Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-82407Highgithub.com/klever-io/klever-go: Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSCVE-2026-82409Highgithub.com/klever-io/klever-go: Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryCVE-2026-82406Highgithub.com/klever-io/klever-go: Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceCVE-2026-82405Highgithub.com/klever-io/klever-go: Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated…CVE-2026-86065Highgithub.com/klever-io/klever-go: Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine…CVE-2026-86064Highgithub.com/klever-io/klever-go: Klever-Go: /log controls global node loggingCVE-2026-88010Mediumgithub.com/traefik/traefik/v3: Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracleCVE-2026-88978Mediumgithub.com/hatchet-dev/hatchet: Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterCVE-2026-84298Lowgithub.com/hatchet-dev/hatchet: Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherCVE-2026-79913Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and…CVE-2026-79767Mediumgithub.com/gardener/gardener: Gardener: Authorization Bypass via Group Subject InjectionCVE-2026-77637Lowgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth ScopeCVE-2026-77633Highgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceCVE-2026-76805Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz ModeCVE-2026-76804Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Local File Read via Workflow File-Protocol Gate BypassCVE-2026-76803Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Local File Read via MySQL Client Sandbox BypassCVE-2026-76802Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Arbitrary Command Execution via DAST Code Signature BypassCVE-2026-76819Highgithub.com/projectdiscovery/nuclei/v3: Nuclei: Arbitrary Code Execution via Goja JavaScript Engine VulnerabilityCVE-2026-77561Mediumgithub.com/steveiliop56/tinyauth: Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of serviceCVE-2026-77560Highgithub.com/tinyauthapp/tinyauth: Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach…CVE-2026-77582Mediumgithub.com/tinyauthapp/tinyauth: Tinyauth: User enumeration attack by timing oracleCVE-2026-62371Highgithub.com/kubeedge/kubeedge: KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 APICVE-2026-62370Mediumgithub.com/kubeedge/kubeedge: KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHubCVE-2026-62369Highgithub.com/kubeedge/kubeedge: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node joinCVE-2026-63131Mediumgithub.com/openbao/openbao: OpenBao Skips Stricter Deny Policy for LIST operations

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo