Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.7
    CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
    gobitnami
  2. 5.3
    CVE-2026-40249 free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
    go
  3. 7.5
    CVE-2026-40248 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
    go
  4. 7.5
    CVE-2026-40247 free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions
    go
  5. 7.5
    CVE-2026-40246 free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions
    go
  6. 7.5
    CVE-2026-40245 Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
    go
  7. 5.5
    CVE-2026-39984 Sigstore Timestamp Authority has Improper Certificate Validation in verifier
    go
  8. 8.2
    CVE-2026-40344 MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads
    go
  9. 7.5
    CVE-2026-40481 monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation
    go
  10. 5.9
    CVE-2026-40265 Note Mark has Broken Access Control on Asset Download
    go
  11. 3.7
    CVE-2026-40263 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
    go
  12. 8.7
    CVE-2026-40262 Note Mark has Stored XSS via Unrestricted Asset Upload
    go
  13. 8.2
    CVE-2026-40193 Maddy Mail Server: LDAP Filter Injection via Unsanitized Username
    go
  14. 6.1
    CVE-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer
    gobitnami
  15. 6.5
    CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
    go
  16. 7.1
    CVE-2026-34476 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
    go
  17. 10.0
    GHSA-9cp7-j3f8-p5jx Daptin has Unauthenticated Path Traversal and Zip Slip
    go
  18. 6.3
    CVE-2026-5724 Missing Authentication on Streaming gRPC Replication Endpoint
    go
  19. 7.2
    CVE-2026-40242 Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
    go
  20. 4.8
    CVE-2026-79670 Ech0 before 4.4.3 Stored XSS via SVG Upload
    go
  21. 5.5
    CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass
    go
  22. 4.3
    CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
    go
  23. 5.5
    CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel
    go
  24. 6.5
    CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token
    go
  25. 9.8
    CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes
    go
  26. 7.7
    CVE-2026-40188 goshs is Missing Write Protection for Parametric Data Values
    go
  27. 6.5
    CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
    go
  28. 7.6
    CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
    go
  29. 8.5
    CVE-2026-40318 SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
    go
  30. 8.1
    CVE-2026-40259 SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API
    go