Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API
    gobitnami
  2. 6.5
    CVE-2026-40197 Incus nil-pointer dereference in custom volume import allows denial of service
    go
  3. 6.5
    CVE-2026-40195 Incus nil-pointer dereference in storage bucket import allows denial of service
    go
  4. 5.0
    CVE-2026-35527 Incus blind SSRF via image import preflight HEAD request
    go
  5. 9.1
    CVE-2026-7482 Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
    go
    EPSS 7.1% chance of exploitation in 30 days, percentile 94%
  6. 5.3
    CVE-2026-7737 osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds
    go
  7. 7.3
    CVE-2026-7736 osrg GoBGP mrt.go parseRibEntry integer underflow
    go
  8. 5.3
    CVE-2026-7734 osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service
    go
  9. 7.5
    CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function
    go
  10. 8.1
    CVE-2026-100838 Contrast before 1.19.1 CopyFile Policy Symlink Subversion
    go
  11. 7.5
    CVE-2026-42461 Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
    go
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  12. 9.1
    CVE-2026-42560 auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation
    go
  13. 7.2
    CVE-2026-7461 OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials
    go
  14. —
    GHSA-28xx-pppm-vqff ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction
    go
  15. 10.0
    CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
    go
    EPSS 2.3% chance of exploitation in 30 days, percentile 83%
  16. 7.2
    CVE-2026-39383 Gotenberg unauthenticated blind SSRF via unfiltered webhook URL
    go
  17. 7.5
    CVE-2026-40280 Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
    go
    EPSS 2.0% chance of exploitation in 30 days, percentile 80%
  18. —
    GHSA-vjgj-42f6-7997 netfoil's optional seccomp sandboxing was not applied
    go
  19. —
    GHSA-84g5-x8j3-7235 Netfoil has incorrect allowlist enforcement
    go
  20. 8.5
    CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
    go
  21. 7.5
    CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
    go
  22. 7.5
    CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
    go
  23. 7.5
    CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
    go
  24. 7.5
    CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
    go
  25. 7.5
    CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
    go
  26. 7.5
    CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
    go
  27. 7.5
    CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
    go
  28. 6.5
    CVE-2026-30246 github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters
    go
  29. 5.9
    CVE-2026-33467 Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass
    go
  30. 7.5
    CVE-2026-41602 Apache Thrift: Go TFramedTransport uint32 overflow
    gobitnami
    EPSS 1.2% chance of exploitation in 30 days, percentile 67%