Skip to content
OpenAdvisories

Ecosystem

Go

5,231 known vulnerabilities.

Most affected packages

github.com/mattermost/mattermost-server 296 github.com/mattermost/mattermost-server/v6 222 github.com/mattermost/mattermost/server/v8 207 github.com/mattermost/mattermost-server/v5 199 stdlib 182 code.gitea.io/gitea 123 github.com/siyuan-note/siyuan/kernel 113 gogs.io/gogs 76 github.com/usememos/memos 75 github.com/traefik/traefik 69 github.com/traefik/traefik/v2 68 code.vikunja.io/api 67 github.com/grafana/grafana 66 github.com/traefik/traefik/v3 61 github.com/rancher/rancher 60 github.com/hashicorp/vault 55 github.com/zitadel/zitadel 52 github.com/argoproj/argo-cd 50 k8s.io/kubernetes 50 github.com/argoproj/argo-cd/v2 48 toolchain 45 gitea.dev 44 github.com/filebrowser/filebrowser/v2 44 github.com/filebrowser/filebrowser 43 github.com/0xJacky/Nginx-UI 41 github.com/cilium/cilium 39 golang.org/x/net 38 github.com/docker/docker 36 github.com/answerdev/answer 34 github.com/hashicorp/nomad 34 github.com/openbao/openbao 33 github.com/fleetdm/fleet/v4 32 golang.org/x/crypto 32 github.com/lxc/incus/v6 32 github.com/hashicorp/consul 32 github.com/lxc/incus 32 github.com/rclone/rclone 29 github.com/nats-io/nats-server/v2 28 github.com/coder/coder 28 github.com/coder/coder/v2 28
All Critical High Medium Low Exploited only Public exploit

97 results · Clear filters · Feed

  • High 8.8
    CVE-2022-0811 Public exploit EPSS 19%

    Code Injection in CRI-O

    A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster no…

    cri-o github.com/cri-o/cri-o cri-o Azure Linux Alpine Go
  • High 7.5
    CVE-2022-23648 Public exploit EPSS 27%

    Insecure handling of image volumes in containerd CRI plugin

    containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image…

    containerd containerd ctop containerd Debian Ubuntu Alpine Wolfi Go
  • High 7.7
    CVE-2022-24348 Public exploit

    Path traversal and dereference of symlinks in Argo CD

    Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

    github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 8.8
    CVE-2021-46398 Public exploit

    Cross-Site Request Forgery in Filebrowser

    A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands …

    github.com/filebrowser/filebrowser/v2 Go
  • High 7.5
    CVE-2022-24124 Public exploit Scanner template EPSS 55%

    SQL Injection in Casdoor

    The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.

    github.com/casdoor/casdoor casdoor PyPI Go
  • High 7.5
    CVE-2021-43798 Exploited Public exploit Scanner template EPSS 89%

    Grafana path traversal

    Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

    Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go
    KEV Oct 9, 2025
  • High 8.8
    CVE-2021-25741 Public exploit

    Symlink Exchange Can Allow Host Filesystem Access

    A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • High 8.1
    CVE-2021-39156 Public exploit

    Fragments in Path May Lead to Authorization Policy Bypass

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitabl…

    istio istio istio.io/istio Go
  • High 7.2
    CVE-2020-14144 Public exploit Scanner template EPSS 95%

    Arbitrary Code Execution in Gitea

    The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented imme…

    code.gitea.io/gitea Go
  • High 7.5
    CVE-2020-26160 Public exploit

    Authorization bypass in github.com/dgrijalva/jwt-go

    jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…

    gitness dgraph docker-credential-acr-env gitea Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.6
    CVE-2020-1764 Public exploit

    Hard coded cryptographic key in Kiali

    A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possib…

    Red Hat kiali github.com/kiali/kiali Go
  • High 7.5
    CVE-2020-9283 Public exploit EPSS 21%

    Improper Verification of Cryptographic Signature in golang.org/x/crypto

    golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

    k3d k3d-proxy k3d-tools golang.org/x/crypto Debian Ubuntu Wolfi Go
  • High 7.5
    CVE-2019-12999 Public exploit

    Improper Access Control in Lightning Network Daemon

    Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.

    github.com/lightningnetwork/lnd Go
  • High 8.1
    CVE-2020-0601 Exploited Public exploit EPSS 89%

    Certificate validation bypass on Windows in crypto/x509

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows Alpine Go
    KEV Nov 3, 2021
  • High 8.1
    CVE-2019-11229 Public exploit EPSS 55%

    Gitea Remote Code Execution

    models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.

    github.com/go-gitea/gitea Go
  • High 7.5
    CVE-2018-12018 Public exploit

    Go Ethereum LES protocol implementation vulnerable to Denial of Service

    The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack b…

    github.com/ethereum/go-ethereum Go
  • High 7.3
    CVE-2014-8682 Public exploit Scanner template EPSS 33%

    SQL Injection in Gogs

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/r…

    gogs.io/gogs Go