Skip to content
OpenAdvisories

Ecosystem

Go

5,231 known vulnerabilities.

Most affected packages

github.com/mattermost/mattermost-server 296 github.com/mattermost/mattermost-server/v6 222 github.com/mattermost/mattermost/server/v8 207 github.com/mattermost/mattermost-server/v5 199 stdlib 182 code.gitea.io/gitea 123 github.com/siyuan-note/siyuan/kernel 113 gogs.io/gogs 76 github.com/usememos/memos 75 github.com/traefik/traefik 69 github.com/traefik/traefik/v2 68 code.vikunja.io/api 67 github.com/grafana/grafana 66 github.com/traefik/traefik/v3 61 github.com/rancher/rancher 60 github.com/hashicorp/vault 55 github.com/zitadel/zitadel 52 github.com/argoproj/argo-cd 50 k8s.io/kubernetes 50 github.com/argoproj/argo-cd/v2 48 toolchain 45 gitea.dev 44 github.com/filebrowser/filebrowser/v2 44 github.com/filebrowser/filebrowser 43 github.com/0xJacky/Nginx-UI 41 github.com/cilium/cilium 39 golang.org/x/net 38 github.com/docker/docker 36 github.com/answerdev/answer 34 github.com/hashicorp/nomad 34 github.com/openbao/openbao 33 github.com/fleetdm/fleet/v4 32 golang.org/x/crypto 32 github.com/lxc/incus/v6 32 github.com/hashicorp/consul 32 github.com/lxc/incus 32 github.com/rclone/rclone 29 github.com/nats-io/nats-server/v2 28 github.com/coder/coder 28 github.com/coder/coder/v2 28
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-7020 Public exploit

    Ollama Tensor Model Transfer transfer.go digestToPath path traversal

    A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.go of the component Tensor Model Transfer Handler. The manipulation of the argument digest results in path traversal. T…

    github.com/ollama/ollama Go
  • Low 2.1
    CVE-2026-29781 Public exploit

    Sliver: Authenticated Nil-Pointer Dereference in Handlers

    Sliver is a command and control framework that uses a custom Wireguard netstack. In versions from 1.7.3 and prior, a vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to a systemic lack of nil-pointer validation. By extracting va…

    BishopFox sliver github.com/bishopfox/sliver Go
  • Low 1.9
    CVE-2025-13425 Public exploit

    Denial of Service in OSV-SCALIBR

    A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OS…

    Google OSV-SCALIBR github.com/google/osv-scalibr Go
  • Low 2.7
    CVE-2024-3177 Public exploit

    Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

    A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFr…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Low —
    CVE-2023-36308 Public exploit

    Crash when processing crafted TIFF files

    disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this …

    golang-github-disintegration-imaging github.com/disintegration/imaging Debian Go
  • Low 3.7
    CVE-2021-28378 Public exploit

    Cross-site Scripting in Gitea

    Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

    code.gitea.io/gitea gitea Alpine Go
  • Low 3.8
    CVE-2020-2023 Public exploit

    Kata Containers - Containers have access to the guest root filesystem device

    Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier…

    kata-containers kata-containers github.com/kata-containers/runtime github.com/kata-containers/agent Go