Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-24451 Gitea fork synchronization can expose private parent repository data
    go
  2. 9.6
    CVE-2026-22874 Gitea webhook and migration allow-list filtering permits SSRF
    go
  3. 9.1
    CVE-2026-22547 Gitea repository creation accepts invalid field values
    go
  4. 5.3
    CVE-2026-20909 Gitea tracked-time list endpoint has insufficient permission checks
    go
  5. 9.8
    CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default
    go
    EPSS 2.8% chance of exploitation in 30 days, percentile 86%
  6. 7.1
    CVE-2026-20779 Gitea TOTP single-use enforcement defect allows OTP replay
    go
  7. 8.7
    CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename
    go
  8. 2.9
    CVE-2026-49254 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
    go
  9. 3.7
    CVE-2026-49245 SFTPGo: Stored XSS via inline parameter on public shares and user file download
    go
  10. 5.9
    CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download
    go
  11. 8.1
    CVE-2026-44454 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
    go
    EPSS 2.6% chance of exploitation in 30 days, percentile 85%
  12. 6.9
    CVE-2026-50192 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
    go
  13. 6.5
    CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
    gobitnami
  14. 5.3
    CVE-2026-45045 Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
    go
  15. 5.3
    CVE-2026-44332 Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
    go
  16. 5.9
    CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit
    go
  17. 8.1
    CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
    go
  18. —
    GHSA-vh4v-2xq2-g5cg ORAS Go forwards registry credentials across registry redirects
    go
  19. 7.1
    CVE-2026-50163 oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction
    go
  20. 6.9
    CVE-2026-50162 oras-go: file store write outside workingDir via symlink traversal
    go
  21. 7.5
    CVE-2026-50151 oras-go: credential forwarding via unvalidated Location header in blob upload
    go
  22. 2.1
    CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
    go
  23. 5.3
    CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)
    go
  24. 9.9
    CVE-2026-44935 Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
    go
  25. 5.0
    CVE-2026-44936 Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
    go
  26. 8.2
    CVE-2026-44937 SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
    go
  27. 8.8
    CVE-2026-44938 Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
    go
  28. 8.2
    CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
    go
  29. 6.3
    CVE-2026-54908 Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
    go
  30. 0.0
    CVE-2026-49826 Concourse login flow has an open redirect issue
    gobitnami