Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 9.8
    CVE-2026-25996 Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode
    go
  2. 7.5
    CVE-2026-25949 Traefik: TCP readTimeout bypass via STARTTLS on Postgres
    go
  3. 9.8
    CVE-2026-24895 FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
    go
  4. 7.5
    CVE-2026-24894 FrankenPHP leaks session data between requests in worker mode
    go
  5. 5.3
    CVE-2026-21438 webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
    go
  6. 5.3
    CVE-2026-21435 webtransport-go CloseWithError can block indefinitely
    go
  7. 5.3
    CVE-2026-21434 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule
    go
  8. 6.8
    CVE-2025-41117 XSS in Grafana Explore stack trace
    gobitnami
  9. 9.8
    CVE-2026-26190 Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
    gobitnami
    EPSS 38.8% chance of exploitation in 30 days, percentile 98%
  10. 5.4
    CVE-2026-25935 Vikunja Affected by XSS Via Task Preview
    go
  11. 5.9
    CVE-2026-26014 Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key
    go
  12. 6.5
    CVE-2026-2303 Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
    go
  13. 4.3
    CVE-2026-25934 go-git improperly verifies data integrity values for .idx and .pack files
    go
  14. 8.1
    CVE-2026-25890 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
    go
  15. 5.4
    CVE-2026-25889 File Browser has an Authentication Bypass in User Password Update
    go
  16. 9.4
    CVE-2025-66630 Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
    go
  17. 7.5
    CVE-2026-25791 Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service
    go
  18. 9.1
    CVE-2026-25804 Antrea has invalid enforcement order for network policy rules caused by integer overflow
    go
  19. —
    GHSA-vhvq-fv9f-wh4q LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic
    go
  20. 8.1
    CVE-2026-25793 Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability
    go
  21. —
    CVE-2025-65852 Gogs has authorization bypass in repository deletion API
    go
  22. 7.3
    GHSA-26gq-grmh-6xm6 Gogs vulnerable to Stored XSS via Mermaid diagrams
    go
  23. 8.1
    CVE-2026-24135 Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
    go
  24. 6.5
    CVE-2026-23633 Gogs has arbitrary file read/write via path traversal in Git hook editing
    go
  25. 6.5
    CVE-2026-23632 Gogs user can update repository content with read-only permission
    go
  26. 6.5
    CVE-2026-22592 Gogs is Vulnerable to Denial of Service
    go
  27. 8.8
    CVE-2025-64175 Gogs Vulnerable to 2FA Bypass via Recovery Code
    go
  28. 9.8
    CVE-2025-64111 Gogs's update .git/config file allows remote command execution
    go
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  29. 7.7
    CVE-2025-13523 Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow
    go
  30. 7.6
    CVE-2025-70963 Gophish is vulnerable to Incorrect Access Control
    go