Package ecosystem
Go package vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 5,737 vulnerabilities in Go packages: 28 in the last 7 days and 679 in the last 90 days, 267 of them critical and 11 exploited in the wild. The most recent, CVE-2026-97054, was published on 11 November 2026. 172 vulnerabilities in the last four weeks, down 33% on the four before (257). 18 critical against 14, 1 exploited in the wild against 0. 554 packages have a page of their own.
- Last 7 days
- 28
- Last 90 days
- 679
- Critical, all time
- 267
- Exploited in the wild
- 11
About Go
An open-source programming language supported by Google.
Go packages
- github.com/mattermost/mattermost-server (Go)297
- github.com/mattermost/mattermost-server/v6 (Go)222
- github.com/mattermost/mattermost/server/v8 (Go)207
- github.com/mattermost/mattermost-server/v5 (Go)199
- stdlib (Go)178
- github.com/siyuan-note/siyuan/kernel (Go)160
- code.gitea.io/gitea (Go)126
- code.vikunja.io/api (Go)91
- gogs.io/gogs (Go)81
- github.com/traefik/traefik/v2 (Go)78
- github.com/traefik/traefik (Go)75
- github.com/usememos/memos (Go)75
- github.com/traefik/traefik/v3 (Go)70
- github.com/grafana/grafana (Go)69
- github.com/rancher/rancher (Go)61
- github.com/hashicorp/vault (Go)55
- github.com/zitadel/zitadel (Go)52
- github.com/argoproj/argo-cd (Go)51
- k8s.io/kubernetes (Go)50
- github.com/argoproj/argo-cd/v2 (Go)48
- github.com/filebrowser/filebrowser/v2 (Go)45
- toolchain (Go)45
- gitea.dev (Go)44
- github.com/filebrowser/filebrowser (Go)43
- github.com/0xJacky/Nginx-UI (Go)41
- github.com/cilium/cilium (Go)41
- github.com/docker/docker (Go)38
- github.com/answerdev/answer (Go)34
- github.com/fleetdm/fleet/v4 (Go)34
- github.com/hashicorp/nomad (Go)34
- github.com/openbao/openbao (Go)33
- golang.org/x/net (Go)33
- github.com/hashicorp/consul (Go)32
- github.com/lxc/incus (Go)32
- github.com/lxc/incus/v6 (Go)32
- golang.org/x/crypto (Go)32
- github.com/coder/coder/v2 (Go)30
- github.com/containerd/containerd (Go)30
- github.com/nats-io/nats-server/v2 (Go)30
- github.com/rclone/rclone (Go)29
- github.com/coder/coder (Go)28
- github.com/ethereum/go-ethereum (Go)27
- github.com/kyverno/kyverno (Go)27
- github.com/openfga/openfga (Go)27
- github.com/canonical/lxd (Go)26
- github.com/cosmos/cosmos-sdk (Go)25
- github.com/goharbor/harbor (Go)24
- github.com/juju/juju (Go)23
- helm.sh/helm/v3 (Go)23
- github.com/gotenberg/gotenberg/v8 (Go)22
- github.com/nats-io/nats-server (Go)22
- go (Go)22
- github.com/argoproj/argo-workflows/v3 (Go)21
- github.com/caddyserver/caddy/v2 (Go)21
- github.com/gotenberg/gotenberg/v7 (Go)21
- github.com/labstack/echo/v4 (Go)21
- github.com/OliveTin/OliveTin (Go)21
- kubevirt.io/kubevirt (Go)21
- github.com/casdoor/casdoor (Go)20
- github.com/coredns/coredns (Go)20
- github.com/go-gitea/gitea (Go)20
- github.com/labstack/echo/v5 (Go)20
- github.com/moby/moby (Go)20
- github.com/opencontainers/runc (Go)20
- github.com/pterodactyl/wings (Go)20
- github.com/argoproj/argo-workflows (Go)19
- github.com/cloudreve/Cloudreve/v4 (Go)19
- github.com/cometbft/cometbft (Go)19
- github.com/fission/fission (Go)19
- github.com/klever-io/klever-go (Go)19
- github.com/lin-snow/ech0 (Go)19
- github.com/1Panel-dev/1Panel (Go)18
