Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-41246 Contour: Lua code injection via Cookie Path Rewrite Policy
    gobitnami
  2. 7.7
    CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller
    gobitnami
  3. 6.5
    CVE-2026-42091 goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
    go
  4. 9.8
    CVE-2026-39087 ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function
    go
  5. 9.8
    CVE-2026-42072 Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access
    go
  6. 7.1
    CVE-2026-41894 SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint
    go
  7. 9.8
    CVE-2026-41889 pgx: SQL Injection via placeholder confusion with dollar quoted string literals
    go
  8. —
    GHSA-3m6q-h5gj-7mrw Gitea has insecure default SSH settings
    go
  9. 5.5
    CVE-2026-41646 Nuclei: Local File Read via require() Module Loader Bypass
    go
  10. 7.1
    CVE-2026-41644 monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh
    go
  11. 8.3
    CVE-2026-41422 Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API
    go
  12. 6.5
    CVE-2026-32885 DDEV has ZipSlip path traversal in tar and zip archive extraction
    go
  13. 9.8
    CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
    gobitnamijulia
    EPSS 8.6% chance of exploitation in 30 days, percentile 95%
  14. 9.8
    CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
    gobitnamijulia
    EPSS 32.7% chance of exploitation in 30 days, percentile 98%
  15. 10.0
    CVE-2026-41070 openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access
    go
  16. 5.3
    CVE-2026-41136 free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer
    go
  17. 7.5
    CVE-2026-41135 free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service
    go
  18. 5.0
    CVE-2026-41131 OpenFGA has Improper Policy Enforcement
    go
  19. 8.5
    CVE-2026-40938 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
    go
  20. 6.5
    CVE-2026-40924 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
    go
  21. 5.4
    CVE-2026-40923 Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
    go
  22. 5.8
    CVE-2026-40343 free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation
    go
    EPSS 8.6% chance of exploitation in 30 days, percentile 95%
  23. 6.1
    CVE-2026-33812 Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
    go
  24. 7.5
    CVE-2026-33813 Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
    go
  25. 7.7
    CVE-2026-40161 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
    go
  26. 6.5
    CVE-2026-25542 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
    go
  27. 8.8
    CVE-2026-39386 Neko has Self-service Privilege Escalation for Authenticated Users
    go
  28. 2.7
    CVE-2026-40264 OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
    gobitnami
  29. 3.1
    CVE-2026-39396 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
    gobitnami
  30. 3.1
    CVE-2026-39388 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
    gobitnami