Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 9.8
    CVE-2026-35458 Gotenberg has a ReDoS via extraHttpHeaders scope feature
    go
  2. 6.2
    CVE-2026-35480 go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers
    go
  3. 5.0
    CVE-2026-34972 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
    go
  4. —
    GHSA-x3f4-v83f-7wp2 Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
    go
  5. 7.3
    GHSA-jfwg-rxf3-p7r9 Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation
    go
  6. 7.5
    CVE-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation
    gobitnami
  7. 7.5
    CVE-2026-33540 Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
    go
  8. 6.5
    CVE-2026-35454 Code Extension Marketplace has a Zip Slip Path Traversal
    go
  9. 5.4
    CVE-2026-35166 Hugo does not properly escape some Markdown links
    gojulia
  10. 9.8
    CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
    go
  11. 6.5
    CVE-2025-68153 Juju: Resource poisoning
    go
  12. 4.9
    CVE-2025-68152 Juju: Read All Controller Logs From Compromised Workload
    go
  13. 4.7
    CVE-2026-5469 Casdoor Webhook URL server-side request forgery
    go
  14. 3.5
    CVE-2026-5468 Casdoor dangerouslySetInnerHTML cross site scripting
    go
  15. 4.3
    CVE-2026-28736 Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)
    go
  16. 8.1
    CVE-2026-25773 Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)
    go
  17. 4.3
    CVE-2026-5467 Casdoor OAuth Authorization Request redirect
    go
  18. 9.8
    CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
    go
  19. 9.8
    CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
    go
  20. 7.5
    CVE-2026-34992 Missing Encryption of Sensitive Data in antrea.io/antrea
    go
  21. 7.2
    CVE-2026-35037 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
    go
  22. 7.5
    CVE-2026-35036 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature
    go
  23. 7.5
    CVE-2026-34986 Go JOSE affect by a panic in JWE decryption
    go
  24. 10.0
    CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
    go
    EPSS 2.1% chance of exploitation in 30 days, percentile 81%
  25. 7.1
    CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change
    go
  26. 8.1
    CVE-2026-34783 Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
    go
  27. 7.5
    CVE-2026-34969 Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback
    go
  28. 8.7
    CVE-2026-34940 KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods
    go
  29. 5.9
    GHSA-prxj-3gcv-cqrh Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials
    go
  30. 2.7
    CVE-2026-34762 Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber
    go