Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-37461Highgithub.com/osrg/gobgp/v4: GoBGP has an out-of-bounds read in the ParseIP6Extended functionCVE-2026-40197Highgithub.com/lxc/incus/v6/cmd/incusd: Incus has a Nil-Pointer Dereference via Custom Volume ImportCVE-2026-40195Highgithub.com/lxc/incus/v6/cmd/incusd: Incus has a Nil-Pointer Dereference Panic via Bucket MetadataCVE-2026-35527Mediumgithub.com/lxc/incus/v6/cmd/incusd: Incus has Blind SSRF via Image Import Preflight HEADCVE-2026-7482Highgithub.com/ollama/ollama: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderCVE-2026-7736Mediumgithub.com/osrg/gobgp/v4: GoBGP has an Integer Underflow IssueCVE-2026-7737Mediumgithub.com/osrg/gobgp: GoBGP has Improper Restriction of Operations within the Bounds of a Memory BufferCVE-2026-7734Mediumgithub.com/osrg/gobgp/v4: GoBGP has an Improper Resource Shutdown or ReleaseGHSA-RH99-WC69-C255Highgithub.com/edgelesssys/contrast: Contras Affected by CopyFile Policy Subversion via SymlinksCVE-2026-42461Highgithub.com/getarcaneapp/arcane/backend: Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CVE-2026-42560Criticalgithub.com/go-pkgz/auth: auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonationGHSA-28XX-PPPM-VQFFLowgithub.com/ydb-platform/ydb-go-sdk/v3: ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transactionCVE-2026-40281Criticalgithub.com/gotenberg/gotenberg/v8: Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)CVE-2026-39383Mediumgithub.com/gotenberg/gotenberg/v8: Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URLCVE-2026-40280Highgithub.com/gotenberg/gotenberg/v8: Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protectionGHSA-VJGJ-42F6-7997Mediumgithub.com/tinfoil-factory/netfoil: netfoil's optional seccomp sandboxing was not appliedGHSA-84G5-X8J3-7235Mediumgithub.com/tinfoil-factory/netfoil: Netfoil has incorrect allowlist enforcementCVE-2026-44015Highgithub.com/0xJacky/Nginx-UI: Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal ServicesCVE-2026-41643Highgithub.com/osrg/gobgp/v4: GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATECVE-2026-41642Highgithub.com/osrg/gobgp/v4: GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path AttributeCVE-2026-33467Mediumgithub.com/elastic/package-registry: Elastic Package Registry has Improper Verification of Cryptographic Signature CVE-2026-35579Highgithub.com/coredns/coredns: CoreDNS has TSIG authentication bypass on gRPC and QUIC transportsCVE-2026-33190Highgithub.com/coredns/coredns: CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPCCVE-2026-33489Highgithub.com/coredns/coredns: CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)CVE-2026-32936Highgithub.com/coredns/coredns: CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo