Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-21386 Private channel enumeration via /mute slash command
    go
  2. 4.3
    CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload
    go
  3. 4.3
    CVE-2026-4265 Guest user can upload files without permission across teams
    go
  4. 4.3
    CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion
    go
  5. 7.5
    CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords
    go
  6. 4.3
    CVE-2026-2578 Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts
    go
  7. 4.3
    CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload
    go
  8. 4.3
    CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal
    go
  9. 4.3
    CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation
    go
  10. 4.3
    CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board
    go
  11. 4.3
    CVE-2026-2463 Unauthorized access to invite ID during team creation
    go
  12. 7.6
    CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets
    go
  13. 5.3
    CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions
    go
  14. 7.5
    CVE-2026-30405 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
    go
  15. 7.1
    CVE-2026-32720 Improper Access Control in github.com/ctfer-io/monitoring
    go
  16. 6.5
    CVE-2026-32704 SiYuan renderSprig: missing admin check allows any user to read full workspace DB
    go
  17. 0.0
    GHSA-q926-c743-49qj Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
    go
  18. 4.3
    CVE-2026-30961 Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload
    go
  19. 6.5
    CVE-2026-30955 Gokapi vulnerable to DoS in E2E Metadata Parser
    go
  20. 4.1
    CVE-2026-30943 Gokapi has Privilege Escalation in File Replace
    go
  21. 4.3
    CVE-2026-30915 SFTPGo improperly sanitizes placeholders in group home directories/key prefixes
    go
  22. 8.1
    CVE-2026-30914 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy
    go
  23. 7.5
    CVE-2026-32614 Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability
    go
  24. 9.1
    CVE-2026-31886 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution
    go
  25. 9.3
    CVE-2026-32301 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
    go
  26. 6.5
    CVE-2026-32320 Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings
    go
  27. 7.5
    CVE-2026-32319 Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload
    go
  28. 8.5
    CVE-2026-32246 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
    go
  29. 6.5
    CVE-2026-32245 Tinyauth's OIDC authorization codes are not bound to client on token exchange
    go
  30. —
    GHSA-4hjq-9h5c-252j Traefik: HTTP/2 frames can cause a running server to panic
    go