Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-28741Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't validate CSRF tokens on an authentication endpointCVE-2026-5807Highgithub.com/hashicorp/vault: HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCVE-2026-5052Mediumgithub.com/hashicorp/vault: HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSCVE-2026-3605Highgithub.com/hashicorp/vault: HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-ServiceCVE-2026-4525Highgithub.com/hashicorp/vault: HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header SanitizationCVE-2026-41413Mediumistio.io/istio: Istio: SSRF via RequestAuthentication jwksUriGHSA-8WFP-579W-6R25Highgithub.com/kyverno/kyverno: Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)CVE-2026-41323Highgithub.com/kyverno/kyverno: Kyverno: ServiceAccount token leaked to external servers via apiCall service URLCVE-2026-41068Highgithub.com/kyverno/kyverno: Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)CVE-2026-40611Highgithub.com/go-acme/lego/v4: ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 ProviderCVE-2026-40304Mediumgithub.com/openziti/zrok: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend recordsCVE-2026-40303Highgithub.com/openziti/zrok: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsingCVE-2026-40302Mediumgithub.com/openziti/zrok: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingCVE-2026-40173Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpointsCVE-2026-39350Mediumistio.io/istio: Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dotsCVE-2026-35469Highgithub.com/moby/spdystream: SpdyStream: DOS on CRICVE-2026-6383Mediumkubevirt.io/kubevirt: KubeVirt's authorization mechanism improperly truncates subresource namesCVE-2026-21726Mediumgithub.com/grafana/loki/v3: Grafana Loki Path Traversal - CVE-2021-36156 BypassCVE-2026-21727Lowgithub.com/grafana/grafana: Grafana legacy correlations allow cross-tenant disclosure and deletionCVE-2025-41118Criticalgithub.com/grafana/pyroscope: Pyroscope Exposes Storage SecretCVE-2026-41059Highgithub.com/oauth2-proxy/oauth2-proxy/v7: OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regexCVE-2026-40574Mediumgithub.com/oauth2-proxy/oauth2-proxy/v7: OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email ClaimsCVE-2026-40575Criticalgithub.com/oauth2-proxy/oauth2-proxy/v7: OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header SpoofingCVE-2026-6290Criticalwww.velocidex.com/golang/velociraptor: Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL tokenCVE-2024-53412Highgithub.com/NietThijmen/ShoppingCart: NietThijmen ShoppingCart: Command injection in the connect function

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo