Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-32934Highgithub.com/coredns/coredns: CoreDNS' DoQ worker pool does not bound stream backlogCVE-2026-30246Mediumgithub.com/gofiber/fiber/v3: Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parametersCVE-2026-38651Criticalgithub.com/gravitl/netmaker: Netmaker does not verify JWT signatures for host tokensCVE-2026-41602Highgithub.com/apache/thrift: Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerabilityCVE-2026-7020Lowgithub.com/ollama/ollama: Ollama is Vulnerable to Path TraversalCVE-2026-41572Mediumgithub.com/enchant97/note-mark/backend: Note Mark: Unauthenticated read of notes and assets in soft-deleted public booksCVE-2026-41571Criticalgithub.com/enchant97/note-mark/backend: Note Mark: OIDC-registered users authenticated by submitting password "null"CVE-2026-41520Highgithub.com/cilium/cilium: Cillium exposes sensitive information included in the cilium-bugtool debug archiveCVE-2026-42275Highgithub.com/openziti/zrok: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeCVE-2026-42274Highgithub.com/dadrus/heimdall: Heimdall has an authorization bypass via path normalization mismatchCVE-2026-42273Highgithub.com/dadrus/heimdall: Heimdall: Case-sensitive host matching may lead to policy bypassCVE-2026-42272Highgithub.com/dadrus/heimdall: Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationCVE-2026-6993Mediumgithub.com/go-kratos/kratos/v2: Kratos has a Confused Deputy issueCVE-2026-6987Mediumgithub.com/sipeed/picoclaw: PicoClaw has an Injection issue in its Web Launcher Management Plane componentGHSA-H829-5CG7-6HFFMediumgithub.com/supply-chain-tools/gitverify: gitverify has improper tag signature verificationCVE-2026-41485Highgithub.com/kyverno/kyverno: Kyverno Controller Denial of Service via forEach Mutation PanicCVE-2026-41263Mediumgithub.com/traefik/traefik/v3: Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middlewareCVE-2026-41174Mediumgithub.com/traefik/traefik/v3: Traefik Kubernetes CRD allows unauthorized cross-namespace middleware bindingCVE-2026-40912Highgithub.com/traefik/traefik/v3: Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath DesyncGHSA-RP7V-4384-HFRPHighgithub.com/k8sgpt-ai/k8sgpt: k8sGPT has Prompt Injection through its k8sGPT-OperatorCVE-2026-39858Highgithub.com/traefik/traefik/v3: Traefik: Pre-authentication decision bypass due to forwarded alias spoofingCVE-2026-35051Highgithub.com/traefik/traefik/v3: Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authenticationGHSA-XHJ4-G6W8-2XJWCriticalgithub.com/woven-planet/go-zserio: go-zserio has Unbounded Memory Allocation for All PlatformsCVE-2026-41492Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/varsCVE-2026-41432Highgithub.com/QuantumNous/new-api: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo