Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Oct 8, 2026Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the useCVE-2026-94447 · Other software · Go toolchain · reported by security@golang.orgHigh 7.8
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to coCVE-2026-94444 · Other software · Go toolchain · reported by security@golang.orgHigh 7.8
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-cCVE-2026-56865 · Other software · Go toolchain · reported by security@golang.orgHigh 8.4
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.CVE-2026-56864 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation.CVE-2026-42501 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp").CVE-2026-39819 · Other software · Go toolchain · reported by security@golang.orgMedium 5.3
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames.CVE-2026-39817 · Other software · Go toolchain · reported by security@golang.orgMedium 5.9
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.CVE-2026-27140 · Other software · Go toolchain · reported by security@golang.orgHigh 8.8
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Downloading and building modules with malicious version strings can cause local code execution.CVE-2025-68119 · Other software · Go toolchain · reported by security@golang.orgHigh 7
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.CVE-2025-61731 · Other software · Go toolchain · reported by security@golang.orgHigh 7.8
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025The go command may execute unexpected commands when operating in untrusted VCS repositories.CVE-2025-4674 · Other software · Go toolchain · reported by security@golang.orgHigh 8.6
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_pathCVE-2025-22867 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not CVE-2024-45340 · Other software · Go toolchain · reported by security@golang.orgHigh 8.8
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Command go env is documented as outputting a shell script containing the Go environment.CVE-2023-24531 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flaCVE-2024-24787 · Other software · Go toolchain · reported by security@golang.orgMedium 6.4
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "hCVE-2023-45285 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compCVE-2023-39323 · Other software · Go toolchain · reported by security@golang.orgHigh 8.1
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" commandCVE-2023-39320 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023The go command may execute arbitrary code at build time when using cgo.CVE-2023-29405 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023The go command may execute arbitrary code at build time when using cgo.CVE-2023-29404 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023The go command may generate unexpected code at build time when using cgo.CVE-2023-29402 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.CVE-2022-23773 · Other software · Golang · reported by MITREHigh 7.5
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comsecurity.gentoo.org
Nov 18, 2020Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a CVE-2020-28367 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in CVE-2020-28366 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.