- github.com/argoproj/argo-workflows/v2 (Go)18
- github.com/cloudreve/Cloudreve/v3 (Go)18
- github.com/containers/podman/v3 (Go)18
- github.com/containers/podman/v4 (Go)18
- github.com/edgelesssys/contrast (Go)18
- github.com/nezhahq/nezha (Go)18
- github.com/patrickhener/goshs (Go)18
- github.com/xuri/excelize/v2 (Go)18
- github.com/authzed/spicedb (Go)17
- github.com/containers/podman (Go)17
- github.com/containers/podman/v2 (Go)17
- github.com/corazawaf/coraza/v3 (Go)17
- github.com/juev/nebula-mesh (Go)17
- github.com/lxc/incus/v7 (Go)17
- github.com/treeverse/lakefs (Go)17
- go.etcd.io/etcd/v3 (Go)17
- k8s.io/ingress-nginx (Go)17
- github.com/apache/incubator-answer (Go)16
- github.com/bishopfox/sliver (Go)16
- github.com/cloudreve/Cloudreve (Go)16
- github.com/ollama/ollama (Go)16
- github.com/tinfoil-factory/netfoil (Go)16
- d7y.io/dragonfly/v2 (Go)15
- github.com/axllent/mailpit (Go)15
- github.com/containerd/containerd/v2 (Go)15
- github.com/go-git/go-git/v5 (Go)15
- github.com/lf-edge/eve (Go)15
- github.com/minio/minio (Go)15
- github.com/zitadel/zitadel/v2 (Go)15
- github.com/charmbracelet/soft-serve (Go)14
- github.com/corazawaf/coraza/v2 (Go)14
- github.com/cri-o/cri-o (Go)14
- github.com/ellanetworks/core (Go)14
- github.com/getkin/kin-openapi (Go)14
- github.com/mattermost/mattermost-plugin-confluence (Go)14
- github.com/QuantumNous/new-api (Go)14
- github.com/babylonlabs-io/babylon (Go)13
- github.com/corazawaf/coraza (Go)13
- github.com/drakkan/sftpgo/v2 (Go)13
- github.com/gofiber/fiber/v2 (Go)13
- github.com/opentofu/opentofu (Go)13
- golang.org/x/image (Go)13
- github.com/drakkan/sftpgo (Go)12
- github.com/gravitl/netmaker (Go)12
- github.com/kubeedge/kubeedge (Go)12
- github.com/lf-edge/ekuiper (Go)12
- github.com/lf-edge/ekuiper/v2 (Go)12
- github.com/oauth2-proxy/oauth2-proxy (Go)12
- github.com/patrickhener/goshs/v2 (Go)12
- github.com/pomerium/pomerium (Go)12
- go.etcd.io/etcd (Go)12
- github.com/argoproj/argo-cd/v3 (Go)11
- github.com/cli/cli (Go)11
- github.com/cloudflare/cfrpki (Go)11
- github.com/containers/podman/v5 (Go)11
- github.com/dragonflyoss/dragonfly (Go)11
- github.com/envoyproxy/envoy (Go)11
- github.com/gohugoio/hugo (Go)11
- github.com/mattermost/mattermost (Go)11
- github.com/navidrome/navidrome (Go)11
- github.com/osrg/gobgp/v4 (Go)11
- github.com/portainer/portainer (Go)11
- github.com/projectcapsule/capsule (Go)11
- github.com/projectdiscovery/nuclei (Go)11
- github.com/projectdiscovery/nuclei/v2 (Go)11
- github.com/projectdiscovery/nuclei/v3 (Go)11
- github.com/rabbitmq/amqp091-go (Go)11
- github.com/sylabs/singularity (Go)11
- go.opentelemetry.io/obi (Go)11
- golang.org/x/crypto/ssh (Go)11
- istio.io/istio (Go)11
- github.com/babylonlabs-io/babylon/v2 (Go)10
- github.com/beego/beego/v2 (Go)10
- github.com/consensys/gnark (Go)10
- github.com/CosmWasm/wasmd (Go)10
- github.com/envoyproxy/gateway (Go)10
- github.com/forceu/gokapi (Go)10
- github.com/getarcaneapp/arcane/backend (Go)10
- github.com/gravitational/teleport (Go)10
- github.com/greenpau/caddy-security (Go)10
- github.com/lxc/incus/v6/cmd/incusd (Go)10
- github.com/lxc/incus/v7/cmd/incusd (Go)10
- github.com/Tencent/WeKnora (Go)10
- github.com/xyproto/algernon (Go)10
