Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-52845 Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
    go
  2. 7.5
    CVE-2026-52844 Caddy: Windows `file_server` path authorization bypass via encoded backslash
    go
  3. 7.0
    CVE-2026-54321 Daytona: Public sandbox previews remain accessible for up to one hour after being made private
    go
  4. 9.1
    CVE-2026-53622 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
    go
  5. 5.5
    CVE-2026-50135 Hugo: Symlink confinement bypass in resources.Get
    go
  6. 5.8
    CVE-2026-50134 Hugo: security.http.urls allow-list bypass via HTTP redirects
    gojulia
  7. 6.1
    CVE-2026-50133 Hugo: XSS via text/html content files
    gojulia
  8. 9.1
    CVE-2026-48491 Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
    go
  9. 3.7
    CVE-2026-48709 OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration
    go
  10. 7.5
    CVE-2026-48708 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination
    go
  11. 8.1
    CVE-2026-50891 Filestash allows attackers to escalate privileges via sending a crafted request
    go
  12. 8.8
    CVE-2026-50884 statping-ng allows attackers to escalate privileges to Administrator and access sensitive components
    go
  13. 7.5
    CVE-2026-50879 linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request
    go
  14. 9.4
    CVE-2026-11624 MCP Toolbox for Databases has an Origin Validation Error
    go
  15. 8.8
    CVE-2026-11769 Operator - Namespaced User Path Traversal
    go
  16. 8.7
    CVE-2026-54090 File Browser: Command Allowlist Bypass via Shell Metacharacter Injection
    go
  17. 7.5
    CVE-2026-54091 File Browser: Incorrect access control in public directory shares via rule path rebasing
    go
  18. 6.8
    CVE-2026-54093 File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames
    go
  19. 7.5
    CVE-2026-54094 File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope
    go
  20. 6.5
    CVE-2026-54092 File Browser: DoS Vulnerability on Public Login API
    go
  21. 8.4
    CVE-2026-54096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
    go
  22. 6.8
    CVE-2026-53523 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
    go
  23. 6.5
    CVE-2026-53522 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
    go
  24. 6.4
    CVE-2026-53521 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
    go
  25. 6.5
    CVE-2026-53520 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
    go
  26. 9.1
    CVE-2026-53519 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
    go
    EPSS 1.9% chance of exploitation in 30 days, percentile 80%
  27. 7.2
    CVE-2026-54097 File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
    go
  28. 6.5
    CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
    go
  29. 6.5
    CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
    go
  30. 7.7
    CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
    go