Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41176Criticalgithub.com/rclone/rclone: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionCVE-2026-41070Criticalgithub.com/jkroepke/openvpn-auth-oauth2: openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN accessCVE-2026-40938Highgithub.com/tektoncd/pipeline: Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCECVE-2026-40924Mediumgithub.com/tektoncd/pipeline: Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory ExhaustionCVE-2026-40923Mediumgithub.com/tektoncd/pipeline: Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ checkCVE-2026-40343Mediumgithub.com/free5gc/udr: free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creationCVE-2026-40161Highgithub.com/tektoncd/pipeline: Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURLCVE-2026-40264Lowgithub.com/openbao/openbao: OpenBao's Token Store Allows Cross-Namespace Renewal, RevocationCVE-2026-39946Mediumgithub.com/openbao/openbao: OpenBao's SQL Injection in PostgreSQL database secrets engineCVE-2026-39396Lowgithub.com/openbao/openbao: OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)CVE-2026-39388Lowgithub.com/openbao/openbao: OpenBao's Certificate Authentication Allows Token Renewal With Different CertificateCVE-2026-39386Highgithub.com/m1k1o/neko/server: Neko has a Self-service Privilege Escalation for Authenticated UsersCVE-2026-25542Mediumgithub.com/tektoncd/pipeline: Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matchingCVE-2026-34403Highgithub.com/0xJacky/Nginx-UI: Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsCVE-2026-33031Highgithub.com/0xJacky/Nginx-UI: Nginx-UI: Disabled users retain full API access through previously issued bearer tokensCVE-2026-6634Lowgithub.com/usememos/memos: Memos has an Incorrect Privilege Assignment issueCVE-2026-41589Criticalcharm.land/wish/v2: Wish has SCP Path Traversal that allows arbitrary file read/writeCVE-2026-6437Mediumgithub.com/kubernetes-sigs/aws-efs-csi-driver: Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fieldsCVE-2026-41574Criticalgithub.com/nhost/nhost: Nhost Vulnerable to Account Takeover via OAuth Email Verification BypassCVE-2026-41506Mediumgithub.com/go-git/go-git/v5: go-git: Credential leak via cross-host redirect in smart HTTP transportCVE-2026-41433Highgo.opentelemetry.io/obi: OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIRCVE-2026-41491Highgithub.com/dapr/dapr: Dapr: Service Invocation path traversal ACL bypassCVE-2026-3590Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcementCVE-2026-27769Lowgithub.com/mattermost/mattermost-server: Mattermost doesn't validate whether users were correctly owned by the correct Connected WorkspaceCVE-2026-5160Mediumgithub.com/yuin/goldmark/renderer/html: goldmark vulnerable to Cross-site Scripting (XSS)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo