Skip to content
OpenAdvisories

Ecosystem

Go

5,231 known vulnerabilities.

Most affected packages

github.com/mattermost/mattermost-server 296 github.com/mattermost/mattermost-server/v6 222 github.com/mattermost/mattermost/server/v8 207 github.com/mattermost/mattermost-server/v5 199 stdlib 182 code.gitea.io/gitea 123 github.com/siyuan-note/siyuan/kernel 113 gogs.io/gogs 76 github.com/usememos/memos 75 github.com/traefik/traefik 69 github.com/traefik/traefik/v2 68 code.vikunja.io/api 67 github.com/grafana/grafana 66 github.com/traefik/traefik/v3 61 github.com/rancher/rancher 60 github.com/hashicorp/vault 55 github.com/zitadel/zitadel 52 github.com/argoproj/argo-cd 50 k8s.io/kubernetes 50 github.com/argoproj/argo-cd/v2 48 toolchain 45 gitea.dev 44 github.com/filebrowser/filebrowser/v2 44 github.com/filebrowser/filebrowser 43 github.com/0xJacky/Nginx-UI 41 github.com/cilium/cilium 39 golang.org/x/net 38 github.com/docker/docker 36 github.com/answerdev/answer 34 github.com/hashicorp/nomad 34 github.com/openbao/openbao 33 github.com/fleetdm/fleet/v4 32 golang.org/x/crypto 32 github.com/lxc/incus/v6 32 github.com/hashicorp/consul 32 github.com/lxc/incus 32 github.com/rclone/rclone 29 github.com/nats-io/nats-server/v2 28 github.com/coder/coder 28 github.com/coder/coder/v2 28
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli nodejs dotnet7 Debian Ubuntu Alpine PyPI Go Hex
    KEV Oct 27, 2026
  • Critical 9.8
    CVE-2026-60004 Exploited Public exploit EPSS 24%

    Gitea: Remote Code Execution via diffpatch Git Hook Installation

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Gitea Gitea code.gitea.io/gitea gitea.dev Alpine Go
    KEV Aug 25, 2026
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Critical 9.9
    CVE-2025-24016 Exploited Public exploit EPSS 94%

    Remote code execution in Wazuh server

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI param…

    wazuh wazuh github.com/wazuh/wazuh Go
    KEV Jun 10, 2025