Go vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49245Lowgithub.com/drakkan/sftpgo/v2: SFTPGo has stored XSS via inline parameter on public shares and user file downloadCVE-2026-49244Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo has path confinement bypass in public browsable share partial ZIP downloadCVE-2026-44454Highgithub.com/coder/coder/v2: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consentCVE-2026-50192Mediumgithub.com/kerberos-io/agent/machinery: Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without…CVE-2026-50149Mediumgithub.com/projectcontour/contour: Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate EnabledCVE-2026-45045Mediumgithub.com/gofiber/fiber/v3: GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForwardCVE-2026-44332Mediumgithub.com/gofiber/fiber/v3: GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default AuthorizerCVE-2026-50139Mediumgoshs.de/goshs/v2: goshs: Share-link ?token=… redemption races past download limitCVE-2026-50138Highgoshs.de/goshs/v2: goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flagsGHSA-VH4V-2XQ2-G5CGMediumoras.land/oras-go/v2: ORAS Go forwards registry credentials across registry redirectsCVE-2026-50163Highoras.land/oras-go/v2: `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50162Mediumoras.land/oras-go/v2: oras-go has file store write outside workingDir via symlink traversalCVE-2026-50151Highoras.land/oras-go/v2: oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-48978Loworas.land/oras-go/v2: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-41052Criticalgithub.com/rancher/rancher: Rancher has Privilege Escalation from Project Owner to HostCVE-2026-48824Mediumgithub.com/axllent/mailpit: Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release…CVE-2026-41053Highgithub.com/rancher/rancher: Rancher has over-inclusive team membership expansion in GitHub App authentication providerCVE-2026-44935Criticalgithub.com/rancher/fleet: Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerCVE-2026-44936Mediumgithub.com/rancher/fleet: Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlCVE-2026-44939Criticalgithub.com/rancher/rancher: Rancher vulnerable to command injection through unsanitized YAML parameterCVE-2026-44937Highgithub.com/rancher/fleet: Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL ComponentsCVE-2026-44938Highgithub.com/rancher/fleet: Fleet has PSS Bypass through addLabelsFromOptions in Fleet AgentCVE-2026-49998Highgithub.com/centrifugal/centrifugo/v6: Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypassCVE-2026-49826Lowgithub.com/concourse/concourse: Concourse login flow has an open redirect issueGHSA-3CCM-4QQ2-5WRPMediumgithub.com/edgelesssys/contrast: Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo