CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 22/05/2026 |
| CVE-2026-39828 | 보통6.3 | When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connec | 22/05/2026 |
| CVE-2026-39827 | 보통6.5 | An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. | 22/05/2026 |
| CVE-2026-42501 | 높음7.5 | A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. | 07/05/2026 |
| CVE-2026-42499 | 높음7.5 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | 07/05/2026 |
| CVE-2026-39836 | 높음7.5 | The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). | 07/05/2026 |
| CVE-2026-39826 | 보통6.1 | If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block. | 07/05/2026 |
| CVE-2026-39825 | 보통5.3 | ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take Par | 07/05/2026 |
| CVE-2026-39823 | 보통6.1 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. | 07/05/2026 |
| CVE-2026-39820 | 높음7.5 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. | 07/05/2026 |
| CVE-2026-39819 | 보통5.3 | The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink. | 07/05/2026 |
| CVE-2026-39817 | 보통5.9 | The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem. | 07/05/2026 |
| CVE-2026-33814 | 높음7.5 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | 07/05/2026 |
| CVE-2026-33811 | 높음7.5 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | 07/05/2026 |
| CVE-2026-42503 | 높음8.8 | gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious | 06/05/2026 |
| CVE-2026-33813 | 높음7.5 | Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. | 21/04/2026 |
| CVE-2026-33812 | 보통6.1 | Parsing a malicious font file can cause excessive memory allocation. | 21/04/2026 |
| CVE-2026-33810 | 높음8.2 | When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in th | 08/04/2026 |