Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview
    go
  2. —
    GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
    go
  3. 5.3
    CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls
    bitnamigo
  4. 7.8
    CVE-2026-39822 Root escape via symlink plus trailing slash in os
    bitnamigo
  5. 8.6
    CVE-2026-59707 LocalAI - Server-Side Request Forgery via POST /models/apply
    go
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  6. —
    GHSA-7856-g3gv-9wq8 netfoil: Attacker controlled data written to logs
    go
  7. —
    GHSA-3g4q-2f67-2gvh netfoil has a resource leak in LRU cache
    go
  8. —
    GHSA-59qp-cfj3-rp64 netfoil has a domain name filter bypass via multiple questions
    go
  9. 5.3
    CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints
    go
  10. 7.7
    CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
    go
  11. 8.3
    CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
    go
  12. 5.8
    CVE-2026-55438 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
    go
  13. 5.4
    CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
    go
  14. 7.4
    CVE-2026-55436 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
    go
  15. 5.4
    CVE-2026-55435 Suspended Coder users retain access to AI Bridge LLM proxy endpoints
    go
  16. 6.5
    CVE-2026-55434 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
    go
  17. 5.4
    CVE-2026-55433 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
    go
  18. 5.4
    CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement
    go
  19. 7.7
    CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
    go
  20. 6.5
    CVE-2026-55078 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
    go
  21. 5.8
    CVE-2026-55430 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
    go
  22. 8.2
    CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
    go
  23. 8.7
    CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
    go
  24. 4.9
    CVE-2026-55079 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
    go
  25. 8.3
    CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
    go
  26. 7.2
    CVE-2026-55077 Coder: User-admin role can reset owner account password
    go
  27. 7.4
    CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
    go
  28. 7.4
    CVE-2026-55076 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
    go
  29. 6.9
    CVE-2026-53935 CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
    gobitnami
  30. 4.8
    CVE-2026-53624 Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
    go