Latest vulnerabilities for vendor "golang"

Golang GoInvoking Encrypted Client Hello privacy leak in crypto/tls

Risk 30

Severity

5.3

First published (updated )

CVE-2026-42505

Golang GoRoot escape via symlink plus trailing slash in os

Risk 74

Severity

7.8

Trending

Month

First published (updated )

CVE-2026-39822

golang.org/x/image/tiffPanic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

Risk 43

Severity

7.5

First published (updated )

CVE-2026-46604

Traefik traefikTraefik - Denial of Service via HTTP/2 Request Handling

Risk 47

Severity

8.7

First published (updated )

CVE-2023-54365

Microsoft azl3 docker-compose 2.27.0-9Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-27136

Microsoft azl3 prometheus-adapter 0.12.0-5Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Risk 37

Severity

6.5

First published (updated )

CVE-2026-25680

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-42502

Microsoft azl3 telegraf 1.31.0-19Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-42506

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-25681

Microsoft azl3 prometheus-process-exporter 0.8.2-3Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Risk 68

Severity

10

First published (updated )

CVE-2026-39821

go/golang.org/x/crypto/sshInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Risk 47

Severity

7.5

First published (updated )

CVE-2026-39829

go/golang.org/x/crypto/sshInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Risk 88

Severity

10

First published (updated )

CVE-2026-46595

golang/golang.org/x/crypto/sshInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Risk 71

Severity

9.1

First published (updated )

CVE-2026-39830

go/golang.org/x/crypto/ssh/agentInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

Risk 29

Severity

5.3

First published (updated )

CVE-2026-46598

go/golang.org/x/crypto/ssh/knownhostsInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Risk 71

Severity

9.1

First published (updated )

CVE-2026-42508

go/golang.org/x/crypto/sshInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

Risk 41

Severity

6.5

First published (updated )

CVE-2026-39827

golang.org/x/crypto/sshInvoking infinite loop on large channel writes in golang.org/x/crypto/ssh

Risk 71

Severity

9.1

First published (updated )

CVE-2026-39834

go/golang.org/x/crypto/sshInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

Risk 71

Severity

9.1

First published (updated )

CVE-2026-39831

golang/golang.org/x/crypto/ssh/agentInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent

Risk 71

Severity

9.1

First published (updated )

CVE-2026-39833

Microsoft azl3 kubevirt 1.7.1-2Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Risk 47

Severity

7.5

First published (updated )

CVE-2026-39835

go/golang.org/x/crypto/sshInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Risk 85

Severity

8.8

First published (updated )

CVE-2026-39828

go/golang.org/x/crypto/ssh/agentInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Risk 71

Severity

9.1

First published (updated )

CVE-2026-39832

golang/golang.org/x/crypto/sshInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Risk 47

Severity

7.5

First published (updated )

CVE-2026-46597

Golang GoBypass of meta content URL escaping causes XSS in html/template

Risk 40

Severity

6.1

First published (updated )

CVE-2026-39823

Golang GoQuadratic string concatentation in consumeComment in net/mail

Risk 46

Severity

7.5

First published (updated )

CVE-2026-39820

Golang GoCrash when handling long CNAME response in net

Risk 46

Severity

7.5

First published (updated )

CVE-2026-33811

Golang GoEscaper bypass leads to XSS in html/template

Risk 40

Severity

6.1

First published (updated )

CVE-2026-39826

Golang GoMalicious module proxy can bypass checksum database in cmd/go

Risk 72

Severity

7.5

First published (updated )

CVE-2026-42501

Golang GoPanic in Dial and LookupPort when handling NUL byte on Windows in net

Risk 45

Severity

7.5

First published (updated )

CVE-2026-39836

Golang GoInvoking "go tool pack" does not sanitize output paths in cmd/go

Risk 35

Severity

5.9

First published (updated )

CVE-2026-39817

Trending

Vendor Risk Score

Software

Golang GoInvoking Encrypted Client Hello privacy leak in crypto/tls

Golang GoRoot escape via symlink plus trailing slash in os

golang.org/x/image/tiffPanic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

Traefik traefikTraefik - Denial of Service via HTTP/2 Request Handling

Microsoft azl3 docker-compose 2.27.0-9Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Don't miss critical vulnerabilities

Microsoft azl3 prometheus-adapter 0.12.0-5Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Microsoft azl3 telegraf 1.31.0-19Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Microsoft azl3 prometheus-process-exporter 0.8.2-3Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Don't miss critical vulnerabilities

go/golang.org/x/crypto/sshInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

go/golang.org/x/crypto/sshInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

golang/golang.org/x/crypto/sshInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

go/golang.org/x/crypto/ssh/agentInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

go/golang.org/x/crypto/ssh/knownhostsInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Don't miss critical vulnerabilities

go/golang.org/x/crypto/sshInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

golang.org/x/crypto/sshInvoking infinite loop on large channel writes in golang.org/x/crypto/ssh

go/golang.org/x/crypto/sshInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

golang/golang.org/x/crypto/ssh/agentInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent

Microsoft azl3 kubevirt 1.7.1-2Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Don't miss critical vulnerabilities

go/golang.org/x/crypto/sshInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh

go/golang.org/x/crypto/ssh/agentInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

golang/golang.org/x/crypto/sshInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Golang GoBypass of meta content URL escaping causes XSS in html/template

Golang GoQuadratic string concatentation in consumeComment in net/mail

Don't miss critical vulnerabilities

Golang GoCrash when handling long CNAME response in net

Golang GoEscaper bypass leads to XSS in html/template

Golang GoMalicious module proxy can bypass checksum database in cmd/go

Golang GoPanic in Dial and LookupPort when handling NUL byte on Windows in net

Golang GoInvoking "go tool pack" does not sanitize output paths in cmd/go

Don't miss critical vulnerabilities

Company

Resources

Contact