Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. —
    GHSA-6vgg-xhvh-38ff nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store
    go
  2. 5.9
    CVE-2026-48154 GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access
    go
  3. 7.6
    CVE-2026-6961 CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync
    go
  4. 8.8
    CVE-2026-7387 Mattermost group syncable endpoints allow privilege escalation via scheme_admin
    go
  5. 5.3
    CVE-2026-6046 Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server
    go
  6. 4.3
    CVE-2026-6689 *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*
    go
  7. 6.5
    CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens
    go
  8. 6.7
    CVE-2026-6739 Mattermost: Delegated admins could patch protected default system roles
    go
  9. 4.3
    CVE-2026-3433 Mattermost fails to scope role_updated websocket events to authorized team and channel members
    go
  10. 6.8
    CVE-2026-12681 Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
    go
  11. 8.5
    CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
    go
  12. 7.1
    CVE-2026-48089 DevGuard has improper authorization on public assets
    go
  13. 8.8
    CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
    go
  14. 9.1
    CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
    go
  15. 6.9
    CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
    go
  16. 5.5
    CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
    go
  17. 4.4
    CVE-2026-47753 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
    go
  18. 4.6
    CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute
    go
  19. 6.9
    CVE-2026-48025 nebula-mesh: Decrypted CA private key persists in heap after signing
    go
  20. 8.5
    CVE-2026-50570 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
    go
  21. 4.3
    CVE-2026-50569 Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
    go
  22. 3.6
    CVE-2026-50568 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
    go
  23. 7.7
    CVE-2026-50567 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
    go
  24. 9.9
    CVE-2026-50566 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
    go
  25. 4.9
    CVE-2026-50565 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
    go
  26. 9.9
    CVE-2026-50564 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
    go
  27. 9.9
    CVE-2026-50563 Fission Container Executor Function PodSpec Injection Leading to Node Escape
    go
  28. 9.9
    CVE-2026-50545 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
    go
  29. 8.5
    CVE-2026-49824 Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
    go
  30. 7.7
    CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
    go