Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 5.8
    GHSA-xp3q-r38w-vgqm SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
    go
  2. 9.8
    CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder
    Node.jspypibitnamigo
    kev EPSS 82.6% chance of exploitation in 30 days, percentile 99.6%
  3. 4.8
    CVE-2026-114437 Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For
    go
  4. 7.5
    CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
    go
  5. 7.4
    CVE-2026-113727 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
    go
  6. —
    GHSA-953h-535j-jg2v agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
    go
  7. 6.8
    CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
    bitnamigocrates.io
  8. 8.8
    CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
    go
  9. 4.3
    CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
    go
  10. 7.5
    CVE-2026-102941 gomarkdown/markdown IsSafeURL panics on short URLs
    go
  11. 8.2
    CVE-2026-77622 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
    go
  12. 4.4
    CVE-2026-64672 Terragrunt catalog predictable temp symlink clobber
    go
  13. 7.5
    CVE-2026-100353 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
    go
  14. 7.5
    CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
    go
  15. 7.5
    CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
    go
  16. 7.4
    CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
    go
  17. 8.2
    CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
    go
  18. 5.3
    CVE-2026-100350 kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
    go
  19. 5.3
    CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
    go
  20. 5.3
    CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
    go
  21. 7.5
    CVE-2026-97394 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
    go
  22. 9.2
    CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
    go
  23. 9.9
    CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
    go
  24. 3.3
    CVE-2026-77564 Talos Linux: Support bundle does not redact registry credentials
    go
  25. 6.5
    CVE-2026-100394 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
    go
  26. 9.8
    CVE-2026-104252 Vitess vttablet /twopcz reflected XSS
    go
    EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  27. 6.8
    CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
    gobitnami
  28. 10.0
    CVE-2026-94603 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
    go
  29. 9.9
    CVE-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
    gobitnami
  30. 7.7
    CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
    go