Go github.com/zitadel/zitadel

Name: Go github.com/zitadel/zitadel
Brand: Go

productUS

pkg:golang/github.com/zitadel/zitadel

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

5critical9high15medium1low

updated 2026-10-28

vulnerabilities (52)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-32868US	high8.1	0.46% (39th)	Exploit	2.50.0	2024-04-26	2 versions
CVE-2025-67494US	high8.6	0.44% (38th)	Exploit	4.7.1	2025-12-09	4 versions
CVE-2024-49757US	medium4.9	2.52% (85th)	—	2.61.4	2024-10-25	7 versions
CVE-2022-36051US	high8.8OT elevated	1.01% (63rd)	—	2.2.0	2022-08-31	2 versions
CVE-2024-28855US	medium6.1	0.78% (56th)	—	2.41.15	2024-03-18	10 versions
CVE-2023-49097US	high8.8	0.77% (55th)	—	2.39.9	2023-11-30	3 versions
CVE-2024-29892US	medium4.9OT elevated	0.77% (55th)	—	2.48.3	2024-03-27	8 versions
CVE-2024-29891US	high8.7	0.76% (55th)	—	2.43.11	2024-03-27	8 versions
CVE-2023-44399US	medium5.3	0.66% (52nd)	—	2.37.3	2023-10-10	< 2.37.3
CVE-2024-49753US	critical9.1	0.65% (51st)	—	0.0.0-20241022141644-79fb4cc1cc6e	2024-10-25	10 versions
CVE-2024-41953US	medium6.1	0.65% (51st)	—	1.80.0-v2.20.0.20240731122110-189505c80fa6	2024-07-31	10 versions
CVE-2024-32967US	medium5.3	0.64% (50th)	—	2.47.10	2024-05-01	6 versions
CVE-2024-41952US	medium5.3	0.63% (50th)	—	1.80.0-v2.20.0.20240731122357-a1d24353db4d	2024-07-31	9 versions
CVE-2023-22492US	medium5.9	0.63% (50th)	—	2.16.4	2023-01-11	2 versions
CVE-2024-39683US	medium6.5	0.61% (49th)	—	2.54.5	2024-07-03	4 versions
CVE-2025-27507US	—OT elevated	0.61% (49th)	—	2.67.8	2025-03-04	9 versions
CVE-2026-54693US	—OT elevated	0.58% (47th)	—	1.80.0-v2.20.0.20260608144108-ed09b3df7f43	2026-07-29	4 versions
CVE-2023-47111US	low3.7	0.52% (44th)	—	2.38.3	2023-11-08	2 versions
CVE-2025-64717US	critical9.8	0.50% (42nd)	—	1.80.0-v2.20.0.20251112124840-33c51deb2040	2025-11-13	4 versions
CVE-2026-44671US	—	0.48% (41st)	—	3.4.10	2026-05-14	4 versions
CVE-2025-46815US	—OT elevated	0.46% (40th)	—	2.71.9	2025-05-06	4 versions
CVE-2026-55672US	—OT elevated	0.43% (37th)	—	1.80.0-v2.20.0.20260616131956-0973b074b488	2026-07-10	< 1.80.0-v2.20.0.20260616131956-0973b074b488
CVE-2026-29191US	—	0.42% (36th)	—	4.12.0	2026-03-07	2 versions
CVE-2026-55671US	—	0.41% (35th)	—	1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2	2026-07-10	< 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2
CVE-2026-56668US	—OT elevated	0.41% (35th)	—	4.15.3	2026-07-10	2 versions
CVE-2025-48936US	high8.8	0.41% (35th)	—	0.0.0-20250528081227-c097887bc5f6	2025-05-30	< 0.0.0-20250528081227-c097887bc5f6
CVE-2024-47000US	high7.5	0.41% (35th)	—	no fix	2024-09-20	—
CVE-2026-23511US	—	0.40% (34th)	—	4.9.1	2026-01-15	3 versions
CVE-2026-76081US	—	0.40% (34th)	—	4.16.0	2026-09-14	2 versions
CVE-2026-85057US	—	0.39% (33rd)	—	1.80.0-v2.20.0.20260717062331-baf6ed501b68	2026-09-24	< 1.80.0-v2.20.0.20260717062331-baf6ed501b68
CVE-2025-64102US	critical9.8	0.37% (31st)	—	1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8	2025-10-29	2 versions
CVE-2025-64101US	high8.8	0.36% (30th)	—	no fix	2025-10-29	—
CVE-2026-55670US	—	0.36% (30th)	—	1.80.0-v2.20.0.20260615092437-6082e59d47c1	2026-07-10	< 1.80.0-v2.20.0.20260615092437-6082e59d47c1
CVE-2024-47060US	medium6.5OT elevated	0.36% (29th)	—	no fix	2024-09-20	—
CVE-2025-64103US	critical9.8	0.35% (29th)	—	1.80.0-v2.20.0.20251029091250-b284f8474eed	2025-10-29	2 versions
CVE-2024-46999US	medium6.5	0.35% (29th)	—	no fix	2024-09-20	—
CVE-2026-29067US	critical9.3	0.34% (28th)	—	1.80.0-v2.20.0.20251208091519-4c879b47334e	2026-03-07	4 versions
CVE-2024-28197US	high7.5	0.34% (27th)	—	2.45.1	2024-03-11	3 versions
CVE-2026-29193US	—	0.33% (26th)	—	4.12.1	2026-03-07	2 versions
CVE-2026-29192US	—	0.33% (26th)	—	4.12.0	2026-03-07	2 versions
CVE-2026-56664US	—	0.32% (25th)	—	1.80.0-v2.20.0.20260615122908-fad02c6d9f45	2026-07-10	< 1.80.0-v2.20.0.20260615122908-fad02c6d9f45
CVE-2026-33132US	—OT elevated	0.32% (24th)	—	3.4.9	2026-03-20	3 versions
CVE-2025-64431US	—	0.30% (23rd)	—	4.6.3	2025-11-07	2 versions
CVE-2025-67495US	medium6.1	0.30% (23rd)	—	1.80.0-v2.20.0.20251208091519-4c879b47334e	2025-12-09	4 versions
CVE-2026-85056US	—	0.29% (21st)	—	1.80.0-v2.20.0.20260717062356-56f4798ed31f	2026-09-24	< 1.80.0-v2.20.0.20260717062356-56f4798ed31f
CVE-2026-56666US	—	0.29% (21st)	—	4.15.3	2026-07-10	2 versions
CVE-2026-56665US	—	0.27% (18th)	—	3.4.12	2026-07-10	3 versions
CVE-2026-27945US	medium6.5	0.26% (17th)	—	1.80.0-v2.20.0.20260225053328-b2532e966621	2026-02-26	< 1.80.0-v2.20.0.20260225053328-b2532e966621
CVE-2025-67717US	medium4.3	0.22% (13th)	—	4.7.2	2025-12-11	3 versions
CVE-2026-27946US	medium6.5OT elevated	0.22% (12th)	—	1.80.0-v2.20.0.20260225053417-0261536243e5	2026-02-26	3 versions

showing 50 of 52

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-287Improper Authentication8 CVEs
CWE-863Incorrect Authorization7 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-613Insufficient Session Expiration4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-269Improper Privilege Management3 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')3 CVEs
CWE-639Authorization Bypass Through User-Controlled Key3 CVEs

sources (1)

Which sources assert this record, and when.

USOSV.dev52 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan