# github.com/kubev2v/migration-planner (Go) vulnerabilities 4 known vulnerabilities (4 critical), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.31.0 (Nov 2, 2026): no advisory affects it - Newest unaffected release: v0.31.0 (Nov 2, 2026), the latest release - Releases: 44 since v0.2.0 (Oct 12, 2025) - Registry: https://pkg.go.dev/github.com/kubev2v/migration-planner - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-53470: v0.2.0-1 to v0.13.4 (v0.13.5 is outside it) - CVE-2026-53471: v0.2.0-1 to v0.13.4 (v0.13.5 is outside it) - CVE-2026-53474: v0.2.0-1 to v0.13.4 (v0.13.5 is outside it) - CVE-2026-53469: v0.2.0-1 to v0.13.4 (v0.13.5 is outside it) ## Advisories (4) ### [CVE-2026-53470](https://cve.now/CVE-2026-53470): Migration-planner: getsourcedownloadurl missing organization check - Severity: Critical 9.6 - Published: Jun 10, 2026 - Affected: fixed in 0.13.5. - Fixed in v0.13.5 (released Jun 8, 2026, 2 days before disclosure). - The latest release, v0.31.0, is not affected. ### [CVE-2026-53471](https://cve.now/CVE-2026-53471): Migration-planner: agent api ignores jwt source\_id claim - Severity: Critical 9.6 - Published: Jun 10, 2026 - Affected: fixed in 0.13.5. - Fixed in v0.13.5 (released Jun 8, 2026, 2 days before disclosure). - The latest release, v0.31.0, is not affected. ### [CVE-2026-53474](https://cve.now/CVE-2026-53474): Migration-planner: second-order sql injection via rvtools upload - Severity: Critical 9.6 - Published: Jun 10, 2026 - Affected: fixed in 0.13.5. - Fixed in v0.13.5 (released Jun 8, 2026, 2 days before disclosure). - The latest release, v0.31.0, is not affected. ### [CVE-2026-53469](https://cve.now/CVE-2026-53469): Migration-planner: unprotected delete endpoint wipes all tenant data - Severity: Critical 9.1 - Published: Jun 10, 2026 - Affected: fixed in 0.13.5. - Fixed in v0.13.5 (released Jun 8, 2026, 2 days before disclosure). - The latest release, v0.31.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/kubev2v/migration-planner Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.