Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2026-6440
- CVE-2026-73087, GHSA-p2w3-6x73-2f6x
- Affects: github.com/amir20/dozzle
- Published: Sep 10, 2026
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle
GO-2026-6439
- CVE-2026-71493, GHSA-mmg6-4qmv-6pc8
- Affects: github.com/infracost/infracost
- Published: Sep 10, 2026
Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost
GO-2026-6437
- CVE-2026-71494, GHSA-6x6c-w9w9-hv4h
- Affects: github.com/infracost/infracost
- Published: Sep 10, 2026
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname in github.com/infracost/infracost
GO-2026-6435
- CVE-2026-73294, GHSA-xp7j-h7jc-4w8p
- Affects: github.com/semaphoreui/semaphore
- Published: Sep 10, 2026
Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore
GO-2026-6434
- CVE-2026-72789, GHSA-v684-q882-jgmq
- Affects: github.com/siyuan-note/siyuan/kernel
- Published: Sep 10, 2026
SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.