{
  "history": [
    {
      "added": 0,
      "commit": "d1f380186385b4f64e00313f31743df8e4b89a77",
      "date": "2026-11-01",
      "dependencies": 8,
      "errors": [],
      "fixable": 3,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 3,
      "osv_only": 0,
      "ref": "v1.1.4",
      "release_changed": false,
      "release_integrity": "no-assets",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 3.7,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 2,
        "Low": 1,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "files": 0
      }
    },
    {
      "added": 0,
      "commit": "d1f380186385b4f64e00313f31743df8e4b89a77",
      "date": "2026-11-02",
      "dependencies": 8,
      "errors": [],
      "fixable": 3,
      "go_version": null,
      "in_binary": null,
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 3,
      "osv_only": 0,
      "ref": "v1.1.4",
      "release_changed": false,
      "release_integrity": "no-assets",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 3.7,
      "scorecard_date": "2026-10-19",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 2,
        "Low": 1,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 2,
      "workflow": {
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "files": 0
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Static Application Security Testing (SAST) \u203a Language-specific \u203a Go",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v1.1.4",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "d1f380186385b4f64e00313f31743df8e4b89a77",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-cmdtest",
        "purl": "pkg:golang/github.com/google/go-cmdtest@v0.4.1-0.20220921163831-55ab3332a786",
        "version": "v0.4.1-0.20220921163831-55ab3332a786"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-cmp",
        "purl": "pkg:golang/github.com/google/go-cmp@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/renameio",
        "purl": "pkg:golang/github.com/google/renameio@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/mod",
        "purl": "pkg:golang/golang.org/x/mod@v0.22.0",
        "version": "v0.22.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sync",
        "purl": "pkg:golang/golang.org/x/sync@v0.10.0",
        "version": "v0.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.29.0",
        "version": "v0.29.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/telemetry",
        "purl": "pkg:golang/golang.org/x/telemetry@v0.0.0-20240522233618-39ace7a40ae7",
        "version": "v0.0.0-20240522233618-39ace7a40ae7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/tools",
        "purl": "pkg:golang/golang.org/x/tools@v0.29.0",
        "version": "v0.29.0"
      }
    ],
    "description": "Report reachable Go vulnerabilities in source and binaries",
    "errors": [],
    "id": "golang__vuln",
    "manifests": [
      "go.mod",
      "go.sum"
    ],
    "name": "govulncheck",
    "osv": {
      "advisories": 3,
      "available": true,
      "confirmed": 3,
      "osv_only": [],
      "warning": null
    },
    "ref": "v1.1.4",
    "ref_kind": "release",
    "release_integrity": {
      "assets": 0,
      "checksums_published": false,
      "methods": [],
      "provenance_published": false,
      "sbom_published": false,
      "signatures_published": false,
      "verdict": "no-assets"
    },
    "released_at": "2025-01-13T17:14:20Z",
    "repository": "golang/vuln",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 9 shared packages \u2014 no actual upgrades"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:07:17+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Branch-Protection",
          "reason": "branch protection not enabled on development/release branches",
          "score": 0
        },
        {
          "name": "CII-Best-Practices",
          "reason": "no effort to earn an OpenSSF best practices badge detected",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 0",
          "score": 0
        },
        {
          "name": "SAST",
          "reason": "no SAST tool detected",
          "score": 0
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file not detected",
          "score": 0
        },
        {
          "name": "Maintained",
          "reason": "5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4",
          "score": 4
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "Code-Review",
          "reason": "all changesets reviewed",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no workflows found",
          "score": -1
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow not detected",
          "score": -1
        },
        {
          "name": "Signed-Releases",
          "reason": "no releases found",
          "score": -1
        },
        {
          "name": "Token-Permissions",
          "reason": "No tokens found",
          "score": -1
        }
      ],
      "date": "2026-10-19",
      "score": 3.7,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [
      {
        "aliases": [
          "CVE-2026-56865"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56865",
          "percentile": 0.02533,
          "score": 0.00129
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.40.0"
        ],
        "id": "GO-2026-6179",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/mod",
        "severity": "High",
        "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno",
        "url": "https://go.dev/issue/80744",
        "version": "v0.22.0"
      },
      {
        "aliases": [
          "CVE-2026-56864"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-56864",
          "percentile": 0.22506,
          "score": 0.00298
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.40.0"
        ],
        "id": "GO-2026-6180",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/mod",
        "severity": "High",
        "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you",
        "url": "https://go.dev/issue/80745",
        "version": "v0.22.0"
      },
      {
        "aliases": [
          "CVE-2026-39824"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-39824",
          "percentile": 0.01457,
          "score": 0.00114
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.44.0"
        ],
        "id": "GO-2026-5024",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/sys",
        "severity": "Low",
        "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.",
        "url": "https://go.dev/issue/78916",
        "version": "v0.29.0"
      }
    ],
    "workflow_audit": {
      "files": 0,
      "findings": []
    }
  },
  "updated": "2026-11-02"
}