Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 9.9
    CVE-2026-54158 SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
    go
  2. 7.1
    CVE-2026-54070 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
    go
  3. 9.2
    CVE-2026-54069 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
    go
    EPSS 7.5% chance of exploitation in 30 days, percentile 94%
  4. 5.9
    CVE-2026-54068 SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
    go
    EPSS 4.3% chance of exploitation in 30 days, percentile 91%
  5. 9.9
    CVE-2026-54067 SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
    go
  6. 7.5
    CVE-2026-54066 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)
    go
    EPSS 2.2% chance of exploitation in 30 days, percentile 82%
  7. 4.3
    CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
    go
  8. 6.1
    CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal
    go
  9. 6.2
    CVE-2026-48496 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
    go
  10. 5.4
    CVE-2026-52816 Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
    go
  11. 5.5
    CVE-2026-52815 Gogs: Unauthenticated Organization Teams Information Disclosure via API
    go
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  12. 5.5
    CVE-2026-52814 Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
    go
  13. 10.0
    CVE-2026-52813 Gogs: Path Traversal in organization name results in RCE through Git hooks
    go
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  14. 7.1
    CVE-2026-52812 Gogs: LFS dedupe path leaks private repo content across tenants
    go
  15. 9.0
    CVE-2026-52811 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
    go
  16. 7.1
    CVE-2026-52810 Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion
    go
  17. 6.8
    CVE-2026-52809 Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
    go
  18. 7.1
    CVE-2026-52808 Gogs: Write-level collaborators can mutate admin-only repository settings via API
    go
  19. 4.8
    CVE-2026-52807 Gogs: DOM-based XSS via Milestone Name on New Issue Page
    go
  20. 9.9
    CVE-2026-52806 Gogs: RCE via git rebase --exec argument injection in pull request merge
    go
    1 public exploit EPSS 7.9% chance of exploitation in 30 days, percentile 94%
  21. 8.7
    CVE-2026-52805 Gogs: Migration Redirect Bypass Leads to Internal Repository Theft
    go
  22. 5.5
    CVE-2026-52804 Gogs: Privilege Escalation via Collaboration Access Mode Validation
    go
  23. 5.4
    CVE-2026-52802 Gogs: Open Redirect via redirect_to in Gogs
    go
  24. 6.8
    CVE-2026-10609 Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization
    go
  25. 8.1
    CVE-2026-52801 Gogs: Ability to import local repositories via Mirror Settings
    go
  26. 8.8
    CVE-2026-52800 Gogs: CSRF Leading to Organization Owner Takeover
    go
  27. 7.5
    CVE-2026-52799 Gogs: Missing Authorization in Attachment Download
    go
  28. 8.9
    CVE-2026-52798 Gogs: Stored XSS in `.ipynb` Preview
    go
  29. 3.5
    CVE-2026-52796 Gogs: DoS in rendering issue index pattern
    go
  30. —
    GHSA-ghmh-jhmj-wcmf nebula-mesh's stores enrollment tokens unhashed in SQLite
    go