Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 2.5
    CVE-2026-11481 yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash
    go
  2. 4.2
    CVE-2026-11479 yoanbernabeu grepai Qdrant Backend chunker.go weak hash
    go
  3. 3.1
    CVE-2026-11465 songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error
    go
  4. 8.0
    CVE-2026-11401 Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
    go
  5. 7.5
    CVE-2026-52878 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain
    go
  6. 7.5
    CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
    go
  7. 7.5
    CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
    go
  8. 5.9
    CVE-2026-49343 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS
    go
  9. 5.3
    CVE-2026-47680 Source controller: Improper path handling allows traversal
    go
  10. 7.5
    CVE-2026-47249 Klever-Go KVM: Hash-array amplification in P2P resolver request handling
    go
  11. 7.6
    CVE-2026-45726 Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
    go
  12. 2.7
    CVE-2026-45723 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
    go
  13. 7.0
    CVE-2026-45720 Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token
    go
  14. 5.3
    CVE-2026-47703 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
    go
  15. 8.9
    CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions
    go
  16. 5.4
    CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
    go
  17. 7.5
    GHSA-74m6-4hjp-7226 Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)
    go
  18. 4.8
    CVE-2026-47215 Singularity: Incorrect path matching for 'limit container paths' directive
    go
  19. 8.3
    CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
    go
  20. 4.5
    CVE-2026-10814 milvus-io milvus Grantee ID Hash kv_catalog.go weak hash
    gobitnami
  21. 5.3
    CVE-2026-40898 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
    go
  22. 3.3
    CVE-2026-10722 cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow
    go
  23. 7.5
    CVE-2026-37462 GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
    go
  24. 5.3
    CVE-2026-42507 Arbitrary inputs are included in errors without any escaping in net/textproto
    bitnamigo
  25. 7.5
    CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime
    bitnamigo
  26. 7.5
    CVE-2026-27145 Inefficient candidate hostname parsing in crypto/x509
    bitnamigo
  27. 7.1
    CVE-2026-48119 Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services
    go
  28. 5.8
    GHSA-698x-9w2p-7vvp Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints
    go
  29. 7.3
    CVE-2026-10219 nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection
    go
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  30. 6.4
    CVE-2026-47268 Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host
    go