Go CVE feed and alerts
Every new CVE and security advisory affecting Go packages, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 20
- High
- 67
- On CISA KEV
- 4
Of the newest 200
- CVE-2026-128037gittuf authorization bypass in namespace policy verificationgithub.com/gittuf/gittuf
- CVE-2026-128036gittuf authorization bypass in policy update verificationgithub.com/gittuf/gittuf
- CVE-2026-128035gittuf authorization bypass in propagated controller policy checksgithub.com/gittuf/gittuf
- CVE-2026-128034gittuf authorization bypass in file protection rulesgithub.com/gittuf/gittuf
- CVE-2026-97054HTTP/1 server crash due to MaxBytesReader header race in net/httpGo standard library net/http · stdlib
- CVE-2026-97033Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97034Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97035Unexpected code execution and arbitrary file write via Clang -gen- and GCC -gnat flags in cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97036Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97037Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97038Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97039Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97040Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/linkGo toolchain cmd/go · Go toolchain cmd/link +1
- CVE-2026-97041Host linker flag injection via //go:cgo_ directives in cmd/compile and cmd/linkGo toolchain cmd/compile · Go toolchain cmd/link +1
- CVE-2026-97042Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/linkGo toolchain cmd/cgo · Go toolchain cmd/compile +2
- CVE-2026-97043Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compileGo toolchain cmd/go · Go toolchain cmd/compile +1
- CVE-2026-125328pgEdge Go LLM lib provider API key disclosure in LLM proxy health checkpgedge-go-llm-lib · github.com/pgEdge/pgedge-go-llm-lib
- CVE-2026-125327pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requestspgedge-rag-server · github.com/pgEdge/pgedge-rag-server
- CVE-2026-125326pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the…pgedge-rag-server · github.com/pgEdge/pgedge-rag-server
- CVE-2026-125325pgEdge RAG Server cross-tenant data leak via race in shared keyword indexpgedge-rag-server · github.com/pgEdge/pgedge-rag-server
- CVE-2026-125323pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connectionspgEdge control-plane · github.com/pgEdge/control-plane
- CVE-2026-87857Temporal Server workflow-history pagination token is not bound to the requested namespace and workflowTemporal Technologies go.temporal.io/server
- CVE-2026-123616imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loaderimgproxy · github.com/imgproxy/imgproxy +3
- CVE-2026-123615imgproxy out-of-bounds write in ICO loaderimgproxy · github.com/imgproxy/imgproxy +3
- CVE-2026-123614imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflowimgproxy · github.com/imgproxy/imgproxy/v3 +3
- CVE-2026-102657esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalesm-dev esm.sh · github.com/esm-dev/esm.sh/web
- CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL pluginVelocidex velociraptor · www.velocidex.com/golang/velocirap…
- GHSA-47W9-6R3F-938GLXD has restricted project bypass leading to arbitrary command executiongithub.com/canonical/lxd
- GHSA-7MR3-28H5-M5VXLXD has project restriction bypass for custom volume copy across projectsgithub.com/canonical/lxd
- GHSA-QX75-2P3R-PWM5LXD has project restriction bypass in instance copy across projectsgithub.com/canonical/lxd
- GHSA-PJFF-C2WC-F6JMLXD has arbitrary file write on client due to trusted image hashgithub.com/canonical/lxd
- GHSA-FMC8-P6Q7-75CCLXD has argument injection in backup compression algorithm leading to AFW and ACEgithub.com/canonical/lxd
- GHSA-VGHH-5RFX-XHQ8LXD has arbitrary file read+write on host via rootfs/ symlink in malicious imagegithub.com/canonical/lxd
- GHSA-JPF8-86F3-WP38LXD has arbitrary file read+write on host via templates/ symlink in malicious imagegithub.com/canonical/lxd
- GHSA-9J25-MM2H-2F76LXD has arbitrary file write on host via `exec-output` symlink in crafted imagegithub.com/canonical/lxd
- CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885ddev · github.com/ddev/ddev
- GO-2026-6893Event type spoofing via UntrustedType in github.com/google/go-eventloggithub.com/google/go-eventlog
- GO-2026-6905Panic on negative member size in Reader.Read in github.com/blakesmith/argithub.com/blakesmith/ar
- GO-2026-6909Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/samlgithub.com/crewjam/saml
- GO-2026-6911SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-gogithub.com/mark3labs/mcp-go
- GO-2026-6906Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoilgithub.com/tinfoil-factory/netfoil
- GO-2026-6907Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arcgithub.com/basekick-labs/arc
- GO-2026-6894anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in…github.com/anacrolix/torrent
- GO-2026-6891charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in…github.com/charmbracelet/soft-serve
- GO-2026-6892charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-servegithub.com/charmbracelet/soft-serve
- GO-2026-6836SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in…github.com/siyuan-note/siyuan/kernel
- GO-2026-6838Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echogithub.com/labstack/echo/v4 · github.com/labstack/echo/v5
- GO-2026-6839Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echogithub.com/labstack/echo/v4 · github.com/labstack/echo/v5
- GO-2026-6840Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echogithub.com/labstack/echo/v4
- GO-2026-6841Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echogithub.com/labstack/echo/v5
