Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.0
    CVE-2026-57210 Heimdall: IP Spoofing via Unvalidated Forwarding Headers
    go
  2. 7.1
    CVE-2026-50141 Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation
    go
  3. 4.2
    CVE-2026-55669 ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
    go
  4. 4.2
    CVE-2026-56664 ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
    go
  5. 7.4
    CVE-2026-55672 ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
    go
  6. 2.3
    CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
    go
  7. 8.7
    CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway
    go
  8. 7.5
    CVE-2026-55229 Gotenberg: SSRF via LibreOffice document processing
    go
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  9. 2.3
    CVE-2026-55671 ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
    go
  10. 8.1
    CVE-2026-11719 MCP Toolbox for Databases: authenticated authorization bypass
    go
  11. 9.1
    CVE-2026-11718 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
    go
  12. 9.1
    CVE-2026-11717 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
    go
  13. 5.7
    CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected
    go
  14. 6.1
    CVE-2026-25779 Gitea redirect handling permits open redirects through backslash paths
    go
  15. 8.7
    CVE-2026-28737 Gitea 3D file viewer allows stored XSS through glTF extensionsRequired
    go
  16. 8.1
    CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
    go
  17. 8.1
    CVE-2026-22555 Gitea organization forks can expose organization secrets without create permission
    go
  18. 6.5
    CVE-2026-54324 Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
    go
  19. 7.1
    CVE-2026-54761 Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services
    go
  20. 9.1
    CVE-2026-20706 Gitea repository archive downloads bypass token scope checks
    go
  21. 4.3
    CVE-2026-27783 Gitea issue-template APIs bypass repository unit authorization
    go
  22. 4.3
    CVE-2026-25714 Gitea user organization API bypasses public-only token filtering
    go
  23. 8.5
    CVE-2026-26231 Gitea maintainer-edit permissions allow unauthorized commits to readable repositories
    go
  24. 8.1
    CVE-2026-28699 Gitea Basic Auth bypasses OAuth2 access token scopes
    go
  25. 8.5
    CVE-2026-52797 Gogs: Overwriting critical files results in a denial of service
    go
  26. 9.8
    CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
    gobitnami
  27. 8.1
    CVE-2026-28744 Gitea Git smart HTTP bypasses repository token scopes for bearer tokens
    go
  28. 8.2
    CVE-2026-48788 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
    go
  29. 7.7
    CVE-2026-54322 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
    go
  30. 4.2
    CVE-2026-52846 Caddy: stripHTML template function bypass
    go