VulnSea

Tagged “go”

CVEs tagged go, newest first.

2111 CVEsRSS

CVE-2026-25679High· 7.5
8mo ago

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

▾ Twilightgolang · goEPSS 0.83%via NVD
CVE-2021-25320Critical· 9.9
8mo ago

Rancher cloud credentials can be used through proxy API by users without access

Rancher cloud credentials can be used through proxy API by users without access

▾ Midnightrancher · github.com/rancher/rancherEPSS 0.85%via OSV
CVE-2022-21951Medium· 6.8
8mo ago

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

▾ Sunlitrancher · github.com/rancher/rancherEPSS 0.39%via OSV
CVE-2023-22648High· 8.0
8mo ago

Rancher's Azure AD permission changes are not reflected on active sessions

Rancher's Azure AD permission changes are not reflected on active sessions

▾ Twilightrancher · github.com/rancher/rancherEPSS 0.45%via OSV
CVE-2021-36783Critical· 9.9
8mo ago

Rancher doesn't properly sanitize credentials in cluster template answers

Rancher doesn't properly sanitize credentials in cluster template answers

▾ Midnightrancher · github.com/rancher/rancherEPSS 0.80%via OSV
CVE-2022-31247Critical· 9.1
8mo ago

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

▾ Midnightrancher · github.com/rancher/rancherEPSS 1.0%via OSV
CVE-2026-22728Medium· 4.9
8mo ago

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotat…

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

▾ Sunlitbitnami-labs · github.com/bitnami-labs/sealed-secretsEPSS 0.41%via OSV
CVE-2026-24834High· 8.8
8mo ago

Kata Container to Guest micro VM privilege escalation

Kata Container to Guest micro VM privilege escalation

▾ Twilightkata-containers · github.com/kata-containers/kata-containers/src/runtimeEPSS 0.24%via OSV
CVE-2026-27017Low
8mo ago

uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots

uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots

▾ Sunlitrefraction-networking · github.com/refraction-networking/utlsEPSS 0.18%via OSV
CVE-2025-67860Low· 3.8
8mo ago

NeuVector scanner insecurely handles passwords as command arguments

NeuVector scanner insecurely handles passwords as command arguments

▾ Sunlitneuvector · github.com/neuvector/scannerEPSS 0.10%via OSV
CVE-2026-21438Medium· 5.3
8mo ago

webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map

webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map

▾ Sunlitquic-go · github.com/quic-go/webtransport-goEPSS 0.41%via OSV
CVE-2026-26190Critical· 9.8PoC
9mo ago

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

▾ Abyssalmilvus-io · github.com/milvus-io/milvusEPSS 39%via GHSA
CVE-2026-25890High· 8.1PoC
9mo ago

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

▾ Midnightfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.50%via OSV
CVE-2026-2303Medium· 6.5
9mo ago

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

▾ Sunlitmongo-driver · go.mongodb.org/mongo-driverEPSS 0.31%via OSV
CVE-2025-66630Critical
9mo ago

Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

▾ Midnightgofiber · github.com/gofiber/fiber/v2EPSS 0.53%via OSV
CVE-2026-25934Medium· 4.3
9mo ago

go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files (CVE-2026-25934)

A flaw was found in go-git, a library for Git implementation in Go. This vulnerability allows a remote attacker to provide specially crafted Git pack or index files that are not properly verified for data integrity. Successful exploitation…

▾ SunlitRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.16%via CSAF
CVE-2026-25793High
9mo ago

Blocklist Bypass possible via ECDSA Signature Malleability

Blocklist Bypass possible via ECDSA Signature Malleability

▾ Twilightslackhq · github.com/slackhq/nebulaEPSS 0.14%via OSV
CVE-2025-68121None
9mo ago

Unexpected session resumption in crypto/tls

Unexpected session resumption in crypto/tls

▾ Sunlitstdlib · stdlibEPSS 0.90%via OSV
CVE-2026-25161High· 8.8
9mo ago

Alist vulnerable to Path Traversal in multiple file operation handlers

Alist vulnerable to Path Traversal in multiple file operation handlers

▾ Twilightalist-org · github.com/alist-org/alist/v3EPSS 0.81%via GHSA
CVE-2026-25160Critical· 9.1
9mo ago

Alist has Insecure TLS Config

Alist has Insecure TLS Config

▾ Midnightalist-org · github.com/alist-org/alist/v3EPSS 0.25%via GHSA
CVE-2026-24513Low· 3.1
9mo ago

ingress-nginx has Improper Check for Unusual or Exceptional Conditions

ingress-nginx has Improper Check for Unusual or Exceptional Conditions

▾ Sunlitingress-nginx · k8s.io/ingress-nginxEPSS 0.35%via OSV
CVE-2026-25145Medium· 5.5
9mo ago

melange has a path traversal in license-path which allows reading files outside workspace

melange has a path traversal in license-path which allows reading files outside workspace

▾ Sunlitmelange · chainguard.dev/melangeEPSS 0.19%via OSV
CVE-2026-24514Medium· 6.5PoC
9mo ago

ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling

ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling

▾ Twilightingress-nginx · k8s.io/ingress-nginxEPSS 0.52%via OSV
CVE-2026-25122Medium· 5.5
9mo ago

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

▾ Sunlitapko · chainguard.dev/apkoEPSS 0.13%via OSV
CVE-2026-25121High· 7.5
9mo ago

apko has a path traversal in apko dirFS which allows filesystem writes outside base

apko has a path traversal in apko dirFS which allows filesystem writes outside base

▾ Twilightapko · chainguard.dev/apkoEPSS 0.41%via OSV
CVE-2025-61730Medium· 5.3
9mo ago

crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVE-2025-61730)

A TLS connection handling flaw has been discovered in the golang crypto/tls library. During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted E…

▾ SunlitRed Hat · Red Hat Ceph Storage 6EPSS 0.32%via CSAF
CVE-2025-61728None
9mo ago

Excessive CPU consumption when building archive index in archive/zip

Excessive CPU consumption when building archive index in archive/zip

▾ Sunlitstdlib · stdlibEPSS 0.74%via OSV
CVE-2025-61726High· 7.5
9mo ago

The net/url package does not set a limit on the number of query parameters in a query

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can …

▾ Twilightgolang · goEPSS 2.3%via NVD
CVE-2025-11065Medium· 5.3PoC
9mo ago

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input valu…

▾ Twilightgo-viper · github.com/go-viper/mapstructure/v2EPSS 0.52%via NVD
CVE-2025-66719Critical· 9.1
9mo ago

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

▾ Midnightfree5gc · github.com/free5gc/nrfEPSS 0.36%via OSV
CVEs tagged “go” — page 51 · VulnSea