- google.golang.org/grpc (Go)10
- goshs.de/goshs/v2 (Go)10
- chainguard.dev/apko (Go)9
- chainguard.dev/melange (Go)9
- github.com/apache/answer (Go)9
- github.com/argoproj/argo-workflows/v4 (Go)9
- github.com/cli/cli/v2 (Go)9
- github.com/containers/buildah (Go)9
- github.com/cosmos/ibc-go/v4 (Go)9
- github.com/cosmos/ibc-go/v5 (Go)9
- github.com/cosmos/ibc-go/v6 (Go)9
- github.com/cosmos/ibc-go/v7 (Go)9
- github.com/CosmWasm/wasmvm (Go)9
- github.com/enchant97/note-mark/backend (Go)9
- github.com/esm-dev/esm.sh (Go)9
- github.com/free5gc/udr (Go)9
- github.com/imgproxy/imgproxy/v3 (Go)9
- github.com/kubeflow/pipelines (Go)9
- github.com/kubernetes/kubernetes (Go)9
- github.com/moby/buildkit (Go)9
- github.com/neuvector/neuvector (Go)9
- github.com/oauth2-proxy/oauth2-proxy/v7 (Go)9
- github.com/omec-project/amf (Go)9
- github.com/sigstore/cosign (Go)9
- github.com/zalando/skipper (Go)9
- goshs.de/goshs (Go)9
- helm.sh/helm (Go)9
- github.com/apache/trafficcontrol (Go)8
- github.com/authelia/authelia/v4 (Go)8
- github.com/babylonlabs-io/babylon/v4 (Go)8
- github.com/beego/beego (Go)8
- github.com/cheqd/cheqd-node (Go)8
- github.com/cosmos/ibc-go (Go)8
- github.com/cosmos/ibc-go/v2 (Go)8
- github.com/cosmos/ibc-go/v3 (Go)8
- github.com/dgraph-io/dgraph (Go)8
- github.com/dgraph-io/dgraph/v25 (Go)8
- github.com/evmos/evmos (Go)8
- github.com/evmos/evmos/v11 (Go)8
- github.com/evmos/evmos/v2 (Go)8
- github.com/evmos/evmos/v3 (Go)8
- github.com/evmos/evmos/v4 (Go)8
- github.com/evmos/evmos/v5 (Go)8
- github.com/evmos/evmos/v6 (Go)8
- github.com/evmos/evmos/v7 (Go)8
- github.com/forgekeep/nebula-mesh (Go)8
- github.com/foxcpp/maddy (Go)8
- github.com/go-chi/chi/v5 (Go)8
- github.com/go-git/go-git/v6 (Go)8
- github.com/go-jose/go-jose/v3 (Go)8
- github.com/gofiber/fiber/v3 (Go)8
- github.com/gophish/gophish (Go)8
- github.com/obot-platform/obot (Go)8
- github.com/ory/oathkeeper (Go)8
- github.com/pion/dtls/v2 (Go)8
- github.com/pocket-id/pocket-id/backend (Go)8
- github.com/quic-go/quic-go (Go)8
- github.com/russellhaering/gosaml2 (Go)8
- github.com/stacklok/minder (Go)8
- github.com/tektoncd/pipeline (Go)8
- oras.land/oras-go/v2 (Go)8
- vitess.io/vitess (Go)8
- www.velocidex.com/golang/velociraptor (Go)8
- github.com/alist-org/alist/v3 (Go)7
- github.com/caddyserver/caddy (Go)7
- github.com/centrifugal/centrifugo/v6 (Go)7
- github.com/CosmWasm/wasmvm/v2 (Go)7
- github.com/daptin/daptin (Go)7
- github.com/edgelesssys/constellation/v2 (Go)7
- github.com/elastic/beats (Go)7
- github.com/evmos/evmos/v10 (Go)7
- github.com/evmos/evmos/v12 (Go)7
- github.com/evmos/evmos/v13 (Go)7
- github.com/evmos/evmos/v8 (Go)7
- github.com/evmos/evmos/v9 (Go)7
- github.com/free5gc/nef (Go)7
- github.com/free5gc/udm (Go)7
- github.com/gofiber/fiber (Go)7
- github.com/gtsteffaniak/filebrowser (Go)7
- github.com/gtsteffaniak/filebrowser/backend (Go)7
- github.com/hashicorp/go-getter (Go)7
- github.com/hatchet-dev/hatchet (Go)7
- github.com/hyperledger/fabric (Go)7
- github.com/imgproxy/imgproxy (Go)7
- github.com/imgproxy/imgproxy/v2 (Go)7
- github.com/kcp-dev/kcp (Go)7
- github.com/lib/pq (Go)7
- github.com/OpenListTeam/OpenList/v4 (Go)7
- github.com/pinchtab/pinchtab (Go)7
- github.com/pion/dtls (Go)7
