Skip to content
OpenAdvisories

Ecosystem

Go

5,231 known vulnerabilities.

Most affected packages

github.com/mattermost/mattermost-server 296 github.com/mattermost/mattermost-server/v6 222 github.com/mattermost/mattermost/server/v8 207 github.com/mattermost/mattermost-server/v5 199 stdlib 182 code.gitea.io/gitea 123 github.com/siyuan-note/siyuan/kernel 113 gogs.io/gogs 76 github.com/usememos/memos 75 github.com/traefik/traefik 69 github.com/traefik/traefik/v2 68 code.vikunja.io/api 67 github.com/grafana/grafana 66 github.com/traefik/traefik/v3 61 github.com/rancher/rancher 60 github.com/hashicorp/vault 55 github.com/zitadel/zitadel 52 github.com/argoproj/argo-cd 50 k8s.io/kubernetes 50 github.com/argoproj/argo-cd/v2 48 toolchain 45 gitea.dev 44 github.com/filebrowser/filebrowser/v2 44 github.com/filebrowser/filebrowser 43 github.com/0xJacky/Nginx-UI 41 github.com/cilium/cilium 39 golang.org/x/net 38 github.com/docker/docker 36 github.com/answerdev/answer 34 github.com/hashicorp/nomad 34 github.com/openbao/openbao 33 github.com/fleetdm/fleet/v4 32 golang.org/x/crypto 32 github.com/lxc/incus/v6 32 github.com/hashicorp/consul 32 github.com/lxc/incus 32 github.com/rclone/rclone 29 github.com/nats-io/nats-server/v2 28 github.com/coder/coder 28 github.com/coder/coder/v2 28
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli nodejs dotnet7 Debian Ubuntu Alpine PyPI Go Hex
    KEV Oct 27, 2026
  • Critical 9.8
    CVE-2026-60004 Exploited Public exploit EPSS 24%

    Gitea: Remote Code Execution via diffpatch Git Hook Installation

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Gitea Gitea code.gitea.io/gitea gitea.dev Alpine Go
    KEV Aug 25, 2026
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • High 8.7
    CVE-2025-8110 Exploited Public exploit EPSS 80%

    File overwrite in file update API in Gogs

    Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

    Gogs Gogs gogs.io/gogs Go
    KEV Jan 12, 2026
  • Critical 9.9
    CVE-2025-24016 Exploited Public exploit EPSS 94%

    Remote code execution in Wazuh server

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI param…

    wazuh wazuh github.com/wazuh/wazuh Go
    KEV Jun 10, 2025
  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs go dotnet7 trafficserver Debian Ubuntu Alpine Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 8.8
    CVE-2023-4863 Exploited Public exploit EPSS 100%

    libwebp: OOB write in BuildHuffmanTable

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

    Google Chrome libwebp chromium Browsers Debian Ubuntu Alpine npm PyPI Go crates.io NuGet
    KEV Sep 13, 2023
  • High 8.8
    CVE-2023-28434 Exploited Public exploit

    MinIO is vulnerable to privilege escalation on Linux/MacOS

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…

    minio minio github.com/minio/minio Go
    KEV Sep 19, 2023
  • High 7.5
    CVE-2021-43798 Exploited Public exploit EPSS 89%

    Grafana path traversal

    Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url…

    Grafana Grafana github.com/grafana/grafana grafana Web / CMS Alpine Go
    KEV Oct 9, 2025
  • High 8.1
    CVE-2020-0601 Exploited Public exploit EPSS 89%

    Certificate validation bypass on Windows in crypto/x509

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows Alpine Go
    KEV Nov 3, 2021