Skip to content
Fencer Vulns

All · go

Newest first. Every view here is also a feed.

  1. 7.5
    CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
    go
  2. 7.4
    CVE-2026-113727 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
    go
  3. —
    GHSA-953h-535j-jg2v agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
    go
  4. 6.8
    CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
    bitnamigocrates.io
  5. 8.8
    CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
    go
  6. 4.3
    CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
    go
  7. 7.5
    CVE-2026-102941 gomarkdown/markdown IsSafeURL panics on short URLs
    go
  8. 8.2
    CVE-2026-77622 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
    go
  9. 4.4
    CVE-2026-64672 Terragrunt catalog predictable temp symlink clobber
    go
  10. 7.5
    CVE-2026-100353 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
    go
  11. 7.5
    CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
    go
  12. 7.5
    CVE-2026-100352 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
    go
  13. 7.4
    CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
    go
  14. 8.2
    CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
    go
  15. 5.3
    CVE-2026-100350 kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
    go
  16. 5.3
    CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
    go
  17. 5.3
    CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
    go
  18. 7.5
    CVE-2026-97394 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
    go
  19. 9.2
    CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
    go
  20. 9.9
    CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
    go
  21. 3.3
    CVE-2026-77564 Talos Linux: Support bundle does not redact registry credentials
    go
  22. 6.5
    CVE-2026-100394 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
    go
  23. 9.8
    CVE-2026-104252 Vitess vttablet /twopcz reflected XSS
    go
    EPSS 1.2% chance of exploitation in 30 days, percentile 67%
  24. 6.8
    CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
    gobitnami
  25. 10.0
    CVE-2026-94603 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
    go
  26. 9.9
    CVE-2026-77459 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
    gobitnami
  27. 7.7
    CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
    go
  28. 4.3
    CVE-2026-103028 SFTPGo source-side file-pattern filter bypass during copy operations
    go
  29. 6.5
    CVE-2026-77375 SFTPGo: Denial of service via malformed SSH channel request
    go
  30. 5.3
    CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint
    go