CVE-2026-94447

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-354

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-944486.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new e CVE-2026-944497.5A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers f CVE-2026-94456.3A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.p CVE-2026-944507.5Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause CVE-2026-944516.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoint CVE-2026-944537.5Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another pa CVE-2026-944557.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middle CVE-2026-944569.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used CVE-2026-944574.8Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94464.7A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the fil CVE-2026-944616.5Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.CVE-2026-944627.1Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associ