Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 5.8
    CVE-2026-34761 Ella Core Panics Upon NGAP handover failure
    go
  2. 8.0
    CVE-2026-34742 Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost
    go
  3. 4.4
    GHSA-rxmp-8h9v-56cx NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner
    go
  4. 8.1
    CVE-2026-34581 goshs has Auth Bypass via Share Token
    go
  5. 7.7
    CVE-2026-33544 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances
    go
  6. 2.3
    CVE-2026-5199 Cross Namespace Access via Batch Operation
    go
  7. 10.0
    CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
    go
  8. 6.9
    CVE-2026-34530 File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection
    go
  9. 8.1
    CVE-2026-34528 File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution
    go
  10. 7.6
    CVE-2026-34529 File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file
    go
  11. 8.1
    CVE-2026-25726 Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)
    go
  12. 6.1
    CVE-2026-34605 SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
    go
  13. 8.6
    CVE-2026-34585 SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution
    go
  14. 9.7
    CVE-2026-34449 SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
    go
  15. 9.1
    CVE-2026-34448 SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client
    go
  16. 7.5
    CVE-2026-34453 SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content
    go
    EPSS 1.2% chance of exploitation in 30 days, percentile 69%
  17. 8.8
    CVE-2026-34227 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
    go
  18. 9.8
    CVE-2026-4789 CVE-2026-4789
    gobitnami
  19. 5.0
    CVE-2026-34165 go-git: Maliciously crafted idx file can cause asymmetric memory consumption
    go
  20. 9.1
    CVE-2026-33990 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
    go
  21. 2.8
    CVE-2026-33762 go-git: Missing validation decoding Index v4 files leads to panic
    go
  22. 9.8
    CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
    go
    EPSS 35.3% chance of exploitation in 30 days, percentile 98%
  23. 8.8
    CVE-2026-33030 Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys
    go
  24. 6.5
    CVE-2026-33029 Nginx UI: DoS via Negative Integer Input in Logrotate Interval
    go
  25. 7.5
    CVE-2026-33028 Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse
    go
  26. 6.5
    CVE-2026-33027 Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
    go
  27. 9.1
    CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups
    go
  28. 7.5
    CVE-2026-27018 Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme
    go
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  29. —
    GHSA-46wh-3698-f2cx Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
    go
  30. —
    GHSA-c279-989m-238f Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted
    go