Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 3.7
    CVE-2026-40097 Step CA affected by an index out of bounds panic in TPM attestation EKU validation
    go
  2. 4.3
    CVE-2026-40103 Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
    go
  3. 5.4
    CVE-2026-35602 Vikunja has a File Size Limit Bypass via Vikunja Import
    go
  4. 4.1
    CVE-2026-35601 Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output
    go
  5. 5.4
    CVE-2026-35600 Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
    go
  6. 6.5
    CVE-2026-35599 Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler
    go
  7. 4.3
    CVE-2026-35598 Vikunja has Missing Authorization on CalDAV Task Read
    go
  8. 5.9
    CVE-2026-35597 Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
    go
  9. 4.3
    CVE-2026-35596 Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
    go
  10. 8.3
    CVE-2026-35595 Vikunja Affected by Privilege Escalation via Project Reparenting
    go
  11. 6.5
    CVE-2026-35594 Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
    go
  12. 7.4
    CVE-2026-34727 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
    go
  13. 9.9
    CVE-2026-5412 Juju CloudSpec API could leak senstive information
    go
  14. 6.4
    CVE-2026-5774 Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map
    go
  15. 3.1
    CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
    go
  16. 6.5
    CVE-2026-40107 SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
    go
  17. 4.4
    CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
    gobitnami
  18. 3.5
    CVE-2026-40077 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter
    go
  19. 6.8
    CVE-2026-39961 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource
    go
  20. 8.0
    CVE-2026-35205 Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
    gobitnami
  21. 8.2
    CVE-2026-35204 Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
    gobitnami
  22. 7.5
    CVE-2026-4660 Go-getter may allow to arbitrary filesystem reads through git operations
    go
  23. 3.7
    CVE-2026-24661 Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint
    go
  24. 3.7
    CVE-2026-21388 Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint
    go
  25. 9.1
    CVE-2026-34179 Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
    go
  26. 9.1
    CVE-2026-34178 Importing a crafted backup leads to project restriction bypass
    go
  27. 9.1
    CVE-2026-34177 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
    go
  28. 7.5
    CVE-2026-40293 OpenFGA Playground Preshared Key Exposure
    go
  29. 6.5
    CVE-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
    go
  30. 7.1
    CVE-2026-39972 Mercure has a Topic Selector Cache Key Collision
    go