Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.2
    CVE-2026-33503 Ory Kratos has a SQL injection via forged pagination tokens
    go
  2. 10.0
    CVE-2026-33494 Ory Oathkeeper has a path traversal authorization bypass
    go
  3. 8.1
    CVE-2026-33496 Ory Oathkeeper has an authentication bypass by cache key confusion
    go
  4. 6.5
    CVE-2026-33495 Ory Oathkeeper has an authentication bypass by usage of untrusted header
    go
  5. 8.8
    CVE-2026-33413 etcd: Authorization bypasses in multiple APIs
    gobitnami
  6. 7.5
    CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit
    go
  7. 5.3
    CVE-2026-33481 Syft improper temporary file cleanup
    go
  8. 7.5
    CVE-2026-33476 SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal
    go
    EPSS 3.2% chance of exploitation in 30 days, percentile 88%
  9. 6.5
    CVE-2026-33474 Vikunja Affected by DoS via Image Preview Generation
    go
  10. 5.7
    CVE-2026-33473 Vikunja has TOTP Reuse During Validity Window
    go
  11. 0.0
    CVE-2026-33343 etcd: Nested etcd transactions bypass RBAC authorization checks
    gobitnami
  12. 8.1
    CVE-2026-33316 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
    go
  13. 4.3
    CVE-2026-33315 Vikunja has a 2FA Bypass via Caldav Basic Auth
    go
  14. 4.3
    CVE-2026-33313 Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
    go
  15. 5.4
    CVE-2026-33312 Read-only Vikunja users can delete project background images via broken object-level authorization
    go
  16. 5.3
    CVE-2026-29794 Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
    go
  17. 3.7
    CVE-2026-32595 Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration
    go
  18. 8.3
    CVE-2026-32305 Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
    go
  19. 8.8
    CVE-2026-4342 ingress-nginx comment-based nginx configuration injection
    Kubernetesgo
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  20. 6.5
    CVE-2026-33353 Soft Serve: Authenticated repo import can clone server-local private repositories
    go
  21. 8.1
    CVE-2026-33344 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG
    go
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  22. 9.8
    CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication
    go
  23. 6.5
    CVE-2026-33283 Ella Core panics on malformed ULNASTransport Message without a Request Type
    go
  24. 7.5
    CVE-2026-33282 Ella Core panics on malformed NGAP Location Report
    go
  25. 6.5
    CVE-2026-33281 Ella Core panics on invalid PDU Session IDs in NGAP messages
    go
  26. 5.7
    CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
    go
  27. 5.7
    CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
    go
  28. 7.1
    CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
    go
  29. 9.6
    CVE-2026-30924 qui CORS Misconfiguration: Arbitrary Origins Trusted
    go
  30. 10.0
    CVE-2026-30836 Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
    go