Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.3
    CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution
    go
  2. 9.3
    CVE-2026-54072 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
    go
  3. 8.1
    CVE-2026-56668 ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
    go
  4. 4.8
    CVE-2026-56666 ZITADEL: Auto-linking by email: IdP-side email verification is not checked
    go
  5. 4.2
    CVE-2026-56665 ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
    go
  6. 7.5
    CVE-2026-54063 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
    go
  7. 7.5
    CVE-2026-59162 Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
    go
  8. 7.5
    CVE-2026-59161 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
    go
  9. 8.2
    CVE-2026-53657 Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
    go
  10. 5.9
    CVE-2026-49838 GoBGP confederation validation panics on empty AS_PATH attribute
    go
  11. 5.9
    CVE-2026-49837 GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
    go
  12. 5.9
    CVE-2026-49834 sigstore-go: Multi-log threshold bypass via single compromised log
    go
  13. 5.1
    CVE-2026-55252 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect
    go
  14. 7.7
    CVE-2026-59832 SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
    go
  15. 7.5
    CVE-2026-59834 SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
    go
  16. 6.9
    CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
    go
  17. 8.6
    CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
    go
  18. 5.3
    CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
    go
  19. 9.6
    CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
    go
  20. 8.0
    CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
    go
  21. 10.0
    CVE-2026-50197 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests
    go
  22. 5.9
    CVE-2026-55761 Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances
    go
  23. 6.3
    CVE-2026-55668 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
    go
  24. 4.3
    CVE-2026-55873 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
    gobitnami
  25. 7.7
    CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
    gobitnami
  26. 9.1
    CVE-2026-54061 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
    go
  27. 6.0
    CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
    go
  28. 5.9
    CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
    go
  29. 7.7
    CVE-2026-53553 Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
    go
  30. 9.6
    CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
    go