Skip to content
Fencer Intel

All · packagist

Newest first, late arrivals on top. Also a feed.

  1. 5.3
    CVE-2026-30878 baserCMS: Mail Form Acceptance Bypass via Public API
    packagist
  2. 9.1
    CVE-2026-30877 baserCMS: OS Command Injection in the baserCMS Update Functionality
    packagist
    EPSS 1.5% chance of exploitation in 30 days, percentile 75%
  3. 9.8
    CVE-2026-30880 baserCMS: OS command injection vulnerability in installer
    packagist
    EPSS 2.1% chance of exploitation in 30 days, percentile 81%
  4. 9.8
    CVE-2026-27697 baserCMS: SQL injection vulnerability in blog post
    packagist
  5. 9.1
    CVE-2026-21861 baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)
    packagist
    EPSS 2.3% chance of exploitation in 30 days, percentile 83%
  6. 8.7
    CVE-2025-32957 baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)
    packagist
  7. 9.1
    CVE-2026-34558 CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
    packagist
  8. 9.1
    CVE-2026-34557 CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
    packagist
  9. 2.7
    CVE-2026-34372 Sulu checks fix permissions for subentities endpoints
    packagist
  10. 4.7
    CVE-2026-27599 CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
    packagist
  11. 7.5
    CVE-2026-56341 AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php
    packagist
  12. —
    GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
    packagist
  13. 8.2
    CVE-2026-34375 AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
    packagist
  14. 5.3
    CVE-2026-34369 AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
    packagist
  15. 5.3
    CVE-2026-34368 AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
    packagist
  16. 5.3
    CVE-2026-34364 AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
    packagist
  17. 6.5
    CVE-2026-34036 Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
    packagist
    EPSS 1.5% chance of exploitation in 30 days, percentile 74%
  18. 5.4
    CVE-2026-34362 AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
    packagist
  19. 5.4
    CVE-2026-34247 AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
    packagist
  20. 6.3
    CVE-2026-34245 AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
    packagist
  21. 6.5
    CVE-2026-33541 TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service
    packagist
  22. 5.4
    CVE-2026-33887 Statamic allows unauthorized content access through missing authorization in its revision controllers
    packagist
  23. 6.5
    CVE-2026-33886 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
    packagist
  24. 6.1
    CVE-2026-33885 Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
    packagist
  25. 4.3
    CVE-2026-33884 Statamic's live preview token bypasses content protection for unrelated entries
    packagist
  26. 6.1
    CVE-2026-33883 Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
    packagist
  27. 6.5
    CVE-2026-33882 Statamic's Markdown preview endpoint exposes sensitive user data
    packagist
  28. 7.5
    CVE-2026-33867 AVideo has Plaintext Video Password Storage
    packagist
  29. 9.8
    CVE-2026-33770 AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
    packagist
  30. 8.8
    CVE-2026-33767 AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
    packagist