Go
3,289 CVEs tracked since 2014. Since Oct 2021, 6 of them reached CISA KEV.
Go CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-10 | 15 | 1 |
| 2021-11 | 21 | 0 |
| 2021-12 | 13 | 1 |
| 2022-01 | 10 | 0 |
| 2022-02 | 47 | 0 |
| 2022-03 | 36 | 0 |
| 2022-04 | 24 | 0 |
| 2022-05 | 44 | 0 |
| 2022-06 | 29 | 0 |
| 2022-07 | 25 | 0 |
| 2022-08 | 15 | 0 |
| 2022-09 | 47 | 0 |
| 2022-10 | 32 | 0 |
| 2022-11 | 34 | 0 |
| 2022-12 | 126 | 0 |
| 2023-01 | 33 | 0 |
| 2023-02 | 44 | 0 |
| 2023-03 | no snapshot | |
| 2023-04 | 26 | 0 |
| 2023-05 | 35 | 0 |
| 2023-06 | 42 | 0 |
| 2023-07 | 30 | 0 |
| 2023-08 | 37 | 0 |
| 2023-09 | 64 | 1 |
| 2023-10 | 44 | 1 |
| 2023-11 | 37 | 0 |
| 2023-12 | 32 | 0 |
| 2024-01 | 46 | 0 |
| 2024-02 | 52 | 0 |
| 2024-03 | 53 | 0 |
| 2024-04 | 64 | 0 |
| 2024-05 | 45 | 0 |
| 2024-06 | 33 | 0 |
| 2024-07 | 49 | 0 |
| 2024-08 | 62 | 0 |
| 2024-09 | 40 | 0 |
| 2024-10 | 65 | 0 |
| 2024-11 | 42 | 0 |
| 2024-12 | 39 | 0 |
| 2025-01 | 49 | 0 |
| 2025-02 | 35 | 1 |
| 2025-03 | 60 | 0 |
| 2025-04 | 56 | 0 |
| 2025-05 | 50 | 0 |
| 2025-06 | 50 | 0 |
| 2025-07 | 34 | 0 |
| 2025-08 | 75 | 0 |
| 2025-09 | 55 | 0 |
| 2025-10 | 60 | 0 |
| 2025-11 | 70 | 0 |
| 2025-12 | 83 | 1 |
| 2026-01 | 85 | 0 |
| 2026-02 | 143 | 0 |
| 2026-03 | 139 | 0 |
| 2026-04 | 62 | 0 |
| 2026-05 | 41 | 0 |
| 2026-06 | 35 | 0 |
| 2026-07 | 31 | 0 |
| 2026-08 | 46 | 0 |
| 2026-09 | 10 | 0 |
| 2026-10 | 43 | 0 |
| 2026-11 | 0 |
Products
The products that kept showing up in Go's monthly top three, with their CVEs summed over those months.
- Github.com/mattermost/mattermost/server/v8149
- Github.com/siyuan-note/siyuan/kernel57
- Github.com/usememos/memos54
- Github.com/mattermost/mattermost-server47
- Github.com/rancher/rancher33
- Gogs.io/gogs27
- Github.com/mattermost/mattermost-server/v620
- Github.com/grafana/grafana17
- Code.vikunja.io/api16
- Github.com/lf-edge/eve14
Latest CVEs
The 15 most recently published vulnerabilities affecting Go.
- GHSA-47w9-6r3f-938gLXD has restricted project bypass leading to arbitrary command execution—
- GHSA-7mr3-28h5-m5vxLXD has project restriction bypass for custom volume copy across projects —
- GHSA-qx75-2p3r-pwm5LXD has project restriction bypass in instance copy across projects —
- GHSA-pjff-c2wc-f6jmLXD has arbitrary file write on client due to trusted image hash—
- GHSA-fmc8-p6q7-75ccLXD has argument injection in backup compression algorithm leading to AFW and ACE—
- GHSA-vghh-5rfx-xhq8LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image—
- GHSA-jpf8-86f3-wp38LXD has arbitrary file read+write on host via templates/ symlink in malicious image—
- GHSA-9j25-mm2h-2f76LXD has arbitrary file write on host via `exec-output` symlink in crafted image—
- GHSA-9ppr-wfw9-xvr2Netfoil doesn't decrement TTL—
- GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`—
- GHSA-hff9-5pqw-6w9fimgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution—
- GHSA-494m-4556-wf5pimgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash—
- GHSA-mmq5-xm89-9pfgimgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field—
- GHSA-2wrx-84qj-4pcganacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS—
- GHSA-f3fj-9625-rv3mcharmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users—
The record
- Peak rank
- #3 in Feb 2026
- Busiest month shown
- Feb 2026, 143 CVEs
- Months with a KEV entry
- 6 since Oct 2021
- Monthly snapshots
- 107 since 2014