Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 7.1
    CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
    go
  2. 8.8
    CVE-2026-73802 Gitea Runner host isolation bypass through container options
    go
  3. —
    GHSA-5wf9-h793-w73c Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
    go
  4. 7.6
    CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
    Dockergo maintainer advisory
  5. 6.9
    CVE-2026-92542 Blind VXLAN injection into encrypted overlay networks from cluster peer
    Dockergo maintainer advisory
  6. 6.9
    CVE-2026-53493 Containerd has image-pull DoS via crafted OCI index graph amplification
    go
  7. 4.3
    CVE-2026-62286 Dozzle label filters do not restrict container event and statistics streams
    go
  8. 9.3
    CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
    go
  9. 8.2
    CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2
    go
  10. 8.7
    CVE-2026-85057 ZITADEL: Actions V1 sandbox escape: host file read via require()
    go
  11. 8.7
    CVE-2026-82405 Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
    go
  12. 8.4
    CVE-2026-82409 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
    go
  13. 7.0
    CVE-2026-82407 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
    go
  14. 7.5
    CVE-2026-86065 Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
    go
  15. 8.6
    CVE-2026-86064 Klever-Go: /log controls global node logging
    go
  16. 7.1
    CVE-2026-82406 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
    go
  17. 8.6
    GHSA-vxg7-f2jj-jmqm Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
    go
  18. 6.0
    CVE-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)
    gobitnami
  19. 9.2
    CVE-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
    gobitnami
  20. 2.4
    CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout
    gobitnami
  21. 5.5
    CVE-2026-79767 Gardener: Authorization Bypass via Group Subject Injection
    go
  22. 7.5
    CVE-2026-77322 SIPGO: DoS via unvalidated WebSocket frame length
    go
  23. 7.5
    CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser
    go
  24. 5.3
    CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
    go
  25. 4.7
    CVE-2026-76802 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
    go
  26. 5.5
    CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
    go
  27. 5.3
    CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass
    go
  28. 5.3
    CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
    go
  29. 3.8
    CVE-2026-77637 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope
    go
  30. 7.1
    CVE-2026-77633 Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
    go