Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2026-6809
standard library- CVE-2026-111943
- Affects: crypto/x509
- Published: Oct 21, 2026
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
- CVE-2026-96627, GHSA-pw5q-rjx4-7f7p
- Affects: github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2
- Published: Oct 19, 2026
- Unreviewed
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend
- CVE-2026-96628, GHSA-mp22-58ff-6fhr
- Affects: github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2
- Published: Oct 19, 2026
- Unreviewed
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
- CVE-2026-62994, GHSA-74w3-63xv-x9mv
- Affects: github.com/coredns/coredns
- Published: Oct 19, 2026
- Unreviewed
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
- CVE-2026-103028, GHSA-wwv9-g5x4-966q
- Affects: github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2
- Published: Oct 19, 2026
- Unreviewed
SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.