Show all 200 entriesShow fewer entries
- GO-2026-6842Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echogithub.com/labstack/echo/v4
- CVE-2026-102943Dagu MCP DAG specification read bypasses path containment and workspace isolationdagucloud dagu · github.com/dagu-org/dagu/v2
- CVE-2026-88982Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook…kubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploadskubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88984Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelineskubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88986Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responseskubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88985Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API serverkubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88983Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationkubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-77463Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymentumputun remark42 · github.com/umputun/remark42/backend +1
- CVE-2026-77622Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderBishopFox sliver · github.com/BishopFox/sliver
- CVE-2026-34157Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOriginswailsapp wails · github.com/wailsapp/wails/v2
- CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughcaddyserver caddy · github.com/caddyserver/caddy/v2
- CVE-2026-119345Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacksultravioletrs cocos · github.com/ultravioletrs/cocos
- CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…Gogs · gogs.io/gogs
- CVE-2026-115770Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofingpocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-62662Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiencespocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headermayswind ezbookkeeping · github.com/mayswind/ezbookkeeping
- CVE-2026-102340Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment…telepresenceio telepresence · github.com/telepresenceio/tel…
- CVE-2026-122132go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middlewarego-chi chi · github.com/go-chi/chi +4
- CVE-2026-102339Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackabletelepresenceio telepresence · github.com/telepresenceio/tel…
- CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driverssnowflake-connector-python · github.com/snowflakedb/gosn… +9
- CVE-2026-64672Terragrunt catalog predictable temp symlink clobbergruntwork-io terragrunt · github.com/gruntwork-io/terragrunt
- CVE-2026-63198traQ: Privilege escalation by OAuth prompt=none requesttraPtitech traQ · github.com/traPtitech/traQ
- CVE-2026-63197traQ: XSS in the User Uploaded File Retrieval APItraPtitech traQ · github.com/traPtitech/traQ
- GHSA-9PPR-WFW9-XVR2Netfoil doesn't decrement TTLgithub.com/tinfoil-factory/netfoil
- GHSA-M3QR-FVP4-78XJArc has unauthenticated application log disclosure via `/api/v1/logs`github.com/basekick-labs/arc
- CVE-2026-105770Octo STS discloses trust policy contents to unauthorized callers via Exchange error messagesgithub.com/octo-sts/app
- CVE-2026-120091Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the…Temporal Technologies go.temporal.io/server
- CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostschainguard kaniko · github.com/chainguard-dev/kaniko
- GHSA-2WRX-84QJ-4PCGanacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSgithub.com/anacrolix/torrent
- CVE-2026-55098Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735Basekick-Labs arc · github.com/basekick-labs/arc
- CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyosac-project osac-operator · github.com/osac-project/osac-o…
- CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injectionmtzanidakis praktor · github.com/mtzanidakis/praktor
- CVE-2026-62160Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewaredaptin · github.com/daptin/daptin
- CVE-2026-119299gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segmentsgopacket · github.com/gopacket/gopacket
- CVE-2026-119298croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receiveschollz croc · github.com/schollz/croc/v11 +5
- GHSA-F3FJ-9625-RV3Mcharmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersgithub.com/charmbracelet/soft-serve
- GHSA-FGXM-5HVV-X4VHcharmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesgithub.com/charmbracelet/soft-serve
- CVE-2026-119285Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsgofiber fiber · github.com/gofiber/fiber/v2
- CVE-2026-118761Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memorykubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-118759Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenantkubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-118658Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Protolabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118657Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headerslabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118656Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURIlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118655Echo: Static Middleware Double-Unescape Path Traversallabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversallabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-54162Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUIalexandre-daubois ember · github.com/alexandre-daubois/ember
- CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configurationlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBloblabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Defaultlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Methodlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peerlabstack echo · github.com/labstack/echo/v5
- CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlslabstack echo · github.com/labstack/echo/v4 +1
- CVE-2026-118263Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestslabstack echo · github.com/labstack/echo/v5
- CVE-2026-118262Echo: WebSocket proxy can retain connections and handlers after client disconnectlabstack echo · github.com/labstack/echo/v4 +1
- CVE-2026-118261Echo: Decompress permits unbounded gzip expansion in v4labstack echo · github.com/labstack/echo/v4
- CVE-2026-118260Echo: BodyDump captures request and response bodies without size limits in v4labstack echo · github.com/labstack/echo/v4
- CVE-2026-97045Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2026-116683CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesctfer-io terraform-provider-ctfd · github.com/ctfer-io/t… +1
- CVE-2026-116682FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directorygtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-116679Neko: Authorization bypass in legacy WebRTC input handlingm1k1o neko · github.com/m1k1o/neko/server
- CVE-2026-116676Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planrunatlantis atlantis · github.com/runatlantis/atlantis
- CVE-2026-54462knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionknative pkg · knative.dev/pkg
- CVE-2026-116591compress zstd: Panic on two-block framesklauspost compress · github.com/klauspost/compress/zstd +1
- CVE-2026-116587Go JOSE: DoS when parsing JWKs that contain RSA keysgo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116586Go JOSE: Panics in JSON parsinggo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116585Go JOSE: Panic during CBC-HMAC processinggo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-57208Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindentireio cli · github.com/entireio/cli
- CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding Headersdadrus heimdall · https://github.com/dadrus/heimdall +1
- CVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Modedadrus heimdall · github.com/dadrus/heimdall
- CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Loginbytebase · github.com/bytebase/bytebase
- CVE-2026-111497Google out-of-bounds write in decompression decoderGoogle Brotli · node +7
- CVE-2026-114665Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileComparezhenorzz goploy · github.com/zhenorzz/goploy
- CVE-2026-114437Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-Forgo-chi chi · github.com/go-chi/chi/v5
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509 · stdlib +3
- CVE-2026-114101Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypasscorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114100Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Typecorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114099Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collisioncorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-113729Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationmoov-io signedxml · github.com/moov-io/signedxml
- CVE-2026-113727OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsopenchoreo · github.com/openchoreo/openchoreo
- GO-2026-6651Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-coregithub.com/xtls/xray-core
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder Hashcoder · github.com/coder/coder/v2 +1
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance Settingscoder · github.com/coder/coder/v2 +1
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Originsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project Permissionsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooksgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · github.com/coder/coder/v2 +1
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parametercoder · github.com/coder/coder/v2 +1
- CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1
- CVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1
- CVE-2026-102941gomarkdown/markdown IsSafeURL panics on short URLsgomarkdown markdown · github.com/gomarkdown/markdown
- CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filtergetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100354kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crashgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100352kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Pathgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100351kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusiongetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100349kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100350kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressiongetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100347kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-100348kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)getkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-97394kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2023-32198Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacksSUSE steve · github.com/rancher/steve
- CVE-2024-22031Rancher users who can create Projects can gain access to arbitrary projectsSUSE rancher · github.com/rancher/rancher
- CVE-2025-23390Fleet doesn’t validate a server’s certificate when connecting through SSHSUSE fleet · github.com/rancher/fleet
- CVE-2026-53999Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)radius-project radius · github.com/radius-project/radius
- CVE-2026-102748Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Servicedgraph-io dgraph · github.com/dgraph-io/dgraph/v25
