Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 6.1
    CVE-2026-118656 Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
    go
  2. 5.9
    CVE-2026-118655 Echo: Static Middleware Double-Unescape Path Traversal
    go
  3. 5.9
    CVE-2026-118654 Echo static file middleware route protection bypass via encoded dot-dot traversal
    go
  4. 2.9
    CVE-2026-55458 Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
    go
  5. 5.3
    CVE-2026-118653 Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
    go
  6. 6.1
    CVE-2026-118652 Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
    go
  7. 5.3
    CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
    go
  8. 7.5
    CVE-2026-118650 Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
    go
  9. 5.3
    CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
    go
  10. 7.8
    CVE-2026-125323 pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
    go
  11. 5.3
    CVE-2026-128086 OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
    go
  12. 5.3
    CVE-2026-128085 opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes
    go
  13. 6.1
    CVE-2026-97045 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
    go
  14. 7.5
    CVE-2026-78661 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
    go
  15. 7.1
    CVE-2026-116683 CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
    go
  16. 8.6
    CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
    go
  17. 5.4
    CVE-2026-116679 Neko: Authorization bypass in legacy WebRTC input handling
    go
  18. 8.8
    CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
    go
  19. 6.5
    CVE-2026-54462 knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
    go
  20. 7.6
    CVE-2026-34157 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
    go
  21. 8.7
    CVE-2026-116591 compress zstd: Panic on two-block frames
    go
  22. 7.5
    CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys
    go
  23. 6.9
    CVE-2026-116586 Go JOSE: Panics in JSON parsing
    go
  24. 6.9
    CVE-2026-116585 Go JOSE: Panic during CBC-HMAC processing
    go
  25. 5.3
    CVE-2026-118265 Echo: X-Real-IP extractor trusts the header value instead of the sending peer
    go
  26. 8.2
    CVE-2026-118262 Echo: WebSocket proxy can retain connections and handlers after client disconnect
    go
  27. 8.2
    CVE-2026-118261 Echo: Decompress permits unbounded gzip expansion in v4
    go
  28. 9.1
    CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
    go
  29. 6.3
    CVE-2026-118263 Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
    go
  30. 8.2
    CVE-2026-118260 Echo: BodyDump captures request and response bodies without size limits in v4
    go