Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
    go
  2. 5.9
    CVE-2026-71493 Infracost: Arbitrary file read via config-template readFile symlink traversal
    go
  3. 5.9
    CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
    go
  4. 7.7
    CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects
    go
  5. 7.7
    CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects
    go
  6. 6.5
    CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
    go
  7. 5.3
    CVE-2026-67447 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement
    go
  8. 5.3
    CVE-2026-67445 Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
    go
  9. 5.3
    CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
    go
  10. 9.1
    CVE-2026-71485 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
    go
  11. 3.1
    CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
    go
  12. 5.3
    CVE-2026-101047 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
    go
  13. 7.6
    CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
    go
  14. 6.5
    CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
    go
  15. 8.2
    CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
    go
  16. 2.6
    GHSA-22w5-2fxg-vrwx OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
    go
  17. 4.7
    CVE-2026-54162 Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
    go
  18. 3.4
    CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings
    go
  19. 3.7
    CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash
    go
  20. 7.5
    CVE-2026-55149 Vouch Proxy: Unbounded Multipart Cookie Allocation DoS
    go
  21. 5.9
    CVE-2026-45404 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
    go
  22. 5.9
    CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball
    go
  23. 6.8
    CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
    go
  24. 5.3
    CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor
    go
  25. 2.3
    CVE-2026-61712 BuildKit: Possible runtime DoS via unbounded group parsing
    go
  26. 6.9
    CVE-2026-53941 Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS
    go
  27. 7.5
    CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
    go
  28. 7.1
    CVE-2026-17106 Tar extraction in moby/go-archive can write outside the destination directory via link following
    Dockergobitnami
  29. 5.3
    CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
    go
  30. —
    GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
    go