Lookup for vulnerable packages by Package URL.
| Purl | pkg:apk/alpine/go@0?arch=armv7&distroversion=v3.22&reponame=community |
| Type | apk |
| Namespace | alpine |
| Name | go |
| Version | 0 |
| Qualifiers |
| arch |
armv7 |
| distroversion |
v3.22 |
| reponame |
community |
|
| Subpath | |
| Is_vulnerable | false |
| Next_non_vulnerable_version | 1.9.4-r0 |
| Latest_non_vulnerable_version | 1.24.13-r0 |
| Affected_by_vulnerabilities |
|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-6tuu-4j3g-37fh |
| vulnerability_id |
VCID-6tuu-4j3g-37fh |
| summary |
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D". |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41716 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02272 |
| published_at |
2026-04-08T12:55:00Z |
|
| 1 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02267 |
| published_at |
2026-04-02T12:55:00Z |
|
| 2 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02347 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02253 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02243 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02261 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02263 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02276 |
| published_at |
2026-04-11T12:55:00Z |
|
| 8 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02294 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.0227 |
| published_at |
2026-04-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41716 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://go.dev/cl/446916 |
| reference_id |
446916 |
| reference_type |
|
| scores |
| 0 |
| value |
6.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:02:04Z/ |
|
|
| url |
https://go.dev/cl/446916 |
|
| 4 |
| reference_url |
https://go.dev/issue/56284 |
| reference_id |
56284 |
| reference_type |
|
| scores |
| 0 |
| value |
6.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-01T14:02:04Z/ |
|
|
| url |
https://go.dev/issue/56284 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-41716
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6tuu-4j3g-37fh |
|
| 1 |
| url |
VCID-h2xu-3fm4-hkap |
| vulnerability_id |
VCID-h2xu-3fm4-hkap |
| summary |
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-24787 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85854 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85924 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85933 |
| published_at |
2026-04-18T12:55:00Z |
|
| 3 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85928 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.8591 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85916 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85918 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85904 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85894 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85875 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.02711 |
| scoring_system |
epss |
| scoring_elements |
0.85871 |
| published_at |
2026-04-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-24787 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://go.dev/cl/583815 |
| reference_id |
583815 |
| reference_type |
|
| scores |
| 0 |
| value |
6.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-06-05T14:49:29Z/ |
|
|
| url |
https://go.dev/cl/583815 |
|
| 4 |
| reference_url |
https://go.dev/issue/67119 |
| reference_id |
67119 |
| reference_type |
|
| scores |
| 0 |
| value |
6.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-06-05T14:49:29Z/ |
|
|
| url |
https://go.dev/issue/67119 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-24787
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h2xu-3fm4-hkap |
|
| 2 |
| url |
VCID-kjf2-r6zt-zqg9 |
| vulnerability_id |
VCID-kjf2-r6zt-zqg9 |
| summary |
net/http: CrossOriginProtection bypass in net/http |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-47910 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01189 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01204 |
| published_at |
2026-04-07T12:55:00Z |
|
| 2 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01195 |
| published_at |
2026-04-04T12:55:00Z |
|
| 3 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01186 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01197 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01194 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.012 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01214 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01211 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.00012 |
| scoring_system |
epss |
| scoring_elements |
0.01641 |
| published_at |
2026-04-18T12:55:00Z |
|
| 10 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02183 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-47910 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://go.dev/cl/699275 |
| reference_id |
699275 |
| reference_type |
|
| scores |
| 0 |
| value |
5.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-24T13:29:38Z/ |
|
|
| url |
https://go.dev/cl/699275 |
|
| 6 |
| reference_url |
https://go.dev/issue/75054 |
| reference_id |
75054 |
| reference_type |
|
| scores |
| 0 |
| value |
5.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-24T13:29:38Z/ |
|
|
| url |
https://go.dev/issue/75054 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-47910
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kjf2-r6zt-zqg9 |
|
| 3 |
| url |
VCID-sbxp-ce7p-23dm |
| vulnerability_id |
VCID-sbxp-ce7p-23dm |
| summary |
golang: path/filepath: path-filepath filepath.Clean path traversal |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41722 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.6001 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60104 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.6009 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60075 |
| published_at |
2026-04-12T12:55:00Z |
|
| 4 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60058 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60097 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60034 |
| published_at |
2026-04-04T12:55:00Z |
|
| 7 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60004 |
| published_at |
2026-04-07T12:55:00Z |
|
| 8 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60055 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.0039 |
| scoring_system |
epss |
| scoring_elements |
0.60069 |
| published_at |
2026-04-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41722 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-41722
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sbxp-ce7p-23dm |
|
| 4 |
| url |
VCID-ywda-6x6q-tud4 |
| vulnerability_id |
VCID-ywda-6x6q-tud4 |
| summary |
golang: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41720 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10199 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10248 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10161 |
| published_at |
2026-04-07T12:55:00Z |
|
| 3 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10236 |
| published_at |
2026-04-08T12:55:00Z |
|
| 4 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10298 |
| published_at |
2026-04-09T12:55:00Z |
|
| 5 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10329 |
| published_at |
2026-04-11T12:55:00Z |
|
| 6 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10288 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10269 |
| published_at |
2026-04-13T12:55:00Z |
|
| 8 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10143 |
| published_at |
2026-04-16T12:55:00Z |
|
| 9 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10116 |
| published_at |
2026-04-18T12:55:00Z |
|
| 10 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10264 |
| published_at |
2026-04-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41720 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://go.dev/cl/455716 |
| reference_id |
455716 |
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:41:16Z/ |
|
|
| url |
https://go.dev/cl/455716 |
|
| 5 |
| reference_url |
https://go.dev/issue/56694 |
| reference_id |
56694 |
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:41:16Z/ |
|
|
| url |
https://go.dev/issue/56694 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-41720
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ywda-6x6q-tud4 |
|
|
| Risk_score | null |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:apk/alpine/go@0%3Farch=armv7&distroversion=v3.22&reponame=community |