Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.2
    CVE-2026-38651 Netmaker does not verify JWT signatures for host tokens
    go
  2. 7.3
    CVE-2026-6970 authd Denial of Service and Local Privilege Escalation
    go
  3. 3.7
    CVE-2026-7020 Ollama Tensor Model Transfer transfer.go digestToPath path traversal
    go
  4. 5.3
    CVE-2026-41572 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books
    go
  5. 9.4
    CVE-2026-41571 Note Mark: OIDC-registered users authenticated by submitting password "null"
    go
  6. 7.9
    CVE-2026-41520 Cillium exposes sensitive information included in the cilium-bugtool debug archive
    gobitnami
  7. 8.7
    CVE-2026-42275 zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
    go
  8. 7.8
    CVE-2026-42274 Heimdall: Authorization bypass via path normalization mismatch
    go
  9. 7.8
    CVE-2026-42273 Heimdall: Case-sensitive host matching may lead to policy bypass
    go
  10. 7.8
    CVE-2026-42272 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
    go
  11. 5.3
    CVE-2026-6993 go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy
    go
  12. 7.3
    CVE-2026-6987 PicoClaw Web Launcher Management Plane restart command injection
    go
    EPSS 3.4% chance of exploitation in 30 days, percentile 89%
  13. —
    GHSA-h829-5cg7-6hff gitverify has improper tag signature verification
    go
  14. 3.7
    CVE-2026-41263 Traefik: BasicAuth middleware: timing side-channel vulnerability
    go
  15. 6.4
    CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
    go
  16. 8.8
    CVE-2026-41326 Kata Containers: CopyFile Policy Subversion via Symlinks
    go
  17. 8.6
    CVE-2026-40912 Traefik: StripPrefixRegex auth bypass via Path/RawPath desync
    go
  18. —
    GHSA-rp7v-4384-hfrp k8sGPT has Prompt Injection through its k8sGPT-Operator
    go
  19. 8.2
    CVE-2026-39858 Traefik: Forwarded alias spoofing top pre-auth decision bypass
    go
  20. 8.2
    CVE-2026-35051 Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
    go
  21. 9.8
    GHSA-xhj4-g6w8-2xjw go-zserio has Unbounded Memory Allocation for All Platforms
    go
  22. 9.8
    CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
    go
    EPSS 3.1% chance of exploitation in 30 days, percentile 87%
  23. 7.1
    CVE-2026-41432 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
    go
  24. 9.1
    CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
    go
  25. 9.1
    CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
    go
  26. 7.5
    CVE-2026-21728 Tempo query limit results in unbounded memory allocation
    go
  27. 7.7
    CVE-2026-41485 Kyverno Controller Denial of Service via forEach Mutation Panic
    gobitnami
  28. 4.4
    CVE-2026-29051 melange has Path Traversal via .PKGINFO in --persist-lint-results
    go
  29. 6.1
    CVE-2026-29050 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
    go
  30. 5.3
    CVE-2026-32952 go-ntlmssp NTLM challenges can panic on malformed payloads
    go
    EPSS 1.0% chance of exploitation in 30 days, percentile 64%