Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 8.5
    CVE-2026-59185 identrail: Cross-tenant GitHub installation binding without ownership verification
    go
  2. 7.8
    CVE-2026-59172 Joker linter executed project-local .jokerd/linter.* files during linting
    go
  3. 8.8
    GHSA-hxjg-93wc-h8p8 Komari: Management Interface CSRF
    go
  4. 6.5
    CVE-2026-59157 webhookd: Unrestricted HTTP Header to Shell Variable Injection
    go
  5. 6.8
    CVE-2026-53495 containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
    go
  6. 5.5
    CVE-2025-58363 LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint
    go
  7. 5.5
    CVE-2025-24979 LF Edge eKuiper: SSRF in External Service
    go
  8. 3.7
    CVE-2025-24978 LF Edge eKuiper: Self-XSS in External Service Creation
    go
  9. 8.7
    CVE-2026-84445 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
    go
  10. 6.5
    CVE-2026-86597 Sensitive information written to logs by Snowflake drivers
    npmpypigomaven
  11. 6.5
    CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool
    go
  12. 7.5
    CVE-2026-125327 pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
    go
  13. 5.8
    CVE-2026-125326 pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages
    go
  14. 5.9
    CVE-2026-125325 pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests
    go
  15. 5.8
    CVE-2026-125328 pgEdge Go LLM Library discloses provider API key fragments in error messages
    go
  16. 8.8
    CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile
    go
  17. 7.5
    CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
    go
  18. 7.5
    CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
    go
  19. 8.7
    CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
    go
  20. 6.3
    CVE-2026-84303 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
    go
  21. 4.9
    CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
    go
  22. 3.7
    CVE-2026-55785 free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
    go
  23. 7.5
    CVE-2026-55784 free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
    go
  24. 8.7
    CVE-2026-55764 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply
    go
  25. 6.9
    CVE-2026-55678 Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset
    go
  26. 8.7
    CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits
    go
  27. 7.5
    CVE-2026-55484 ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
    go
  28. 8.7
    CVE-2026-55245 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
    go
  29. 9.3
    CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
    go
  30. 5.0
    CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
    go