Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
- CVE-2026-73087, GHSA-p2w3-6x73-2f6x
- Affects: github.com/amir20/dozzle
- Published: Sep 10, 2026
- Unreviewed
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle
- CVE-2026-71493, GHSA-mmg6-4qmv-6pc8
- Affects: github.com/infracost/infracost
- Published: Sep 10, 2026
- Unreviewed
Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost
- CVE-2026-71494, GHSA-6x6c-w9w9-hv4h
- Affects: github.com/infracost/infracost
- Published: Sep 10, 2026
- Unreviewed
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname in github.com/infracost/infracost
- CVE-2026-73294, GHSA-xp7j-h7jc-4w8p
- Affects: github.com/semaphoreui/semaphore
- Published: Sep 10, 2026
- Unreviewed
Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore
- CVE-2026-72789, GHSA-v684-q882-jgmq
- Affects: github.com/siyuan-note/siyuan/kernel
- Published: Sep 10, 2026
- Unreviewed
SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.