Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-4128Lowgithub.com/mattermost/mattermost/server/v8: Mattermost allows guest users to view information about public teams they are not members of CVE-2025-4573Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows authenticated administrator to execute LDAP search filter injection CVE-2025-8556Lowgithub.com/cloudflare/circl: CIRCL-Fourq: Missing and wrong validation can lead to incorrect results CVE-2025-49140Highgithub.com/pion/interceptor: Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)CVE-2025-49136Criticalgithub.com/knadh/listmonk: listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVE-2025-25208Mediumgithub.com/kuadrant/authorino: Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25207Mediumgithub.com/kuadrant/authorino: Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-49011Lowgithub.com/authzed/spicedb: SpiceDB checks involving relations with caveats can result in no permission when permission is expected CVE-2025-47950Highgithub.com/coredns/coredns: CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification CVE-2025-48710Mediumgithub.com/kro-run/kro: kro Confused Deputy vulnerability CVE-2025-48494Mediumgithub.com/forceu/gokapi: Gokapi vulnerable to stored XSS via uploading file with malicious file name CVE-2025-48495Mediumgithub.com/forceu/gokapi: Gokapi has stored XSS vulnerability in friendly name for API keys CVE-2025-29785Highgithub.com/quic-go/quic-go: quic-go Has Panic in Path Probe Loss Recovery Handling CVE-2025-3454Mediumgithub.com/grafana/grafana: Grafana's datasource proxy API allows authorization checks to be bypassed CVE-2025-3260Highgithub.com/grafana/grafana: Grafana vulnerable to authenticated users bypassing dashboard, folder permissions CVE-2025-48938Mediumgithub.com/cli/go-gh/v2: Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server CVE-2025-3230Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly invalidate personal access tokens upon user deactivation CVE-2025-3611Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly enforce access control restrictions for System Manager roles CVE-2025-2571Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to clear Google OAuth credentials CVE-2025-1792Lowgithub.com/mattermost/mattermost/server/v8: Mattermost fails to properly enforce access controls for guest users CVE-2025-48948Highgithub.com/navidrome/navidrome: Navidrome Transcoding Permission Bypass Vulnerability Report CVE-2025-3913Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost improperly allows team administrators to modify team invites CVE-2025-48949Highgithub.com/navidrome/navidrome: Navidrome allows SQL Injection via role parameter CVE-2025-48865Criticalgithub.com/fabiolb/fabio: Fabio allows HTTP clients to manipulate custom headers it adds CVE-2025-48936Highgithub.com/zitadel/zitadel: ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.