- github.com/rancher/fleet (Go)7
- github.com/schollz/croc (Go)7
- github.com/schollz/croc/v6 (Go)7
- github.com/schollz/croc/v8 (Go)7
- github.com/schollz/croc/v9 (Go)7
- github.com/seaweedfs/seaweedfs (Go)7
- go.temporal.io/server (Go)7
- github.com/360EntSecGroup-Skylar/excelize/v2 (Go)6
- github.com/amir20/dozzle (Go)6
- github.com/authorizerdev/authorizer (Go)6
- github.com/babylonlabs-io/babylon/v3 (Go)6
- github.com/basekick-labs/arc (Go)6
- github.com/centrifugal/centrifugo (Go)6
- github.com/centrifugal/centrifugo/v3 (Go)6
- github.com/centrifugal/centrifugo/v4 (Go)6
- github.com/centrifugal/centrifugo/v5 (Go)6
- github.com/cloudflare/circl (Go)6
- github.com/cosmos/evm (Go)6
- github.com/cosmos/ibc-go/v8 (Go)6
- github.com/crossplane/crossplane (Go)6
- github.com/cubefs/cubefs (Go)6
- github.com/dadrus/heimdall (Go)6
- github.com/distribution/distribution (Go)6
- github.com/dunglas/frankenphp (Go)6
- github.com/edgelesssys/marblerun (Go)6
- github.com/elastic/beats/v7 (Go)6
- github.com/external-secrets/external-secrets (Go)6
- github.com/fluxcd/flux2 (Go)6
- github.com/free5gc/free5gc (Go)6
- github.com/gin-gonic/gin (Go)6
- github.com/git-lfs/git-lfs (Go)6
- github.com/go-git/go-git (Go)6
- github.com/go-jose/go-jose/v4 (Go)6
- github.com/googleapis/mcp-toolbox (Go)6
- github.com/hypermodeinc/dgraph/v24 (Go)6
- github.com/inspektor-gadget/inspektor-gadget (Go)6
- github.com/ipfs/go-ipfs (Go)6
- github.com/jackc/pgx/v5 (Go)6
- github.com/mattermost/mattermost-plugin-playbooks (Go)6
- github.com/nhost/nhost (Go)6
- github.com/NVIDIA/nvidia-container-toolkit (Go)6
- github.com/open-policy-agent/opa (Go)6
- github.com/openchoreo/openchoreo (Go)6
- github.com/OpenListTeam/OpenList (Go)6
- github.com/OpenListTeam/OpenList/v3 (Go)6
- github.com/osrg/gobgp (Go)6
- github.com/osrg/gobgp/v3 (Go)6
- github.com/projectcalico/calico (Go)6
- github.com/prometheus/prometheus (Go)6
- github.com/russellhaering/goxmldsig (Go)6
- github.com/siderolabs/omni (Go)6
- github.com/sigstore/cosign/v2 (Go)6
- github.com/snapcore/snapd (Go)6
- github.com/square/go-jose (Go)6
- goauthentik.io (Go)6
- miniflux.app/v2 (Go)6
- github.com/AdguardTeam/AdGuardHome (Go)5
- github.com/akuity/kargo (Go)5
- github.com/alist-org/alist (Go)5
- github.com/aquasecurity/trivy (Go)5
- github.com/binance-chain/tss-lib (Go)5
- github.com/bnb-chain/tss-lib (Go)5
- github.com/chainguard-dev/malcontent (Go)5
- github.com/concourse/concourse (Go)5
- github.com/Consensys/gnark-crypto (Go)5
- github.com/containers/libpod (Go)5
- github.com/crewjam/saml (Go)5
- github.com/dagu-org/dagu (Go)5
- github.com/dexidp/dex (Go)5
- github.com/dgraph-io/dgraph/v24 (Go)5
- github.com/docker/distribution (Go)5
- github.com/evmos/evmos/v14 (Go)5
- github.com/evmos/evmos/v15 (Go)5
- github.com/evmos/evmos/v16 (Go)5
- github.com/evmos/evmos/v17 (Go)5
- github.com/fleetdm/fleet (Go)5
- github.com/fluxcd/kustomize-controller (Go)5
- github.com/free5gc/amf (Go)5
- github.com/free5gc/pcf (Go)5
- github.com/go-git/go-git/v4 (Go)5
- github.com/go-vela/server (Go)5
- github.com/gogs/gogs (Go)5
- github.com/google/fscrypt (Go)5
- github.com/h44z/wg-portal (Go)5
- github.com/hashicorp/boundary (Go)5
- github.com/IBAX-io/go-ibax (Go)5
