Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 5.9
    CVE-2026-56742 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
    gobitnami
  2. 8.1
    CVE-2026-62685 File Browser: Colliding username normalization gives two users the same home directory
    go
  3. 6.8
    CVE-2026-62843 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
    go
  4. 7.6
    CVE-2026-54560 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim
    go
  5. 7.1
    CVE-2026-54563 Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root
    go
  6. 6.5
    CVE-2026-54562 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
    go
  7. 8.8
    CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
    gobitnami
  8. 7.5
    CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
    gobitnami
  9. 5.0
    CVE-2026-59732 rclone archive extract allows S3 destination prefix escape via crafted archive paths
    gobitnami
  10. 9.0
    CVE-2026-61549 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
    go
  11. 7.7
    CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
    go
  12. 8.1
    CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh
    go
  13. 5.4
    CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
    go
  14. 5.3
    CVE-2026-55512 nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting
    go
  15. 7.5
    CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
    go
  16. 7.1
    CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database
    go
  17. 7.1
    CVE-2026-53604 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
    go
  18. 8.6
    CVE-2026-54628 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
    go
  19. —
    GHSA-mqxv-9rm6-w8qc Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
    go
  20. 8.5
    GHSA-pqg7-v6wh-3pfp TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services
    go
  21. 7.7
    CVE-2026-50158 yutu: Arbitrary File Write via MCP `caption-download` Tool
    go
  22. 9.1
    CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
    go
  23. 7.5
    CVE-2026-50125 MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion
    go
  24. 6.5
    CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
    go
  25. 7.5
    CVE-2026-50013 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
    go
  26. 7.5
    CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text
    go
  27. 7.5
    CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
    bitnamigo
  28. 8.8
    CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
    go
  29. 3.1
    CVE-2026-61874 filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
    go
  30. 9.0
    GHSA-g936-7jqj-mwv8 TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation
    go