Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.1
    CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
    go
  2. 8.1
    CVE-2026-55065 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api
    go
  3. 4.3
    CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
    go
  4. 5.3
    CVE-2026-54766 Vikunja: Project duplication bypasses write-permission check on the target parent project
    go
  5. 4.3
    CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
    go
  6. 6.6
    CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory
    go
  7. 9.6
    CVE-2026-54755 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
    go
  8. 9.6
    CVE-2026-54754 Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
    go
  9. 8.5
    CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read
    go
  10. 6.4
    CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe
    go
  11. 7.5
    CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
    go
  12. 8.2
    CVE-2026-82234 SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
    go
  13. 5.7
    CVE-2026-82233 SiYuan before v3.8.1 Path Traversal via asset.upload
    go
  14. 5.3
    CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou
    go
  15. 8.9
    CVE-2026-79921 amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
    go
  16. 9.8
    CVE-2026-60004 Gitea: Remote Code Execution via diffpatch Git Hook Installation
    gobitnami
    kev EPSS 24.0% chance of exploitation in 30 days, percentile 97%
  17. 9.6
    CVE-2026-54523 Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
    gobitnami
  18. 6.5
    CVE-2026-55588 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
    go
  19. 8.8
    CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport
    go
  20. 8.6
    CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist
    go
  21. 8.4
    CVE-2026-55581 mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
    go
  22. 8.4
    CVE-2026-55582 mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias
    go
  23. 3.1
    CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
    go
  24. 5.3
    CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint
    go
  25. —
    GHSA-w67g-5rqw-f597 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
    go
  26. —
    GHSA-4ph6-mjv7-3fq6 netfoil vulnerable to improper handling of untrusted DoH response data
    go
  27. 6.6
    CVE-2026-62204 SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install
    go
  28. 4.9
    CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
    go
  29. 8.7
    CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
    go
  30. 7.5
    CVE-2026-76905 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
    go