- github.com/karmada-io/karmada (Go)5
- github.com/kiali/kiali (Go)5
- github.com/knadh/listmonk (Go)5
- github.com/komari-monitor/komari (Go)5
- github.com/KubeOperator/kubepi (Go)5
- github.com/lestrrat-go/jwx (Go)5
- github.com/lestrrat-go/jwx/v2 (Go)5
- github.com/moby/moby/v2 (Go)5
- github.com/modelcontextprotocol/go-sdk (Go)5
- github.com/modelcontextprotocol/registry (Go)5
- github.com/nuclio/nuclio (Go)5
- github.com/openziti/zrok (Go)5
- github.com/openziti/zrok/v2 (Go)5
- github.com/ory/fosite (Go)5
- github.com/owncast/owncast (Go)5
- github.com/runatlantis/atlantis (Go)5
- github.com/sigstore/rekor (Go)5
- github.com/SpectoLabs/hoverfly (Go)5
- github.com/t2bot/matrix-media-repo (Go)5
- github.com/tendermint/tendermint (Go)5
- github.com/tidwall/gjson (Go)5
- github.com/tomwright/dasel (Go)5
- github.com/tomwright/dasel/v2 (Go)5
- github.com/tomwright/dasel/v3 (Go)5
- github.com/weaviate/weaviate (Go)5
- gitlab.com/uniget-org/cli (Go)5
- golang.org/x/text (Go)5
- miniflux.app (Go)5
- zotregistry.dev/zot (Go)5
- crypto (Go)4
- github.com/almeidapaulopt/tsdproxy (Go)4
- github.com/apache/thrift (Go)4
- github.com/apernet/hysteria (Go)4
- github.com/apernet/hysteria/core/v2 (Go)4
- github.com/apptainer/apptainer (Go)4
- github.com/arduino/arduino-create-agent (Go)4
- github.com/astaxie/beego (Go)4
- github.com/authelia/authelia (Go)4
- github.com/chaos-mesh/chaos-mesh (Go)4
- github.com/clidey/whodb/core (Go)4
- github.com/cloudnativelabs/kube-router (Go)4
- github.com/cloudnativelabs/kube-router/v2 (Go)4
- github.com/cortexproject/cortex (Go)4
- github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 (Go)4
- github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 (Go)4
- github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 (Go)4
- github.com/crypto-org-chain/cronos (Go)4
- github.com/daytonaio/daytona (Go)4
- github.com/distribution/distribution/v3 (Go)4
- github.com/edgelesssys/constellation (Go)4
- github.com/evmos/evmos/v18 (Go)4
- github.com/fkie-cad/yapscan (Go)4
- github.com/flipped-aurora/gin-vue-admin (Go)4
- github.com/free5gc/ausf (Go)4
- github.com/go-viper/mapstructure/v2 (Go)4
- github.com/gomarkdown/markdown (Go)4
- github.com/gotify/server (Go)4
- github.com/hahwul/dalfox (Go)4
- github.com/hahwul/dalfox/v2 (Go)4
- github.com/hamba/avro/v2 (Go)4
- github.com/IceWhaleTech/CasaOS-UserService (Go)4
- github.com/iskorotkov/avro/v2 (Go)4
- github.com/julien040/anyquery (Go)4
- github.com/k8sgpt-ai/k8sgpt (Go)4
- github.com/kubev2v/migration-planner (Go)4
- github.com/kubewarden/kubewarden-controller (Go)4
- github.com/kumahq/kuma (Go)4
- github.com/layer5io/meshery (Go)4
- github.com/lightningnetwork/lnd (Go)4
- github.com/mattermost/mattermost-plugin-github (Go)4
- github.com/mattermost/mattermost-plugin-msteams (Go)4
- github.com/mholt/archiver (Go)4
- github.com/mvt-project/androidqf (Go)4
- github.com/netbirdio/netbird (Go)4
- github.com/notaryproject/notation-go (Go)4
- github.com/openshift/console (Go)4
- github.com/oxia-db/oxia (Go)4
- github.com/plentico/plenti (Go)4
- github.com/quic-go/webtransport-go (Go)4
- github.com/shellhub-io/shellhub (Go)4
- github.com/sigstore/gitsign (Go)4
- github.com/siyuan-note/siyuan (Go)4
