Go github.com/zitadel/zitadel/v2

Name: Go github.com/zitadel/zitadel/v2
Brand: Go

productUS

pkg:golang/github.com/zitadel/zitadel/v2

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

unpatched

by severity

3critical4high4medium0low

updated 2026-10-28

vulnerabilities (15)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-67494US	high8.6	0.44% (38th)	Exploit	1.80.0-v2.20.0.20251208091519-4c879b47334e	2025-12-09	< 1.80.0-v2.20.0.20251208091519-4c879b47334e
CVE-2025-27507US	—OT elevated	0.61% (49th)	—	2.67.8	2025-03-04	8 versions
CVE-2026-29191US	—	0.42% (36th)	—	4.12.0	2026-03-07	4.0.0 → 4.12.0
CVE-2025-48936US	high8.8	0.41% (35th)	—	3.2.2	2025-05-30	4 versions
CVE-2024-47000US	high7.5	0.41% (35th)	—	2.54.10	2024-09-20	9 versions
CVE-2025-64102US	critical9.8	0.37% (31st)	—	2.71.18	2025-10-29	< 2.71.18
CVE-2025-64101US	high8.8	0.36% (30th)	—	1.80.0-v2.20.0.20251029090537-72a5c33e6ac3	2025-10-29	2 versions
CVE-2024-47060US	medium6.5OT elevated	0.36% (29th)	—	2.55.8	2024-09-20	9 versions
CVE-2025-64103US	critical9.8	0.35% (29th)	—	2.71.18	2025-10-29	3 versions
CVE-2024-46999US	medium6.5	0.35% (29th)	—	2.55.8	2024-09-20	9 versions
CVE-2026-29067US	critical9.3	0.34% (28th)	—	1.80.0-v2.20.0.20251208091519-4c879b47334e	2026-03-07	< 1.80.0-v2.20.0.20251208091519-4c879b47334e
CVE-2026-29193US	—	0.33% (26th)	—	4.12.1	2026-03-07	4.0.0 → 4.12.1
CVE-2026-29192US	—	0.33% (26th)	—	4.12.0	2026-03-07	4.0.0 → 4.12.0
CVE-2025-67495US	medium6.1	0.30% (23rd)	—	1.80.0-v2.20.0.20251208091519-4c879b47334e	2025-12-09	< 1.80.0-v2.20.0.20251208091519-4c879b47334e
CVE-2026-27945US	medium6.5	0.26% (17th)	—	4.11.1	2026-02-26	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-601URL Redirection to Untrusted Site ('Open Redirect')3 CVEs
CWE-672Operation on a Resource after Expiration or Release3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-269Improper Privilege Management2 CVEs
CWE-287Improper Authentication2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.