CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/09/2026 |
| GO-2026-6061 | Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc | 27/07/2026 |
| GHSA-hrxh-6v49-42gf | HIGH | gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities | 21/07/2026 |
| CVE-2026-33186 | CRITICAL9.1 | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., | 20/03/2026 |
| GO-2024-2978 | Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc | 09/07/2024 |
| GHSA-xr7q-jx4m-x55m | LOW | Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go | 05/07/2024 |
| GO-2023-2153 | Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc | 01/11/2023 |
| GHSA-m425-mq94-257g | HIGH7.5 | gRPC-Go HTTP/2 Rapid Reset vulnerability | 25/10/2023 |