CM
Product
cmd/go
10
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Severity mix
Critical 0High 8Medium 2Low 0
Watch
Add cmd/go to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27140 | 8.8 | Apr 8 | Code execution vulnerability in SWIG code generation in cmd/go Affected: before 1.25.9; 1.26.0-0 before 1.26.2 |
| CVE-2026-56865 | 8.4 | Aug 13 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog Affected: before 1.25.13; 1.26.0-0 before 1.26.6; 1.27.0-0 before 1.27.0-rc.3 |
| CVE-2026-94447 | 7.8 | Oct 8 | Checksum database bypass for golang.org/toolchain in cmd/go Affected: before 1.26.9; 1.27.0-0 before 1.27.2 |
| CVE-2026-94444 | 7.8 | Oct 8 | Checksum bypass for golang.org/fips140 in cmd/go Affected: before 1.26.9; 1.27.0-0 before 1.27.2 |
| CVE-2025-61731 | 7.8 | Jan 28 | Arbitrary file write using cgo pkg-config directive in cmd/go Affected: before 1.24.12; 1.25.0 before 1.25.6 |
| CVE-2026-56864 | 7.5 | Aug 13 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb Affected: before 1.25.13; 1.26.0-0 before 1.26.6; 1.27.0-0 before 1.27.0-rc.3 |
| CVE-2026-42501 | 7.5 | May 7 | Malicious module proxy can bypass checksum database in cmd/go Affected: before 1.25.10; 1.26.0-0 before 1.26.3 |
| CVE-2025-68119 | 7.0 | Jan 28 | Unexpected code execution when invoking toolchain in cmd/go Affected: 1.25.0 before 1.25.6 |
| CVE-2026-39817 | 5.9 | May 7 | Invoking "go tool pack" does not sanitize output paths in cmd/go Affected: before 1.25.10; 1.26.0-0 before 1.26.3 |
| CVE-2026-39819 | 5.3 | May 7 | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go Affected: before 1.25.10; 1.26.0-0 before 1.26.3 |
Showing 10