Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-23644 esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages
    go
  2. 8.8
    CVE-2026-23742 Skipper arbitrary code execution through lua filters
    go
  3. 6.1
    CVE-2026-23645 SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload
    go
  4. 6.8
    CVE-2025-14435 Application-Level DoS via infinite re-render loop in user profile handling
    go
  5. 3.1
    CVE-2025-14822 DoS from quadratic complexity in model.ParseHashtags
    go
  6. 5.9
    CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
    go
  7. 6.5
    CVE-2025-68671 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
    go
  8. 9.1
    CVE-2026-23520 Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE
    go
    EPSS 1.8% chance of exploitation in 30 days, percentile 79%
  9. 5.3
    CVE-2026-23511 ZITADEL has a user enumeration vulnerability in Login UIs
    go
  10. 8.1
    CVE-2025-66292 DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface
    go
  11. 4.7
    CVE-2025-69725 chi has an open redirect vulnerability in the RedirectSlashes middleware
    go
  12. 6.5
    CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service
    go
  13. 7.5
    CVE-2026-22868 go-ethereum has a DoS via malicious p2p message
    go
  14. 7.5
    CVE-2026-22862 go-ethereum has a DoS via malicious p2p message
    go
  15. 7.2
    CVE-2026-22786 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal
    go
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  16. 5.8
    CVE-2026-22772 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
    go
  17. 8.8
    CVE-2026-22771 Envoy Extension Policy lua scripts injection causes arbitrary command execution
    gobitnami
  18. 5.5
    CVE-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions
    gobitnami
  19. 6.5
    CVE-2026-22689 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails
    go
  20. 10.0
    CVE-2026-22688 WeKnora has Command Injection in MCP stdio test
    go
    EPSS 1.9% chance of exploitation in 30 days, percentile 80%
  21. 5.6
    CVE-2026-22687 WeKnora vulnerable to SQL Injection
    go
  22. 6.5
    CVE-2025-60538 Shiori is vulnerable to authentication bypass via a brute force attack
    go
  23. 5.4
    CVE-2026-22253 Soft Serve is missing an authorization check in LFS lock deletion
    go
  24. 7.5
    CVE-2025-68151 CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages
    go
  25. 6.5
    CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
    go
  26. 9.3
    CVE-2026-0650 OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
    go
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  27. 9.0
    CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
    gobitnami
  28. 5.8
    CVE-2026-21859 Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)
    go
  29. 5.4
    CVE-2025-68954 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
    packagistgo
  30. 9.8
    CVE-2025-62877 Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer
    go