Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-6339 Missing request origin validation on burn-on-read reveal endpoint
    go
  2. 4.3
    CVE-2026-6340 Memory Exhaustion via Malicious 7zip File Upload
    go
  3. 3.8
    CVE-2026-3495 Unescaped variables during error page composition
    go
  4. 3.7
    CVE-2026-4273 Insufficient token rotation validation in remote cluster invite confirmation
    go
  5. 4.3
    CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts
    go
  6. 4.3
    CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler
    go
  7. 4.3
    CVE-2026-28759 Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels
    go
  8. 3.1
    CVE-2026-6334 OAuth authorization code client binding not enforced during token redemption in Mattermost
    go
  9. 4.3
    CVE-2026-8783 omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference
    go
  10. 4.3
    CVE-2026-8782 omec-project amf NGAP Message handler.go null pointer dereference
    go
  11. 4.3
    CVE-2026-8781 omec-project amf handler.go RANConfiguration null pointer dereference
    go
  12. 4.3
    CVE-2026-8780 omec-project amf NGAP Message dispatcher.go memory corruption
    go
  13. 4.3
    CVE-2026-8779 omec-project amf handler.go NGSetupRequest memory corruption
    go
  14. 9.6
    CVE-2026-46703 BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host
    pypicrates.ionpmgo
  15. 10.0
    CVE-2026-46695 BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files
    pypinpmgocrates.io
  16. 3.1
    CVE-2026-4053 post edit time limit is not enforced on some post update operations
    go
  17. 4.3
    CVE-2026-4054 SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service
    go
  18. 2.8
    GHSA-rc6v-5rmx-w5mv arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS
    go
  19. 7.4
    GHSA-mxg3-432p-mr72 goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request
    go
  20. 8.1
    CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
    go
  21. 3.5
    CVE-2026-45803 gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
    go
  22. 3.5
    CVE-2026-45781 MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims
    go
  23. —
    GHSA-gxhx-2686-5h9g slack-go `SecretsVerifier` accepts empty signing secret without precondition
    go
  24. 5.1
    CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
    go
  25. 9.1
    CVE-2026-8634 Crabbox < v0.12.0 Environment Variable Information Disclosure
    go
  26. 8.8
    CVE-2026-8621 Crabbox < v0.12.0 Authentication Bypass via Header Spoofing
    go
  27. 8.1
    CVE-2026-44973 Billy: Path traversal vulnerabilities
    go
  28. 6.5
    CVE-2026-44884 Portainer: Missing authorization on custom template file endpoint exposes template content
    go
  29. 7.5
    CVE-2026-44883 Portainer: JWT accepted in URL query leaks tokens to logs and referers
    go
  30. 8.8
    CVE-2026-44849 Portainer: Endpoint security bypass via Swarm service create/update
    go