Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-107806Criticalgithub.com/0xJacky/Nginx-UI: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite CVE-2026-107839Highgithub.com/luskaner/ageLANServer/server: ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service CVE-2026-76216Highcode.vikunja.io/api: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure CVE-2026-107840Highgithub.com/jhaals/yopass: yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels CVE-2026-68582Criticalcode.vikunja.io/api: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)CVE-2026-68581Highcode.vikunja.io/api: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management CVE-2026-57458Highcode.vikunja.io/api: Vikunja: Scoped API token can mint unrestricted OAuth session credentials CVE-2026-107812Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM CVE-2026-107808Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)CVE-2026-107809Highgithub.com/0xJacky/Nginx-UI: Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs CVE-2026-107813Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive…CVE-2026-107811Highgithub.com/0xJacky/Nginx-UI: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser CVE-2026-107807Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Node Secret Credential Exposure via URL Query Parameter CVE-2026-107810Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied CVE-2026-55797Highgithub.com/argoproj/argo-cd/v2: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL CVE-2026-107386Mediumgithub.com/rabbitmq/amqp091-go: amqp091-go: Pre-negotiation frame limit is not enforced to 4KB CVE-2026-107211Highgithub.com/xuri/excelize/v2: Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic CVE-2026-107834Mediumgithub.com/corazawaf/coraza/v3: Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor GHSA-W253-M66G-RX24Mediumgithub.com/corazawaf/coraza/v3: Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection CVE-2026-107833Mediumgithub.com/corazawaf/coraza/v3: Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion GHSA-3WR7-993Q-JRFFMediumgithub.com/corazawaf/coraza/v3: Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules GHSA-G4QM-M288-5CP9Mediumgithub.com/corazawaf/coraza/v3: Coraza has Cookie Parser Confusion CVE-2026-107825Mediumgithub.com/corazawaf/coraza/v3: Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations CVE-2026-104774Mediumgithub.com/corazawaf/coraza/v3: Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass CVE-2026-107826Highgithub.com/corazawaf/coraza/v3: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo