Approved changes feed: RSS · Atom
cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*
part: a version: 1.26.0 update: *
| Vendor | Golang (670356c5-bd1b-5c66-9eee-f755f5cec4c7) |
|---|---|
| Product | Go (96a6ef33-04c7-5363-bbc8-7d2a06bf0b4b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-27142 |
vulnerable | 2026-06-03 15:18:06.081025 |
URLs in meta content attribute actions are not escaped in html/template
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.
Published: 2026-03-06T21:28:14.674Z
Updated: 2026-03-16T15:21:14.465Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27139 |
vulnerable | 2026-06-03 15:18:06.075333 |
FileInfo can escape from a Root in os
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.
Published: 2026-03-06T21:28:14.451Z
Updated: 2026-03-09T14:53:58.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27138 |
vulnerable | 2026-06-03 15:18:06.073488 |
Panic in name constraint checking for malformed certificates in crypto/x509
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.
Published: 2026-03-06T21:28:14.000Z
Updated: 2026-03-10T13:35:19.784Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27137 |
vulnerable | 2026-06-03 15:18:06.073004 |
Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Published: 2026-03-06T21:28:13.748Z
Updated: 2026-03-10T13:32:53.202Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25679 |
vulnerable | 2026-06-03 15:18:03.840800 |
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Published: 2026-03-06T21:28:14.211Z
Updated: 2026-03-10T13:37:02.459Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.