Top technology
Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
MEDIUM 5.3
CVE-2026-39825
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function wh…
Go
1.25.10 / 1.26.3+
HIGH 7.5
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Go
1.25.10 / 1.26.3+
HIGH 7.5
CVE-2026-33814
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE…
Go
0.53.0 / 1.25.10+
MEDIUM 5.9
CVE-2026-39817
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extr…
Go
1.25.10 / 1.26.3+
HIGH 7.5
CVE-2026-33813
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Image
0.39.0+
MEDIUM 6.1
CVE-2026-33812
Parsing a malicious font file can cause excessive memory allocation.
Image
0.39.0+
CRITICAL 9.8
CVE-2026-27143
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid …
Go
1.25.9 / 1.26.2+
HIGH 8.2
CVE-2026-33810
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a …
Go
1.26.2+
HIGH 7.5
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in Verify…
Go
1.25.9 / 1.26.2+
HIGH 7.5
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontro…
Go
1.25.9 / 1.26.2+
HIGH 7.5
CVE-2026-32281
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy map…
Go
1.25.9 / 1.26.2+
HIGH 7.1
CVE-2026-27144
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the…
Go
1.25.9 / 1.26.2+
MEDIUM 6.4
CVE-2026-32282
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the sym…
Go
1.25.9 / 1.26.2+
MEDIUM 6.1
CVE-2026-32289
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches w…
Go
1.25.9 / 1.26.2+
MEDIUM 5.5
CVE-2026-32288
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded …
Go
1.25.9 / 1.26.2+
HIGH 8.8
CVE-2026-27140
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer…
Go
1.25.9 / 1.26.2+
MEDIUM 5.3
CVE-2026-33809
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or a…
Tiff
0.38.0+
MEDIUM 6.1
CVE-2026-27142
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv att…
Go
1.25.8+
HIGH 7.5
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Go
1.25.8+
HIGH 7.5
CVE-2026-27137
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but d…
Go
Mitigation only
MEDIUM 5.9
CVE-2026-27138
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name const…
Go
Mitigation only
CRITICAL 10.0
CVE-2025-68121
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the r…
Go
1.24.13 / 1.25.7+
HIGH 8.6
CVE-2025-61732
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Go
1.24.13 / 1.25.7+
HIGH 7.0
CVE-2025-68119
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading…
Go
1.24.12 / 1.25.6+
HIGH 7.8
CVE-2025-61731
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo …
Go
1.24.12 / 1.25.6+
HIGH 7.5
CVE-2025-61726
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generall…
Go
1.24.12 / 1.25.6+
MEDIUM 6.5
CVE-2025-61728
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial…
Go
1.24.12 / 1.25.6+
MEDIUM 5.3
CVE-2025-61730
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encryp…
Go
1.24.12 / 1.25.6+
MEDIUM 6.5
CVE-2025-61727
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constrain…
Go
1.24.11 / 1.25.5+
HIGH 7.5
CVE-2025-61729
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the …
Go
1.24.11 / 1.25.5+
Go
1.25.10 / 1.26.3+
HIGH 7.5
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Go
1.25.10 / 1.26.3+
HIGH 7.5
CVE-2026-33814
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE…
Go
0.53.0 / 1.25.10+
MEDIUM 5.9
CVE-2026-39817
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extr…
Go
1.25.10 / 1.26.3+
HIGH 7.5
CVE-2026-33813
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Image
0.39.0+
MEDIUM 6.1
CVE-2026-33812
Parsing a malicious font file can cause excessive memory allocation.
Image
0.39.0+
CRITICAL 9.8
CVE-2026-27143
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid …
Go
1.25.9 / 1.26.2+
HIGH 8.2
CVE-2026-33810
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a …
Go
1.26.2+
HIGH 7.5
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in Verify…
Go
1.25.9 / 1.26.2+
HIGH 7.5
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontro…
Go
1.25.9 / 1.26.2+
HIGH 7.5
CVE-2026-32281
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy map…
Go
1.25.9 / 1.26.2+
HIGH 7.1
CVE-2026-27144
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the…
Go
1.25.9 / 1.26.2+
MEDIUM 6.4
CVE-2026-32282
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the sym…
Go
1.25.9 / 1.26.2+
MEDIUM 6.1
CVE-2026-32289
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches w…
Go
1.25.9 / 1.26.2+
MEDIUM 5.5
CVE-2026-32288
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded …
Go
1.25.9 / 1.26.2+
HIGH 8.8
CVE-2026-27140
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer…
Go
1.25.9 / 1.26.2+
MEDIUM 5.3
CVE-2026-33809
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or a…
Tiff
0.38.0+
MEDIUM 6.1
CVE-2026-27142
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv att…
Go
1.25.8+
HIGH 7.5
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Go
1.25.8+
HIGH 7.5
CVE-2026-27137
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but d…
Go
Mitigation only
MEDIUM 5.9
CVE-2026-27138
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name const…
Go
Mitigation only
CRITICAL 10.0
CVE-2025-68121
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the r…
Go
1.24.13 / 1.25.7+
HIGH 8.6
CVE-2025-61732
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Go
1.24.13 / 1.25.7+
HIGH 7.0
CVE-2025-68119
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading…
Go
1.24.12 / 1.25.6+
HIGH 7.8
CVE-2025-61731
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo …
Go
1.24.12 / 1.25.6+
HIGH 7.5
CVE-2025-61726
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generall…
Go
1.24.12 / 1.25.6+
MEDIUM 6.5
CVE-2025-61728
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial…
Go
1.24.12 / 1.25.6+
MEDIUM 5.3
CVE-2025-61730
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encryp…
Go
1.24.12 / 1.25.6+
MEDIUM 6.5
CVE-2025-61727
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constrain…
Go
1.24.11 / 1.25.5+
HIGH 7.5
CVE-2025-61729
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the …
Go
1.24.11 / 1.25.5+