Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 5.9
    CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
    go
  2. 4.0
    CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
    go
  3. 4.0
    CVE-2026-107835 OWASP Coraza WAF: Cookie Parser Confusion
    go
  4. 4.0
    CVE-2026-107825 OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
    go
  5. 5.8
    CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
    go
  6. 7.5
    CVE-2026-107826 OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
    go
  7. 5.8
    CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
    go
  8. 5.5
    CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files
    go
  9. 6.5
    CVE-2026-107225 Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
    go
  10. 6.5
    CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
    go
  11. 7.5
    CVE-2026-107223 Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
    go
  12. 6.5
    CVE-2026-107222 Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
    go
  13. 6.5
    CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
    go
  14. 6.5
    CVE-2026-107220 Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
    go
  15. 7.5
    CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
    go
  16. 5.3
    CVE-2026-107218 Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
    go
  17. 7.5
    CVE-2026-107217 Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
    go
  18. 7.5
    CVE-2026-107216 Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
    go
  19. 7.5
    CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
    go
  20. 7.5
    CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
    go
  21. 5.5
    CVE-2026-107213 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
    go
  22. 7.5
    CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
    go
  23. 5.5
    CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
    go
  24. 9.8
    CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
    go
  25. 9.8
    CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
    go
  26. 8.1
    CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
    go
  27. 7.5
    CVE-2026-56851 Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
    go
  28. 7.2
    CVE-2026-41510 OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
    go
  29. 5.8
    CVE-2026-41508 OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
    go
  30. 5.8
    CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields
    go