Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 5.3
    CVE-2026-79778 rclone before v1.75.0 Denial of Service via TUS nil-response panic
    gobitnami
  2. 5.9
    CVE-2026-71310 rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
    gobitnami
  3. 8.6
    CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic
    gobitnami
  4. 3.6
    CVE-2026-79783 rclone before 1.74.4 Privilege Escalation via setuid Metadata
    gobitnami
  5. 2.7
    CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API
    gobitnami
  6. 7.7
    CVE-2026-69086 SiYuan before v3.7.3 Path Traversal via unvalidated avID
    go
  7. 10.0
    CVE-2026-69085 SiYuan before v3.7.3 SQL Injection via searchDocs
    go
    EPSS 1.4% chance of exploitation in 30 days, percentile 72%
  8. 10.0
    CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
    go
    EPSS 1.6% chance of exploitation in 30 days, percentile 75%
  9. 10.0
    CVE-2026-69083 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
    go
  10. 8.6
    CVE-2026-68587 SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction
    go
  11. 8.6
    CVE-2026-68586 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc
    go
  12. 5.8
    CVE-2026-68585 SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo
    go
  13. 8.6
    CVE-2026-68584 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints
    go
  14. 6.5
    CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
    go
  15. 8.1
    CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
    go
  16. 7.5
    CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass
    go
  17. 5.3
    CVE-2026-54909 Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
    go
  18. 3.1
    CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period
    go
  19. 6.9
    CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure
    go
  20. 9.6
    CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
    go
  21. 7.5
    CVE-2026-52856 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
    go
  22. 9.9
    CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating
    go
  23. 5.5
    CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
    go
  24. 6.6
    CVE-2026-65835 Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
    go
  25. 6.8
    CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
    go
  26. 4.3
    CVE-2026-67439 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output
    go
  27. 6.6
    CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check
    go
    EPSS 1.6% chance of exploitation in 30 days, percentile 76%
  28. 7.5
    CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
    go
  29. —
    GHSA-xvg2-cgv6-6h7v netfoil: Incorrect block responses could lead to localhost traffic
    go
  30. 9.9
    CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution
    go