go
Security Risk Profile
43
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 63 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 7, 2022 to present
63
Total CVEs
26
Critical+High
1
Exploited
18
Unpatched
Threat Assessment
Avg CVSS
6.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
18
Critical/High
Risk Level
43/100
medium
⚠️ 1 Active Exploits🆕 1Fresh (<7d)📈 2 in Last 30 Days
Severity Distribution
Critical
2High
24Medium
21Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
4Age Distribution
Common Weaknesses (CWE)
1
Path Traversal
2
2
XSS
1
3
Integer Overflow
1
4
Code Injection
1
5
CSRF
1
Most Affected Products
1. Golang Go32
2. go Go16
3. go crypto/x5096
4. go crypto/tls4
5. IBM Concert Software4
Recent Vulnerabilities
See more →CVE-2026-39822
CVSS 7.8high
Root escape via symlink plus trailing slash in os
7/8/2026🔧 No Patch
REDHAT-BUG-2484207
CVSS 7.0high
6/2/2026🔧 No Patch
CVE-2026-42504
CVSS 7.5high
Quadratic complexity in WordDecoder.DecodeHeader in mime
6/2/2026
https://seclists.org/oss-sec/2026/q2/454
unknown
Go 1.26.3 and Go 1.25.10 aleased with 11 security fixes
5/8/2026🔧 No Patch
REDHAT-BUG-2467823
CVSS 4.0medium
5/7/2026🔧 No Patch
REDHAT-BUG-2467825
CVSS 4.0medium
5/7/2026🔧 No Patch
REDHAT-BUG-2467822
CVSS 7.0high
5/7/2026🔧 No Patch
CVE-2026-39823
CVSS 6.1medium
Bypass of meta content URL escaping causes XSS in html/template
5/7/2026🔧 No Patch
CVE-2026-39817
CVSS 5.9medium
Invoking "go tool pack" does not sanitize output paths in cmd/go
5/7/2026
CVE-2026-39819
CVSS 5.3medium
Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
5/7/2026
Monitor go in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.