Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-79913 Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
    go
  2. 4.3
    GHSA-jhjp-4c2q-xmx4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers
    go
  3. 8.8
    CVE-2026-62182 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
    go
  4. 8.1
    CVE-2026-62369 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
    go
  5. 6.5
    CVE-2026-62370 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
    go
  6. 8.8
    CVE-2026-62371 KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
    go
  7. 6.2
    CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
    go
  8. 6.2
    CVE-2026-62866 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`
    go
  9. 5.3
    CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
    go
  10. 6.9
    CVE-2026-77582 Tinyauth: User enumeration attack by timing oracle
    go
  11. 8.1
    CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
    go
  12. 5.8
    CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header
    go
  13. 4.3
    CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
    go
  14. 3.1
    CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
    go
  15. 7.1
    CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
    go
  16. 6.3
    CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
    go
  17. 4.1
    CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
    go
  18. 7.5
    CVE-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
    gobitnami
  19. 8.1
    CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
    go
  20. 7.5
    CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
    go
  21. 4.2
    CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window
    go
  22. 7.6
    CVE-2026-101064 Obot before v0.23.0 Server-Side Request Forgery via MCP
    go
  23. 5.3
    CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API
    go
  24. 8.8
    CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
    go
  25. 7.1
    CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal
    go
  26. 8.3
    CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure
    go
  27. 7.1
    CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources
    go
  28. 8.1
    CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
    go
  29. 5.9
    CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
    go
  30. 5.9
    CVE-2026-63405 AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
    go