Vendor
Go
4,564 known vulnerabilities in products by Go, 6 of them actively exploited (CISA KEV).
Key figures
4,564
Vulnerabilities
6
Actively exploited (KEV)
0
Used by ransomware
685
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2026-60004 | Gitea: Remote Code Execution via diffpatch Git Hook Installation In CISA KEV | 9.8 | |
| Critical | CVE-2025-24016 | Remote code execution in Wazuh server In CISA KEV | 9.9 | |
| Critical | CVE-2021-39226 | Snapshot authentication bypass in grafana In CISA KEV | 9.8 | |
| Critical | CVE-2023-28434 | MinIO is vulnerable to privilege escalation on Linux/MacOS In CISA KEV | 8.8 | |
| Critical | CVE-2021-43798 | Grafana path traversal In CISA KEV | 7.5 | |
| Critical | CVE-2026-33634 | Trivy ecosystem supply chain briefly compromised In CISA KEV | 8.8 | |
| Critical | CVE-2026-52806 | Gogs: RCE via git rebase --exec argument injection in pull request merge | 9.9 | |
| Critical | CVE-2025-1974 | ingress-nginx admission controller RCE escalation | 9.8 | |
| Critical | CVE-2024-9264 | Grafana SQL Expressions allow for remote code execution | 9.9 | |
| Critical | CVE-2025-44005 | Smallstep Step-CA: Improper Authentication | 10.0 | |
| Critical | CVE-2024-45387 | Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments | 9.9 | |
| Critical | CVE-2026-41179 | Rclone: OS Command Injection | 9.8 | |
| Critical | CVE-2025-25279 | Arbitrary file read in Mattermost Boards via import & export board archive | 9.9 | |
| Critical | CVE-2024-39931 | Gogs: security vulnerability | 9.9 | |
| Critical | CVE-2024-6886 | Inproper Sanitation of field leading to stored XSS | — | |
| Critical | CVE-2025-54123 | SpectoLabs Hoverfly: OS Command Injection | 9.8 | |
| Critical | CVE-2026-6987 | PicoClaw Web Launcher Management Plane restart command injection | 7.3 | |
| Critical | CVE-2023-27584 | Dragonfly2 vulnerable to hard coded cyptographic key | 9.8 | |
| Critical | CVE-2024-45337 | Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto | 9.1 | |
| High | CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | 8.8 | |
| Critical | CVE-2024-39907 | a sqlinjection in 1Panel | 9.8 | |
| Critical | CVE-2022-2024 | OS Command Injection in gogs/gogs | 9.8 | |
| Critical | CVE-2024-41110 | Moby authz zero length regression | 10.0 | |
| Critical | CVE-2026-42589 | Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection | 9.8 | |
| High | CVE-2025-62725 | Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations | — |
News
- CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlinessans-newsbites-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payloadthehackernews,
- CISA Warns of Exploited Gitea Vulnerabilitysecurityweek,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- 17 old software bugs that took way too long to squashcsoonline,