Skip to content
Fencer Intel

All · packagist

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-28781 Craft Affected by Entries Authorship Spoofing via Mass Assignment
    packagist
  2. 9.1
    CVE-2026-28697 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
    packagist
    EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  3. 4.8
    CVE-2026-56393 Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
    packagist
  4. 7.5
    CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs
    packagist
  5. 7.2
    CVE-2026-28695 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
    packagist
  6. 9.8
    CVE-2026-29058 AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php
    packagist
    1 public exploit EPSS 8.9% chance of exploitation in 30 days, percentile 95%
  7. 9.8
    CVE-2026-27012 Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php
    packagist
  8. 9.1
    CVE-2026-26279 Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
    packagist
  9. 6.1
    CVE-2026-24415 OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
    packagist
  10. 7.2
    CVE-2026-28507 Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal
    packagist
  11. 8.6
    CVE-2026-28508 Idno: Unauthenticated SSRF via URL Unfurl Endpoint
    packagist
  12. 8.8
    CVE-2026-28502 WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
    packagist
  13. 9.8
    CVE-2026-28501 WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
    packagist
    1 public exploit EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  14. 8.7
    CVE-2026-28426 Statamic vulnerable to privilege escalation via stored cross-site scripting
    packagist
  15. 8.0
    CVE-2026-28425 Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
    packagist
  16. 6.5
    CVE-2026-28424 Statamic's missing authorization allows access to email addresses
    packagist
  17. 6.8
    CVE-2026-28423 Statamic Vulnerable to Server-Side Request Forgery via Glide
    packagist
  18. 8.8
    CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
    packagist
  19. 7.5
    CVE-2026-27836 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
    packagist
  20. 4.8
    CVE-2026-56383 Craft CMS - Stored XSS in Table Field via Row Heading Column Type
    packagist
  21. 4.8
    CVE-2026-3218 Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019
    packagist
  22. 6.1
    CVE-2026-3217 SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
    packagist
  23. 5.0
    CVE-2026-3216 Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
    packagist
  24. 5.4
    CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016
    packagist
  25. 6.5
    CVE-2026-3214 CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015
    packagist
  26. 4.7
    CVE-2026-3213 Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014
    packagist
  27. 5.4
    CVE-2026-3212 Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
    packagist
  28. 4.3
    CVE-2026-3211 Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
    packagist
  29. 5.3
    CVE-2026-3210 Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
    packagist
  30. 5.4
    CVE-2026-27621 TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
    packagist