Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 6.2
    CVE-2026-33320 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
    go
  2. —
    GHSA-q382-vc8q-7jhj Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
    go
  3. 5.3
    CVE-2026-33221 Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload
    go
  4. 9.6
    CVE-2026-33211 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
    go
  5. 7.5
    GHSA-pcgw-qcv5-h8ch Unsigned SAML LogoutRequest Acceptance in gosaml2
    go
  6. —
    GHSA-hwqm-qvj9-4jr2 gosaml2 CBC Padding Panic — Unauthenticated Process Crash
    go
  7. 7.5
    CVE-2026-33487 goxmldsig has validateSignature Loop Variable Capture Signature Bypass
    go
  8. —
    GHSA-vccx-p757-pv6h mo has a XSS via inline SVG script tags in Markdown rendering
    go
  9. 5.3
    CVE-2026-33192 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
    go
  10. 8.6
    CVE-2026-33191 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
    go
  11. 7.5
    CVE-2026-33203 SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
    go
  12. 6.8
    CVE-2026-33194 SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home
    go
  13. 9.1
    CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path
    go
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  14. 5.3
    CVE-2026-33065 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
    go
  15. 7.5
    CVE-2026-33064 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
    go
  16. 7.5
    CVE-2026-33063 free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion
    go
  17. 7.5
    CVE-2026-33062 free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter
    go
  18. 6.5
    CVE-2026-32937 free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS
    go
  19. 5.3
    CVE-2026-33132 ZITADEL is missing enforcement of organization scopes
    go
  20. 5.8
    CVE-2026-33081 PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation
    go
  21. 9.0
    CVE-2026-33067 SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata
    go
  22. 9.0
    CVE-2026-33066 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
    go
  23. 8.2
    CVE-2026-32811 Heimdall: Path received via Envoy gRPC corrupted when containing query string
    go
  24. 6.5
    CVE-2026-32761 File Browser has an Authorization Policy Bypass in its Public Share Download Flow
    go
  25. 4.8
    GHSA-594f-3595-c47v Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121
    go
  26. 6.6
    CVE-2026-32694 Insecure Direct Object Reference attack via predictable secret ID in Juju
    go
  27. 8.8
    CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
    go
  28. 7.6
    CVE-2026-32692 Unauthorized update of out-of-scope Vault secrets
    go
  29. 5.3
    CVE-2026-32691 Timing ownership claim attack on new external back-end secrets
    go
  30. 7.5
    CVE-2026-32287 Infinite loop in github.com/antchfx/xpath
    go