Product by Go
Toolchain
14 known vulnerabilities in Toolchain (Go), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2018-7187 | Go: security vulnerability | 8.8 | |
| Critical | CVE-2017-15041 | Go: security vulnerability | 9.8 | |
| High | CVE-2018-16873 | Golang: Improper Input Validation | 7.5 | |
| High | CVE-2018-6574 | Go: security vulnerability | 7.8 | |
| High | CVE-2018-16874 | Golang: Improper Input Validation | 6.8 | |
| High | CVE-2020-28367 | Arbitrary code execution via the go command with cgo in cmd/go | 7.5 | |
| Critical | CVE-2023-24531 | Output of "go env" does not sanitize values in cmd/go | 9.8 | |
| High | CVE-2026-94444 | Checksum bypass for golang.org/fips140 in cmd/go | 7.8 | |
| High | CVE-2026-56865 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog | 8.4 | |
| High | CVE-2026-94447 | Checksum database bypass for golang.org/toolchain in cmd/go | 7.0 | |
| High | CVE-2026-56864 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb | 7.5 | |
| Medium | CVE-2024-24787 | Arbitrary code execution during build on Darwin in cmd/go | 6.4 | |
| Medium | CVE-2026-39817 | Invoking "go tool pack" does not sanitize output paths in cmd/go | 5.9 | |
| Medium | CVE-2026-39819 | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go | 5.3 |