GT
Vendor
Go toolchain
13
CVEs
0
On KEV
2
New 30D
Products
CM8.8
cmd/go
Go toolchain
10 CVEs0 on KEV2 new
CM9.8
cmd/compile
Go toolchain
2 CVEs0 on KEV0 new
CM8.6
cmd/cgo
Go toolchain
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-94447 | CM cmd/go Go toolchain | 7.8 | Oct 8 | Checksum database bypass for golang.org/toolchain in cmd/go |
| CVE-2026-94444 | CM cmd/go Go toolchain | 7.8 | Oct 8 | Checksum bypass for golang.org/fips140 in cmd/go |
| CVE-2026-56864 | CM cmd/go Go toolchain | 7.5 | Aug 13 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb |
| CVE-2026-56865 | CM cmd/go Go toolchain | 8.4 | Aug 13 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog |
| CVE-2026-42501 | CM cmd/go Go toolchain | 7.5 | May 7 | Malicious module proxy can bypass checksum database in cmd/go |
| CVE-2026-39817 | CM cmd/go Go toolchain | 5.9 | May 7 | Invoking "go tool pack" does not sanitize output paths in cmd/go |
| CVE-2026-39819 | CM cmd/go Go toolchain | 5.3 | May 7 | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go |
| CVE-2026-27140 | CM cmd/go Go toolchain | 8.8 | Apr 8 | Code execution vulnerability in SWIG code generation in cmd/go |
| CVE-2026-27143 | CM cmd/compile Go toolchain | 9.8 | Apr 8 | Missing bound checks can lead to memory corruption in safe Go in cmd/compile |
| CVE-2026-27144 | CM cmd/compile Go toolchain | 7.1 | Apr 8 | Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile |
| CVE-2025-61732 | CM cmd/cgo Go toolchain | 8.6 | Feb 5 | Potential code smuggling via doc comments in cmd/cgo |
| CVE-2025-61731 | CM cmd/go Go toolchain | 7.8 | Jan 28 | Arbitrary file write using cgo pkg-config directive in cmd/go |
| CVE-2025-68119 | CM cmd/go Go toolchain | 7.0 | Jan 28 | Unexpected code execution when invoking toolchain in cmd/go |