Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2025-3757
- CVE-2025-4128, GHSA-jwhw-xf5v-qgxc
- Affects: github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5, and 2 more
- Published: Jun 11, 2025
Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server
GO-2025-3756
- CVE-2025-4573, GHSA-4r67-4x4p-fprg
- Affects: github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5, and 2 more
- Published: Jun 11, 2025
Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server
GO-2025-3755
- GHSA-79xg-q4qm-7v9w
- Affects: github.com/CosmWasm/wasmd
- Published: Jun 12, 2025
CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error in github.com/CosmWasm/wasmd
GO-2025-3754
- GHSA-2x5j-vhc8-9cwm
- Affects: github.com/cloudflare/circl
- Published: Jun 11, 2025
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl
GO-2025-3751
- CVE-2025-4673
- Affects: net/http
- Published: Jun 11, 2025
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.