Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer
    go
  2. 3.7
    CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching
    go
  3. 5.9
    CVE-2026-49835 Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
    go
  4. 8.7
    CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
    go
  5. 4.7
    CVE-2026-49820 Probo has an open redirect bypass via path normalization
    go
  6. 8.1
    GHSA-7m8x-qg2j-4m3v Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec
    go
  7. —
    GHSA-55f6-4pr5-c7m5 Kahi has privilege-drop and socket/log permission issues
    go
  8. 6.5
    CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users
    go
  9. 7.5
    CVE-2026-53433 Denial of Service in fzf
    go
  10. 8.8
    CVE-2026-41053 Over-inclusive team membership expansion in GitHub App authentication provider for Rancher
    go
  11. 7.5
    CVE-2026-44840 Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
    go
  12. 9.1
    CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
    go
  13. 8.8
    CVE-2026-41052 Rancher Privilege Escalation from Project Owner to Host
    go
  14. 6.9
    CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API
    go
  15. 6.8
    CVE-2026-49349 regclient may leak authentication credentials to external blob stores
    go
  16. 9.9
    CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
    go
  17. —
    GHSA-wcr3-9x4c-f5gj Blnk has an API key authorization bypass in owner and scope enforcement
    go
  18. 8.8
    CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
    go
  19. —
    GHSA-v2jf-442r-6mjh nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction
    go
  20. 5.0
    GHSA-rhq6-9rgh-v45c Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
    go
  21. 5.5
    CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
    go
  22. 4.3
    CVE-2026-41262 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint
    go
  23. 7.5
    GHSA-jqc5-2p7q-fqfc Hysteria: http large header with sniff cause server DoS
    go
  24. 7.5
    CVE-2026-46604 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
    go
  25. 7.5
    GHSA-qh5x-rfwf-rvfv Hysteria vulnerable to server crash when max_datagram_frame_size very small
    go
  26. 7.4
    GHSA-vgrc-hq28-p3xp Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
    go
  27. 4.8
    CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive
    go
  28. 9.9
    CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash
    go
  29. 2.1
    CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
    go
  30. 9.9
    CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE
    go