Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Aug 13, 2026Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quaCVE-2026-56860 · Other software · Go standard library · reported by security@golang.orgMedium 5.9
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
- Product
- net/url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- Product
- net/url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering.CVE-2025-15562 · Other software · NesterSoft Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker.
- Product
- WorkTime (on-prem/cloud)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026The net/url package does not set a limit on the number of query parameters in a query.CVE-2025-61726 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
- Product
- net/url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL.CVE-2025-47912 · Other software · Go standard library · reported by security@golang.orgMedium 5.3
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
- Product
- net/url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path.CVE-2022-32190 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
- Product
- net/url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2019net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications.CVE-2019-14809 · Other software · Golang · reported by MITRECritical 9.8
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.