- github.com/smallstep/certificates (Go)4
- github.com/steveiliop56/tinyauth (Go)4
- github.com/supranational/blst (Go)4
- github.com/theupdateframework/go-tuf/v2 (Go)4
- go.opentelemetry.io/otel/sdk (Go)4
- go.woodpecker-ci.org/woodpecker (Go)4
- go.woodpecker-ci.org/woodpecker/v2 (Go)4
- golang.org/x/crypto/ssh/agent (Go)4
- golang.org/x/net/http2 (Go)4
- gopkg.in/src-d/go-git.v4 (Go)4
- mellium.im/xmpp (Go)4
- github.com/AlexxIT/go2rtc (Go)3
- github.com/anchore/quill (Go)3
- github.com/apache/servicecomb-service-center (Go)3
- github.com/argoproj/argo-events (Go)3
- github.com/artifacthub/hub (Go)3
- github.com/aws/aws-advanced-go-wrapper/awssql (Go)3
- github.com/aws/aws-sdk-go (Go)3
- github.com/bincyber/go-sqlcrypter (Go)3
- github.com/btcsuite/btcd (Go)3
- github.com/buger/jsonparser (Go)3
- github.com/bytebase/bytebase (Go)3
- github.com/cert-manager/cert-manager (Go)3
- github.com/containous/traefik (Go)3
- github.com/containous/traefik/v2 (Go)3
- github.com/ctfer-io/chall-manager (Go)3
- github.com/dapr/dapr (Go)3
- github.com/donknap/dpanel (Go)3
- github.com/dutchcoders/transfer.sh (Go)3
- github.com/ElrondNetwork/elrond-go (Go)3
- github.com/emiago/sipgo (Go)3
- github.com/envoyproxy/ai-gateway (Go)3
- github.com/fluxcd/helm-controller (Go)3
- github.com/fluxcd/source-controller (Go)3
- github.com/flyteorg/flyteadmin (Go)3
- github.com/free5gc/nrf (Go)3
- github.com/free5gc/smf (Go)3
- github.com/gardener/gardener (Go)3
- github.com/git-lfs/git-lfs/v3 (Go)3
- github.com/go-chi/chi/v5/middleware (Go)3
- github.com/go-skynet/LocalAI (Go)3
- github.com/gopacket/gopacket (Go)3
- github.com/goreleaser/goreleaser (Go)3
- github.com/gorilla/websocket (Go)3
- github.com/gotify/server/v2 (Go)3
- github.com/grafana/tempo (Go)3
- github.com/heketi/heketi (Go)3
- github.com/IceWhaleTech/CasaOS (Go)3
- github.com/imgproxy/imgproxy/v4 (Go)3
- github.com/in-toto/in-toto-golang (Go)3
- github.com/ipld/go-ipld-prime (Go)3
- github.com/jackc/pgproto3/v2 (Go)3
- github.com/jackc/pgx (Go)3
- github.com/jackc/pgx/v4 (Go)3
- github.com/k3s-io/k3s (Go)3
- github.com/kata-containers/kata-containers (Go)3
- github.com/kedacore/keda (Go)3
- github.com/kedacore/keda/v2 (Go)3
- github.com/kgateway-dev/kgateway/v2 (Go)3
- github.com/klauspost/compress (Go)3
- github.com/kong/kubernetes-ingress-controller (Go)3
- github.com/kong/kubernetes-ingress-controller/v2 (Go)3
- github.com/kong/kubernetes-ingress-controller/v3 (Go)3
- github.com/kopia/kopia (Go)3
- github.com/kumahq/kuma/v2 (Go)3
- github.com/libp2p/go-libp2p (Go)3
- github.com/lucasdillmann/nginx-ignition (Go)3
- github.com/mattermost/mattermost-plugin-calls (Go)3
- github.com/mattermost/mattermost-plugin-jira (Go)3
- github.com/mayswind/ezbookkeeping (Go)3
- github.com/metal3-io/ironic-standalone-operator (Go)3
- github.com/mickael-kerjean/filestash (Go)3
- github.com/miekg/dns (Go)3
- github.com/milvus-io/milvus (Go)3
- github.com/monetr/monetr (Go)3
- github.com/mudler/LocalAI (Go)3
- github.com/mutagen-io/mutagen (Go)3
- github.com/nats-io/jwt (Go)3
- github.com/nats-io/nats-streaming-server (Go)3
- github.com/nektos/act (Go)3
- github.com/netlify/gotrue (Go)3
- github.com/notaryproject/notation (Go)3
- github.com/open-feature/flagd/flagd (Go)3
