Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-47W9-6R3F-938GCriticalgithub.com/canonical/lxd: LXD has restricted project bypass leading to arbitrary command executionGHSA-7MR3-28H5-M5VXHighgithub.com/canonical/lxd: LXD has project restriction bypass for custom volume copy across projects GHSA-QX75-2P3R-PWM5Highgithub.com/canonical/lxd: LXD has project restriction bypass in instance copy across projects CVE-2026-9639Mediumgithub.com/canonical/lxd: LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_atGHSA-PJFF-C2WC-F6JMCriticalgithub.com/canonical/lxd: LXD has arbitrary file write on client due to trusted image hashGHSA-FMC8-P6Q7-75CCCriticalgithub.com/canonical/lxd: LXD has argument injection in backup compression algorithm leading to AFW and ACEGHSA-VGHH-5RFX-XHQ8Criticalgithub.com/canonical/lxd: LXD has arbitrary file read+write on host via rootfs/ symlink in malicious imageGHSA-JPF8-86F3-WP38Criticalgithub.com/canonical/lxd: LXD has arbitrary file read+write on host via templates/ symlink in malicious imageGHSA-9J25-MM2H-2F76Criticalgithub.com/canonical/lxd: LXD has arbitrary file write on host via `exec-output` symlink in crafted imageCVE-2026-28385Mediumgithub.com/canonical/lxd: LXD: SSRF via image import from URL allows internal network probing by authenticated usersCVE-2026-62361Mediumgithub.com/knadh/listmonk: listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsCVE-2026-62284Highgithub.com/osac-project/osac-operator: OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyCVE-2026-105769Criticalgithub.com/chainguard-dev/kaniko: kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsCVE-2026-12411Highgithub.com/canonical/lxd: lxd allows Cross-guest volume hijack via DevLXD device patchCVE-2026-55098Mediumgithub.com/basekick-labs/arc: Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735CVE-2026-62331Highgithub.com/mtzanidakis/praktor: praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction…GHSA-9PPR-WFW9-XVR2Mediumgithub.com/tinfoil-factory/netfoil: Netfoil doesn't decrement TTLGHSA-M3QR-FVP4-78XJLowgithub.com/basekick-labs/arc: Arc has unauthenticated application log disclosure via `/api/v1/logs`CVE-2026-118761Highgithub.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryCVE-2026-118759Highgithub.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsCVE-2026-119285Mediumgithub.com/gofiber/fiber/v2: Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGHSA-HFF9-5PQW-6W9FCriticalgithub.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGHSA-494M-4556-WF5PHighgithub.com/imgproxy/imgproxy/v3: imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashGHSA-MMQ5-XM89-9PFGHighgithub.com/imgproxy/imgproxy/v3: imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldGHSA-2WRX-84QJ-4PCGMediumgithub.com/anacrolix/torrent: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo