Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
- CVE-2026-54094, GHSA-239w-m3h6-ch8v
- Affects: github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- Published: Jun 16, 2026
- Unreviewed
File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser
- CVE-2026-48113, GHSA-24fp-5v3p-rvpw
- Affects: github.com/jpillora/chisel
- Published: Jun 16, 2026
- Unreviewed
Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel
- CVE-2026-47725, GHSA-273q-qgh5-wrj6
- Affects: github.com/juev/nebula-mesh
- Published: Jun 16, 2026
- Unreviewed
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints in github.com/juev/nebula-mesh
- CVE-2026-30963, GHSA-2ww6-hf35-mfjm
- Affects: github.com/projectcapsule/capsule
- Published: Jun 16, 2026
- Unreviewed
Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule
- CVE-2026-47243, GHSA-2gv2-cffp-j227
- Affects: github.com/kata-containers/kata-containers
- Published: Jun 16, 2026
- Unreviewed
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs in github.com/kata-containers/kata-containers
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.