Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Aug 7, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-71557 · Other software · go-git · reported by GitHubMedium 6.3
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-71556 · Other software · go-git · reported by GitHubHigh 7.1
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Billy is an interface filesystem abstraction for Go.CVE-2026-44740 · Other software · go-git · reported by GitHubMedium 6.5
Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
- Product
- go-billy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Billy is an interface filesystem abstraction for Go.CVE-2026-44973 · Other software · go-git · reported by GitHubHigh 8.1
Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.
- Product
- go-billy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-45571 · Other software · go-git · reported by GitHubMedium 5.4
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-45570 · Other software · go-git · reported by GitHubLow 2.3
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-45022 · Other software · go-git · reported by GitHubHigh 7
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-41506 · Other software · go-git · reported by GitHubMedium 4.7
go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-34165 · Other software · go-git · reported by GitHubMedium 5
go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026go-git is an extensible git implementation library written in pure Go.CVE-2026-33762 · Other software · go-git · reported by GitHubLow 2.8
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026go-git is a highly extensible git implementation library written in pure Go.CVE-2026-25934 · Other software · go-git · reported by GitHubMedium 4.3
go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025go-git is a highly extensible git implementation library written in pure Go.CVE-2025-21614 · Other software · go-git · reported by GitHubHigh 7.5
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025go-git is a highly extensible git implementation library written in pure Go.CVE-2025-21613 · Other software · go-git · reported by GitHubCritical 9.2
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024A path traversal vulnerability was discovered in go-git versions prior to v5.11.CVE-2023-49569 · Other software · go-git · reported by cve-requests@bitdefender.comCritical 9.8
A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11.CVE-2023-49568 · Other software · go-git · reported by cve-requests@bitdefender.comHigh 7.5
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.
- Product
- go-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.CVE-2023-3515 · Other software · go-gitea · reported by security@huntr.devMedium 4.4
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
- Product
- go-gitea/gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.CVE-2022-1928 · Other software · go-gitea · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.
- Product
- go-gitea/gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.CVE-2022-1058 · Other software · go-gitea · reported by security@huntr.devMedium 6.1
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.
- Product
- go-gitea/gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.CVE-2022-0905 · Other software · go-gitea · reported by security@huntr.devHigh 7.1
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
- Product
- go-gitea/gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.