- github.com/openclaw/crabbox (Go)3
- github.com/openshift/hive (Go)3
- github.com/openshift/origin (Go)3
- github.com/ory/hydra (Go)3
- github.com/perses/perses (Go)3
- github.com/pgEdge/pgedge-rag-server (Go)3
- github.com/phachon/mm-wiki (Go)3
- github.com/pinchtab/pinchtab/cmd/pinchtab (Go)3
- github.com/pingcap/tidb (Go)3
- github.com/pocketbase/pocketbase (Go)3
- github.com/prest/prest (Go)3
- github.com/proglottis/gpgme (Go)3
- github.com/projectcalico/calico/v3 (Go)3
- github.com/projectcontour/contour (Go)3
- github.com/pydio/cells (Go)3
- github.com/pydio/cells/v4 (Go)3
- github.com/rancher/rke2 (Go)3
- github.com/refraction-networking/utls (Go)3
- github.com/rs/cors (Go)3
- github.com/semaphoreui/semaphore (Go)3
- github.com/siderolabs/talos (Go)3
- github.com/sigstore/cosign/v3 (Go)3
- github.com/sigstore/fulcio (Go)3
- github.com/sigstore/sigstore-go (Go)3
- github.com/sigstore/timestamp-authority (Go)3
- github.com/sigstore/timestamp-authority/v2 (Go)3
- github.com/sipcapture/homer-app (Go)3
- github.com/snowflakedb/gosnowflake (Go)3
- github.com/sonirico/mcp-shell (Go)3
- github.com/stacklok/toolhive (Go)3
- github.com/syncthing/syncthing (Go)3
- github.com/talos-systems/talos (Go)3
- github.com/tharsis/evmos (Go)3
- github.com/theupdateframework/go-tuf (Go)3
- github.com/tilt-dev/tilt (Go)3
- github.com/tinyauthapp/tinyauth (Go)3
- github.com/traPtitech/traQ (Go)3
- github.com/ubuntu/authd (Go)3
- github.com/ulikunitz/xz (Go)3
- github.com/wazuh/wazuh (Go)3
- github.com/weaveworks/weave-gitops (Go)3
- github.com/woodpecker-ci/woodpecker (Go)3
- github.com/xuri/excelize (Go)3
- github.com/ydb-platform/ydb-go-sdk/v3 (Go)3
- github.com/zxh326/kite (Go)3
- go.etcd.io/etcd/client/v3 (Go)3
- go.mongodb.org/mongo-driver (Go)3
- go.senan.xyz/gonic (Go)3
- golang.org/x/net/html (Go)3
- gopkg.in/yaml.v2 (Go)3
- helm.sh/helm/v4 (Go)3
- k8s.io/apimachinery (Go)3
- k8s.io/client-go (Go)3
- net/html (Go)3
- net/http (Go)3
- tailscale.com (Go)3
- volcano.sh/volcano (Go)3
Latest Go package vulnerabilities
- CVE-2026-97054: Go HTTP/1 server race condition in MaxBytesReader header handlinginfoEPSS 0.2%
- CVE-2026-97043: Go cgo LDFLAGS validation bypass in cmd/cgoinfoEPSS 0.3%
- CVE-2026-97042: Go compiler unsafe library path validation in Windows linkerinfoEPSS 0.2%
- CVE-2026-97041: Go compiler cgo linker flag injection via directivesinfoEPSS 0.2%
- CVE-2026-97040: Go linker arbitrary flag injection via crafted .syso filesinfoEPSS 0.3%
- CVE-2026-97039: Go command unsafe pkg-config flag handling in cgoinfoEPSS 0.2%
- CVE-2026-97038: Go linker code injection via malicious package compilationinfoEPSS 0.3%
- CVE-2026-97037: Go arbitrary code execution via malicious cgo linker flagsinfoEPSS 0.3%
- CVE-2026-97036: Go cgo arbitrary code execution via Apple linker argument injectioninfoEPSS 0.3%
- CVE-2026-97035: Go cgo arbitrary code execution via compiler flagsinfoEPSS 0.3%
- CVE-2026-97034: Go compiler arbitrary command execution via untrusted GCC spec filesinfoEPSS 0.3%
- CVE-2026-97033: Go cgo arbitrary code execution via compiler flagsinfoEPSS 0.3%
- CVE-2026-125328: pgEdge Go LLM Library credential disclosure in error messagesmediumCVSS 5.8EPSS 0.3%
