Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 10.0
    CVE-2026-54763 Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
    go
  2. 5.5
    CVE-2026-54637 Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
    go
  3. 8.5
    CVE-2026-54765 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
    go
  4. 5.8
    CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
    go
  5. 9.2
    CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
    gobitnami
  6. 9.6
    CVE-2026-58426 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
    go
  7. 8.9
    CVE-2026-58424 Permanent Fork PR Workflow Approval Gate Bypass
    go
  8. 7.7
    CVE-2026-58423 LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
    go
  9. 9.8
    CVE-2026-58422 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
    go
  10. 7.5
    CVE-2026-58421 Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
    go
  11. 7.5
    CVE-2026-58419 Notification API leaks private issue metadata after access revocation
    go
  12. 6.5
    CVE-2026-58418 SSRF via HTTP Redirect in Repository Migration
    go
  13. 7.1
    CVE-2026-28740 Gitea LFS object reuse bypasses Code-unit authorization
    go
  14. 5.3
    CVE-2026-28705 Gitea repository dumps write release assets using unsafe path names
    go
  15. 9.8
    CVE-2026-27780 Gitea pre-receive hook can miss branch-protection checks after scanner errors
    go
  16. 7.5
    CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing
    go
  17. 8.8
    CVE-2026-27775 Gitea pre-receive hook permission cache allows full repository write access
    go
  18. 8.2
    CVE-2026-27771 Gitea Composer package source links use insufficient permission checks
    go
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  19. 4.3
    CVE-2026-27761 Gitea repository feeds bypass API token scope enforcement
    go
  20. 7.5
    CVE-2026-27660 Gitea draft releases use insufficient permission checks
    go
  21. 7.5
    CVE-2026-27657 Gitea email settings allow changing another user's primary email address
    go
  22. 7.5
    CVE-2026-26307 Gitea git grep search lacks a timeout
    go
  23. 9.8
    CVE-2026-26292 Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
    go
  24. 9.1
    CVE-2026-26247 Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
    go
  25. 9.1
    CVE-2026-26232 Gitea OAuth2 authorization codes lack expiry and reuse enforcement
    go
  26. 5.3
    CVE-2026-25782 Gitea tracked-time deletion can target entries from another issue
    go
  27. 9.1
    CVE-2026-25718 Gitea template repository generation mishandles symlinked paths
    go
  28. 7.5
    CVE-2026-25712 Gitea organization permission APIs expose private visibility information
    go
  29. 7.5
    CVE-2026-25038 Gitea private organization labels are visible to unauthorized users
    go
  30. 7.5
    CVE-2026-24690 Gitea pull-request branch updates use insufficient permission checks
    go