Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 2.1
    CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
    go
  2. 9.9
    CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload
    go
  3. 9.9
    CVE-2026-48752 Incus has arbitrary file read+write on host via templates/ symlink in malicious image
    go
  4. 9.9
    CVE-2026-48751 Incus has a restricted project bypass leading to arbitrary command execution
    go
  5. 9.9
    CVE-2026-48750 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
    go
  6. 9.9
    CVE-2026-48749 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
    go
  7. 7.5
    CVE-2026-57231 Podman: Malformed Image can trick podman run into leaking host environment variables into the container
    go
  8. 5.0
    CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users
    go
  9. 7.5
    CVE-2026-55677 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
    go
  10. 6.5
    CVE-2026-9639 Authenticated Denial of Service via Malicious Backup Tarball in LXD
    go
  11. 8.4
    CVE-2026-12411 Broken Access Control in Canonical LXD DevLXD API
    go
  12. 5.4
    CVE-2026-13426 Client4 fails to validate path parameters
    go
  13. 3.8
    CVE-2026-13322 Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
    go
  14. 6.4
    CVE-2026-13318 Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
    go
  15. 4.2
    CVE-2026-13218 Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
    go
  16. 7.5
    CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
    go
  17. 6.0
    CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
    go
  18. 10.0
    CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
    gobitnami
    EPSS 1.6% chance of exploitation in 30 days, percentile 76%
  19. 6.9
    CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
    go
  20. 6.5
    CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
    go
  21. 6.5
    CVE-2026-72817 go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
    go
  22. 6.5
    GHSA-r4v7-6wcg-ghj5 FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks
    go
  23. 5.8
    CVE-2026-54250 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
    go
  24. 9.3
    CVE-2026-54088 File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
    go
  25. 9.1
    CVE-2026-54089 File Browser: Authentication Bypass via Proxy Auth Header Forgery
    go
  26. 8.2
    CVE-2026-55667 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
    go
  27. 6.5
    CVE-2026-54448 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
    go
  28. 7.5
    CVE-2026-55092 Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts
    go
  29. 7.2
    CVE-2026-55477 Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
    go
  30. 9.9
    CVE-2026-50551 SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
    go