Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-45686 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
    go
  2. 7.5
    CVE-2026-45685 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
    go
  3. 4.9
    CVE-2026-45684 OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers
    go
  4. 5.1
    CVE-2026-45682 OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
    go
  5. 3.8
    CVE-2026-45683 OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
    go
  6. 5.9
    CVE-2026-45681 OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
    go
  7. 5.9
    CVE-2026-45680 OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
    go
  8. 7.5
    CVE-2026-45678 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads
    go
  9. 6.5
    CVE-2026-45679 OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
    go
  10. 5.5
    CVE-2026-45676 OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
    go
  11. 8.2
    CVE-2026-45327 TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
    go
  12. 7.2
    CVE-2026-42306 Moby: Race condition in docker cp allows bind mount redirection to host path
    Dockergo
  13. 6.1
    CVE-2026-41568 Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
    Dockergo
  14. 7.5
    CVE-2026-41567 Docker: `PUT /containers/{id}/archive` executes container binary on the host
    Dockergo
  15. 8.6
    CVE-2026-45298 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
    go
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  16. 7.5
    CVE-2026-46385 iskorotkov/avro: CPU Exhaustion in Avro Decoder
    go
  17. 7.5
    CVE-2026-46384 iskorotkov/avro: Integer Overflow in Avro Decoder
    go
  18. 8.2
    CVE-2026-45627 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover
    go
  19. 6.3
    CVE-2026-45626 Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter
    go
  20. 9.9
    CVE-2026-45625 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs
    go
  21. 8.1
    CVE-2026-45135 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
    go
  22. 7.5
    GHSA-mx64-mj3q-7prj iskorotkov/avro: Denial-of-Service Vulnerability in Decoder
    go
  23. 3.5
    CVE-2026-6333 SSRF via Host Header Spoofing in Custom Slash Commands
    go
  24. 6.5
    CVE-2026-6345 Prevent password disclosure and force reset during Slack import
    go
  25. 8.7
    CVE-2026-6346 Sensitive credentials exposed in plaintext in Mattermost support packets
    go
  26. 4.3
    CVE-2026-28732 Slash command trigger-word update allowed command hijacking
    go
  27. 4.3
    CVE-2026-6343 Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks
    go
  28. 7.6
    CVE-2026-6347 Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets
    go
  29. 6.5
    CVE-2026-5163 Missing authorization check in AI message rewrite endpoint allows access to private thread content
    go
  30. 3.1
    CVE-2026-4286 Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update
    go