Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 3.1
    CVE-2025-9081 IDOR in board file download allows any user to download any file by UUID
    go
  2. 8.0
    CVE-2025-9079 Admin RCE via prepackaged plugins by way of misconfigured imports directory
    go
  3. 4.3
    CVE-2025-10630 Regex DoS in Grafana Zabbix Plugin
    go
  4. 6.5
    CVE-2025-47906 Unexpected paths returned from LookPath in os/exec
    bitnamigo
  5. 3.7
    CVE-2025-59410 Dragonfly tiny file download uses hard coded HTTP protocol
    go
  6. 5.3
    CVE-2025-59354 Dragonfly has weak integrity checks for downloaded files
    go
  7. 7.5
    CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses
    go
  8. 9.8
    CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine
    go
  9. 5.3
    CVE-2025-59351 Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
    go
  10. 5.3
    CVE-2025-59350 Timing attacks against Proxy’s basic authentication are possible
    go
  11. 3.3
    CVE-2025-59349 Directories created via os.MkdirAll are not checked for permissions
    go
  12. 7.5
    CVE-2025-59348 Dragonfly incorrectly handles a task structure’s usedTraffic field
    go
  13. 6.5
    CVE-2025-59347 Dragonfly Manager makes requests to external endpoints with disabled TLS authentication
    go
  14. 5.3
    CVE-2025-59346 Dragonfly server-side request forgery vulnerability
    go
  15. 9.1
    CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints
    go
  16. 5.5
    CVE-2025-59342 esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
    go
    1 public exploit EPSS 3.2% chance of exploitation in 30 days, percentile 88%
  17. 7.7
    CVE-2025-59341 Local File Inclusion in esm.sh
    go
    EPSS 1.6% chance of exploitation in 30 days, percentile 76%
  18. 7.4
    CVE-2025-4953 Podman: build context bind mount
    go
  19. 6.9
    CVE-2025-8396 Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling
    go
  20. 9.8
    CVE-2025-59361 OS command injection in Chaos Mesh via the cleanIptables mutation
    go
    EPSS 3.4% chance of exploitation in 30 days, percentile 88%
  21. 9.8
    CVE-2025-59360 OS command injection in Chaos Mesh via the killProcesses mutation
    go
    EPSS 2.9% chance of exploitation in 30 days, percentile 87%
  22. 9.8
    CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation
    go
    EPSS 3.0% chance of exploitation in 30 days, percentile 87%
  23. 7.5
    CVE-2025-59358 Denial of Service via Unauthorized Access to Chaos Mesh debugging server
    go
  24. 7.6
    CVE-2025-9072 One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter
    go
  25. 3.1
    CVE-2025-9084 Open redirect in OAuth login
    go
  26. 4.3
    CVE-2025-9078 Weak cache keys lead to post IDOR and link preview poisoning
    go
  27. 6.5
    CVE-2025-9076 Mattermost Server exposes sensitive user credentials during shared channel membership synchronization
    go
  28. 7.5
    CVE-2025-54376 Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.
    go
  29. 9.8
    CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
    go
    EPSS 10.9% chance of exploitation in 30 days, percentile 95%
  30. 6.1
    CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover
    go