Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41328Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang FieldCVE-2026-41327Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldCVE-2026-41246Highgithub.com/projectcontour/contour: Contour has Lua code injection via Cookie Path Rewrite PolicyCVE-2026-21728Highgithub.com/grafana/tempo: Grafana Tempo has an Uncontrolled Resource Consumption issueCVE-2026-29051Lowchainguard.dev/melange: melange has Path Traversal via .PKGINFO in --persist-lint-resultsCVE-2026-29050Mediumchainguard.dev/melange: melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].usesCVE-2026-40886Highgithub.com/argoproj/argo-workflows/v4: Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows ControllerCVE-2026-32952Mediumgithub.com/Azure/go-ntlmssp: go-ntlmssp NTLM challenges can panic on malformed payloadsCVE-2026-39087Criticalheckel.io/ntfy/v2: ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions functionCVE-2026-42091Mediumgithub.com/patrickhener/goshs/v2: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORSCVE-2026-42072Criticalgithub.com/orneryd/nornicdb: NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote accessCVE-2026-41894Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)CVE-2026-41889Lowgithub.com/jackc/pgx/v5: pgx: SQL Injection via placeholder confusion with dollar quoted string literalsGHSA-3M6Q-H5GJ-7MRWMediumcode.gitea.io/gitea: Gitea has insecure default SSH settingsCVE-2026-41645Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Environment variable disclosure via Response-Derived DSL ExpressionsCVE-2026-41646Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Local File Read via require() Module Loader BypassCVE-2026-41644Highgithub.com/monetr/monetr: monetr: Server-side request forgery in Lunch Flow link creation and refreshCVE-2026-41136Mediumgithub.com/free5gc/amf: free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransferCVE-2026-41135Highgithub.com/free5gc/pcf: free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of ServiceCVE-2026-41131Mediumgithub.com/openfga/openfga: OpenFGA has Improper Policy EnforcementCVE-2026-32885Mediumgithub.com/ddev/ddev: DDEV has ZipSlip path traversal in tar and zip archive extractionCVE-2026-25996Mediumgithub.com/inspektor-gadget/inspektor-gadget: Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output ModeCVE-2026-24905Mediumgithub.com/inspektor-gadget/inspektor-gadget: Inspektor Gadget: Command Injection via malicious buildOptions manipulationCVE-2026-41422Highgithub.com/daptin/daptin: Daptin: SQL injection via unvalidated goqu.L() calls in aggregate APICVE-2026-41179Criticalgithub.com/rclone/rclone: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo