Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
- CVE-2026-12411, GHSA-hhf9-qw4v-72xp
- Affects: github.com/canonical/lxd
- Published: Nov 05, 2026
LXD allows cross-guest volume hijack via DevLXD device patch in github.com/canonical/lxd
- CVE-2026-13218, GHSA-q3jc-42cq-33fj
- Affects: kubevirt.io/kubevirt
- Published: Nov 05, 2026
- Unreviewed
KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite in kubevirt.io/kubevirt
- CVE-2026-55098, GHSA-93cm-2v4m-c56c
- Affects: github.com/basekick-labs/arc
- Published: Nov 05, 2026
- Unreviewed
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc
- CVE-2026-13322, GHSA-6f2p-2qg2-qqch
- Affects: kubevirt.io/kubevirt
- Published: Nov 05, 2026
- Unreviewed
KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption in kubevirt.io/kubevirt
- Affects: github.com/mark3labs/mcp-go
- Published: Nov 05, 2026
In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer. If an MCP server responds with a 3xx redirect, the client follows the Location header to arbitrary hosts and schemes and attaches configured WithHeaders and OAuth Authorization headers to the redirected request, enabling server-side request forgery (SSRF) and credential disclosure.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.