Package · Wolfi

trust-package

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 8.8

CVE-2026-27140

Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Go toolchain cmd/go renovate golang Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 8.6

CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026