE-2026-42575Highchainguard.dev/apko: apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)CVE-2026-42574Highchainguard.dev/apko: apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootCVE-2026-42576Mediumchainguard.dev/apko: apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryCVE-2026-42571Criticalgithub.com/pelicanplatform/pelican: Pelican Web UI Affected by a Privilege Escalation AttackCVE-2026-41888Mediumgithub.com/distribution/distribution/v3: Distribution's tag deletion bypasses `storage.delete.enabled` configurationCVE-2026-42295Highgithub.com/argoproj/argo-workflows/v4: Argo vulnerable to exposure of artifact repository credentialsCVE-2026-42296Highgithub.com/argoproj/argo-workflows/v3: Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/SecureCVE-2026-42294Highgithub.com/argoproj/argo-workflows/v3: Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook InterceptorCVE-2026-42183Lowgithub.com/argoproj/argo-workflows/v4: Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)CVE-2026-42297Highgithub.com/argoproj/argo-workflows/v4: Argo has Missing Authorization in its Sync ConfigMap ProviderCVE-2026-41685Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus is affected by unbounded binary import disk exhaustionCVE-2026-41684Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Nil Dereferences on Restore via Malformed YAMLCVE-2026-41648Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Unbounded YAML Metadata Decode via ParsingCVE-2026-41647Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Nil-Pointer Dereference via S3 Bucket ImportCVE-2026-41326Highgithub.com/kata-containers/kata-containers: Kata Container has CopyFile Policy Subversion via SymlinksCVE-2026-41181Mediumgithub.com/traefik/traefik/v2: Traefik's errors middleware forwards Authorization and Cookie headers to separate error page serviceCVE-2026-40893Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and MoveCVE-2026-40251Highgithub.com/lxc/incus/v6/cmd/incusd: Incus Vulnerable to Panic via Snapshot Bounds CheckCVE-2026-40243Lowgithub.com/lxc/incus/v6/cmd/incusd: Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo