Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2025-3937
- CVE-2025-56761, GHSA-cgrg-86m5-xm4w
- Affects: github.com/usememos/memos
- Published: Sep 08, 2025
Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos
GO-2025-3936
- CVE-2025-56760, GHSA-78j5-8vq7-jxv5
- Affects: github.com/usememos/memos
- Published: Sep 08, 2025
Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos
GO-2025-3935
- CVE-2025-9566, GHSA-wp3j-xq48-xpjw
- Affects: github.com/containers/podman, github.com/containers/podman/v2, and 3 more
- Published: Sep 08, 2025
podman kube play symlink traversal vulnerability in github.com/containers/podman
GO-2025-3934
- CVE-2025-55190, GHSA-786q-9hcg-v9ff
- Affects: github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2, and 1 more
- Published: Sep 08, 2025
Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
GO-2025-3930
- CVE-2025-58355, GHSA-33pr-m977-5w97
- Affects: github.com/charmbracelet/soft-serve
- Published: Sep 08, 2025
Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.