Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.6
    GHSA-x845-2f78-7v36 Blocky DNSSEC validation bypass and validation-cache scope pollution
    go
  2. 1.3
    CVE-2026-48794 Authelia has an Edge Case Access Control Rule Mismatch
    go
  3. 9.6
    CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
    go
  4. 6.5
    CVE-2026-53489 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
    go
  5. 8.8
    CVE-2026-53488 containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
    go
  6. 9.9
    CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
    go
  7. 5.5
    CVE-2026-47262 containerd image-triggered runtime DoS via unbounded group parsing
    go
  8. 6.8
    CVE-2026-58404 Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings
    go
  9. 8.1
    CVE-2026-49340 gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
    go
  10. 7.1
    CVE-2026-49338 Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
    go
  11. 6.5
    CVE-2026-27878 Tempo TraceQL query with exemplar hint could result in unbounded memory usage
    go
  12. 7.1
    CVE-2026-49339 Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist
    go
  13. 6.5
    CVE-2026-58403 Hugo symlink confinement bypass in os.ReadFile
    go
  14. 5.4
    CVE-2026-58402 Hugo default code block renderer XSS via unescaped code-fence language
    gojulia
  15. 7.5
    GHSA-q7j3-v8qv-22vq OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
    go
  16. 6.2
    CVE-2026-57208 Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind
    go
  17. 6.8
    CVE-2026-55689 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
    go
  18. 9.2
    CVE-2026-55884 Tilt: Missing authentication on the network-exposed Tilt HUD server
    go
  19. 8.3
    CVE-2026-55883 Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream
    go
  20. 8.3
    CVE-2026-55882 Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
    go
  21. 9.6
    CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher
    go
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  22. 5.1
    CVE-2026-10720 MicroCeph path traversal issue in the remote-import API
    go
  23. 7.5
    CVE-2026-46602 Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
    go
  24. 7.5
    CVE-2026-46601 Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
    go
  25. 4.2
    CVE-2026-54319 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
    go
  26. 5.4
    CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
    go
  27. 6.9
    CVE-2026-55701 OpenTelemetry githubreceiver silently ignores configured required_headers authentication
    go
  28. 5.3
    CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token
    go
  29. 5.3
    CVE-2026-55686 Podman: WORKDIR symlink traversal vulnerability
    go
  30. 7.0
    CVE-2026-57209 Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode
    go