- CVE-2026-125327: pgEdge RAG Server denial of service via unbounded corpus readhighCVSS 7.5EPSS 0.4%
- CVE-2026-125326: pgEdge RAG Server credential leak in error responsesmediumCVSS 5.8EPSS 0.4%
- CVE-2026-125325: pgEdge RAG Server concurrent query data isolation bypassmediumCVSS 5.9EPSS 0.3%
- CVE-2026-125323: pgEdge Control Plane authentication bypass in pg_hba.confhighCVSS 7.8EPSS 0.1%
- CVE-2026-85737: Velociraptor SQL plugin missing authorization checksmediumCVSS 6.5EPSS 0.2%
- CVE-2026-102657: esm.sh path traversal in web.NewHandler file serverhighCVSS 7.5EPSS 0.7%
- LXD restricted project bypass leading to arbitrary command executioncriticalCVSS 9.9
- LXD project restriction bypass in custom volume copyhighCVSS 7.7
- LXD project restriction bypass in instance copyhighCVSS 7.7
- Incus arbitrary file write via trusted image hashcriticalCVSS 9.9
- LXD argument injection in backup compression algorithmcriticalCVSS 9.9
- LXD arbitrary file read and write via symlink in container imagecriticalCVSS 9.9
Most severe Go package vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.criticalexploited in the wildCVSS 9.8EPSS 24.0%
- CVE-2025-8110: Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.criticalexploited in the wildCVSS 8.8EPSS 85.2%
- CVE-2020-0601: GO-2022-0535 - Certificate validation bypass on Windows in crypto/x509criticalexploited in the wildCVSS 8.1EPSS 89.4%
- CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attackcriticalexploited in the wildCVSS 5.3EPSS 100.0%
- CVE-2026-111497: Google Brotli buffer overflow in decodercriticalexploited in the wildCVSS 4EPSS 82.6%
- CVE-2026-33634: GO-2026-4919 - Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivycriticalexploited in the wildCVSS 4EPSS 1.7%
- CVE-2023-4863: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTablecriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2021-39226: Authentication bypass for viewing and deletions of snapshotscriticalexploited in the wildCVSS 3.1EPSS 99.9%
- CVE-2025-24016: GO-2025-3459 - Remote code execution in Wazuh server in github.com/wazuh/wazuhcriticalexploited in the wildCVSS 3.1EPSS 93.8%
- CVE-2021-43798: Grafana path traversalcriticalexploited in the wildCVSS 3.1EPSS 88.5%
Vulnerabilities per week
172 vulnerabilities in the last four weeks, down 33% on the four before (257). 18 critical against 14, 1 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 84 | 11 | |
| 24 Aug 2026 | 72 | 5 | |
| 31 Aug 2026 | 42 | 8 | |
| 7 Sep 2026 | 31 | 5 | |
| 14 Sep 2026 | 126 | 7 | |
| 21 Sep 2026 | 51 | 3 | |
| 28 Sep 2026 | 7 | 0 | |
| 5 Oct 2026 | 73 | 4 | |
| 12 Oct 2026 | 53 | 6 | |
| 19 Oct 2026 | 27 | 2 | |
| 26 Oct 2026 | 45 | 1 | |
| 2 Nov 2026 | 47 | 9 | |
| 9 Nov 2026 | 17 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Go package vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/go)<a href="https://junglewise.ai/threats/vendors/go"><img src="https://junglewise.ai/threats/vendors/go/badge.svg" alt="Go package vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/go.json, and this page as text at https://junglewise.ai/threats/vendors/go.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Go package vulnerabilities", https://junglewise.ai/threats/vendors/go, 13 November 2026.