- CVE-2026-77524KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationkedacore keda · github.com/kedacore/keda +1
- CVE-2026-77564Talos Linux: Support bundle does not redact registry credentialssiderolabs talos · github.com/siderolabs/talos
- CVE-2026-100394Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-73802Gitea Runner host isolation bypass through container optionsGitea Runner · gitea.com/gitea/runner
- CVE-2026-59766Gitea private repository metadata disclosure after access revocationGitea · code.gitea.io/gitea +1
- CVE-2026-104252Vitess vttablet /twopcz reflected XSSvitessio vitess · vitess.io/vitess
- CVE-2026-62367Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeovergo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-55797Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLargoproj argo-cd · argo-cd +3
- GHSA-9CQF-HHRQ-7V45SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class…github.com/siyuan-note/siyuan/kernel
- CVE-2026-60004Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.Gitea · gitea.dev +1
- CVE-2026-54523Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any…kyverno · github.com/kyverno/kyverno
- CVE-2026-62204SiYuan before v3.7.4 Plugin Overwrite via Bazaar Installsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-60083SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file toolsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-77763JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the…github.com/juicedata/juicefs
- CVE-2026-73054SiYuan before v3.7.4 Authentication Bypass via WebSocketsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73630SiYuan before v3.7.4 Information Disclosure via authFilePublishAccesssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73049SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinkssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-33818Enforce maximum recursion depth in encoding/asn1Go standard library encoding/asn1
- CVE-2026-73608SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTargetsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-72791SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViewssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-65600Traefik auth bypass via path traversal in ReplacePathRegextraefik · github.com/traefik/traefik/v2 +2
- GHSA-RJWR-M7QX-3FJRoapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Codegithub.com/oapi-codegen/oapi-codegen/v2
- CVE-2026-62290cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialscert-manager · github.com/cert-manager/cert-manager
- CVE-2026-62361listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsknadh listmonk · github.com/knadh/listmonk
- GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issuesgolang.org/x/crypto
- CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated usersCanonical lxd · github.com/canonical/lxd
- CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXDCanonical LXD · github.com/canonical/lxd
- CVE-2026-12411Broken Access Control in Canonical LXD DevLXD APICanonical lxd · github.com/canonical/lxd
- CVE-2026-13426Client4 fails to validate path parametersgithub.com/mattermost/mattermost/server/public
- CVE-2026-13322Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of serviceRed Hat OpenShift Virtualization · github.com/kubevirt/k… +1
- CVE-2026-13318Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ipRed Hat OpenShift Virtualization · kubevirt.io/kubevirt
- CVE-2026-13218Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherRed Hat OpenShift Virtualization · kubevirt.io/kubevirt
- CVE-2026-42504Quadratic complexity in WordDecoder.DecodeHeader in mimeGo standard library mime
- CVE-2026-7482Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackersollama · github.com/ollama/ollama
- CVE-2026-39883OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingopen-telemetry opentelemetry-go · go.opentelemetry.io/otel/…
- CVE-2026-33344Dagu path traversal in locateDAGdagu-org dagu · github.com/dagu-org/dagu
- CVE-2025-8110File overwrite in file update API in GogsGogs · gogs.io/gogs
- CVE-2025-26625Git LFS may write to arbitrary files via crafted symlinksgit-lfs · github.com/git-lfs/git-lfs +1
- CVE-2021-43798Grafana path traversalgrafana · github.com/grafana/grafana
- CVE-2020-8927Buffer overflow in Brotli libraryGoogle Brotli · brotli +122
Get alerts for new Go CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?ecosystem=go
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?ecosystem=go in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?ecosystem=go&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?ecosystem=go&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest Go packages CVEs?
The newest are CVE-2026-128037 (gittuf authorization bypass in namespace policy verification); CVE-2026-128036 (gittuf authorization bypass in policy update verification); CVE-2026-128035 (gittuf authorization bypass in propagated controller policy checks).
Are any Go packages CVEs being exploited?
4 of the 200 newest Go packages vulnerabilities are on CISA's Known Exploited Vulnerabilities list: CVE-2026-111497, CVE-2026-60004, CVE-2025-8110, CVE-2021-43798.
How many critical Go packages CVEs are there?
20 of the 200 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-123614, GHSA-47W9-6R3F-938G, GHSA-PJFF-C2WC-F6JM, GHSA-FMC8-P6Q7-75CC, GHSA-VGHH-5RFX-XHQ8 and more.
How do I get alerts for new Go packages CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of Go CVEs?
Yes: https://cve.now/feed?ecosystem=go. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get Go CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?ecosystem=go. For email, give the RSS URL to any RSS-to-email service.