Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 6.1
    CVE-2026-42502 Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
    go
  2. 9.6
    CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
    go
    EPSS 1.8% chance of exploitation in 30 days, percentile 79%
  3. 6.1
    CVE-2026-27136 Invoking duplicate attributes can cause XSS in golang.org/x/net/html
    go
  4. 6.1
    CVE-2026-25681 Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
    go
  5. 6.5
    CVE-2026-25680 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
    go
  6. 5.3
    CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
    go
  7. 7.5
    CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
    go
  8. 10.0
    CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
    go
  9. 9.1
    CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
    go
    EPSS 6.9% chance of exploitation in 30 days, percentile 94%
  10. 7.5
    CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
    go
  11. 9.1
    CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
    go
  12. 9.1
    CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
    go
  13. 9.1
    CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
    go
  14. 9.1
    CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
    go
  15. 9.1
    CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
    go
  16. 7.5
    CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
    go
  17. 8.8
    CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
    go
  18. 6.5
    CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
    go
  19. 7.8
    CVE-2026-46680 containerd user ID handling bypass allows runAsNonRoot evasion
    go
  20. 2.3
    CVE-2026-46668 SpiceDB: Caveat structures with nested lists can result in improper cache reuse
    go
  21. 6.9
    CVE-2026-46618 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
    go
  22. 8.7
    CVE-2026-46617 Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read
    go
  23. 9.8
    CVE-2026-46614 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger
    go
  24. 8.8
    CVE-2026-46612 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
    go
  25. —
    GHSA-763j-3p5v-jfc6 androidqf: APK download Path Traversal in device APK paths
    go
  26. —
    GHSA-jf2q-463c-6f52 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)
    go
  27. 6.3
    CVE-2026-46403 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
    go
  28. 8.1
    CVE-2026-45760 Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
    go
  29. 8.0
    CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.
    go
  30. 4.3
    CVE-2026-4055 Insufficient permission validation on cross-team playbook run creation
    go