# Go


- [CVE-2025-24016](https://insights.sbomify.com/CVE-2025-24016/): Wazuh Server Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-60004](https://insights.sbomify.com/CVE-2026-60004/): Gitea Code Injection (critical 9.8, exploited in the wild)
- [CVE-2021-39226](https://insights.sbomify.com/CVE-2021-39226/): Grafana Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2026-33634](https://insights.sbomify.com/CVE-2026-33634/): Aquasecurity Trivy Embedded Malicious Code (critical 9.4, exploited in the wild)
- [CVE-2023-4863](https://insights.sbomify.com/CVE-2023-4863/): Google Chromium WebP Heap-Based Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2023-28434](https://insights.sbomify.com/CVE-2023-28434/): MinIO Security Feature Bypass (high 8.8, exploited in the wild)
- [CVE-2025-8110](https://insights.sbomify.com/CVE-2025-8110/): Gogs Path Traversal (high 8.7, exploited in the wild)
- [CVE-2020-0601](https://insights.sbomify.com/CVE-2020-0601/): Microsoft Windows CryptoAPI Spoofing (high 8.1, exploited in the wild)
- [CVE-2023-44487](https://insights.sbomify.com/CVE-2023-44487/): HTTP/2 Rapid Reset Attack (high 7.5, exploited in the wild)
- [CVE-2021-43798](https://insights.sbomify.com/CVE-2021-43798/): Grafana Path Traversal (high 7.5, exploited in the wild)
- [CVE-2026-94603](https://insights.sbomify.com/CVE-2026-94603/): Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation (critical 10.0)
- [CVE-2026-54735](https://insights.sbomify.com/CVE-2026-54735/): prebid-server's request forgery vulnerability allows for possible host environment data extraction (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/go/