Skip to content
Fencer Intel

All · packagist

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-45260 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
    packagist
  2. 8.0
    CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
    packagist
  3. 6.1
    CVE-2026-45065 Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
    packagist
  4. 9.1
    CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
    packagist
  5. 8.8
    CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
    packagist
  6. 8.7
    CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration
    packagist
  7. 8.8
    CVE-2026-44177 Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup
    packagist
    EPSS 1.8% chance of exploitation in 30 days, percentile 78%
  8. 6.0
    CVE-2026-44176 Kirby: `pages.access` permission is not checked during rendering of page drafts
    packagist
  9. 8.5
    CVE-2026-44175 Kirby: Cross-site scripting (XSS) from list field content in the site frontend
    packagist
  10. 8.7
    CVE-2026-44174 Kirby: Arbitrary Method Call via REST API search and collection query endpoints
    packagist
  11. 2.3
    CVE-2026-35202 Pterodactyl has a database resource limit bypass via race condition in Client API
    packagist
  12. 9.8
    CVE-2018-25357 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php
    packagist
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  13. 9.8
    CVE-2026-46670 YesWiki: Unauthenticated SQL Injection
    packagist
    EPSS 2.0% chance of exploitation in 30 days, percentile 81%
  14. 4.8
    CVE-2026-8353 Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme
    packagist
  15. 4.3
    CVE-2026-8347 Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog
    packagist
  16. 4.3
    CVE-2026-8340 Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion
    packagist
  17. 5.4
    CVE-2026-8139 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName
    packagist
  18. 6.4
    CVE-2026-7890 Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block
    packagist
  19. 8.8
    CVE-2026-8409 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
    packagist
  20. 8.8
    CVE-2026-8410 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
    packagist
  21. 8.8
    CVE-2026-8411 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
    packagist
  22. 8.8
    CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
    packagist
  23. 8.8
    CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
    packagist
  24. 6.5
    CVE-2026-46639 Twig: Sandbox property and method bypass via object-destructuring assignment
    packagist
  25. 8.8
    CVE-2026-8413 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
    packagist
  26. 8.8
    CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
    packagist
  27. 8.8
    CVE-2026-8415 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
    packagist
  28. 8.8
    CVE-2026-8416 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
    packagist
  29. 8.1
    CVE-2026-46638 Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
    packagist
  30. 5.4
    CVE-2026-46637 Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
    packagist